Granted Patent B2

US 11,165,801 · App. 15/998,423 · Granted Nov 2, 2021

Inventors: Christopher B. Cullison (Westminster, MD); Michael Price (Baltimore, MD); James Foster (Baltimore, MD)

Assignee: ZeroFOX, Inc.

H04L63/1425H04L51/12H04L51/32H04L63/1416

Abstract

Claims (62)

1. A computer-implemented method comprising:

scanning data that is maintained on multiple social networks, wherein the data that is maintained on multiple social networks is known to be associated with a protected social entity, wherein scanning comprises identifying, by one or more processors, a first security threat that is associated with the protected social entity;

scanning data maintained on one or more additional platforms, wherein the data maintained on one or more additional platforms is known to be associated with the protected social entity, wherein scanning comprises identifying, by one or more processors, a second security threat that is associated with the protected social entity;

wherein, scanning data is performed on a continuous basis, without user initiation;

determining one or more characteristics of the first security threat and second security threat;

generating, for each of the one or more characteristics, a reference to the respective security threat that indicates the characteristic;

comparing the one or more generated references of the first security threat to the one or more generated references of the second security threat;

determining, based on the comparison, a correlation score that reflects a level of similarity between the first and second security threat; and

generating, based on the determined correlation score, a threat level indicator.

2. The method of claim 1 wherein scanning data maintained on one or more additional platforms, comprises scanning data maintained by an email service.

3. The method of claim 1 further comprising:

comparing the threat indicator level to a threshold; and

in response to the threat indicator level exceeding the threshold, initiating a security action.

4. The method of claim 3 wherein initiating the security action comprises:

generating an alert; and

providing the alert to the protected social entity.

5. The method of claim 4 wherein providing the alert to the protected social entity comprises providing a computer-based alert to the protected social entity.

6. The method of claim 5 wherein providing a computer-based alert to the protected social entity comprises emailing the protected social entity.

7. A system comprising:

one or more processing devices; and

one or more non-transitory computer-readable media coupled to the one or more processing devices having instructions stored thereon which, when executed by the one or more processing devices, cause the one or more processing devices to perform operations comprising:

scanning data that is maintained on multiple social networks, wherein the data that is maintained on multiple social networks is known to be associated with a protected social entity, wherein scanning comprises identifying, by one or more processors, a first security threat that is associated with the protected social entity;

scanning data maintained on one or more additional platforms, wherein the data maintained on one or more additional platforms is known to be associated with the protected social entity, wherein scanning comprises identifying, by one or more processors, a second security threat that is associated with the protected social entity;

wherein, scanning data is performed on a continuous basis, without user initiation;

determining one or more characteristics of the first security threat and second security threat;

generating, for each of the one or more characteristics, a reference to the respective security threat that indicates the characteristic;

comparing the one or more generated references of the first security threat to the one or more generated references of the second security threat;

determining, based on the comparison, a correlation score that reflects a level of similarity between the first and second security threat; and

generating, based on the determined correlation score, a threat level indicator.

8. The system of claim 7 further comprising storing one or more references to the respective security threats in one or more databases that are accessible to a security analysis engine.

9. The system of claim 7 further comprising:

comparing the threat indicator level to a threshold; and

in response to the threat indicator level exceeding the threshold, initiating a security action.

10. The system of claim 9 wherein initiating the security action comprises:

generating an alert; and

providing the alert to the protected social entity.

11. The system of claim 10 wherein providing the alert to the protected social entity comprises providing a computer-based alert to the protected social entity.

12. The system of claim 11 wherein providing a computer-based alert to the protected social entity comprises emailing the protected social entity.

13. A non-transitory computer-readable storage medium encoded with a computer program, the program comprising instructions that when executed by a data processing apparatus cause the data processing apparatus to perform operations comprising:

scanning data that is maintained on multiple social networks, wherein the data that is maintained on multiple social networks is known to be associated with a protected social entity, wherein scanning comprises identifying, by one or more processors, a first security threat that is associated with the protected social entity;

scanning data maintained on one or more additional platforms, wherein the data maintained on one or more additional platforms is known to be associated with the protected social entity, wherein scanning comprises identifying, by one or more processors, a second security threat that is associated with the protected social entity;

wherein, scanning data is performed on a continuous basis, without user initiation;

determining one or more characteristics of the first security threat and second security threat;

generating, for each of the one or more characteristics, a reference to the respective security threat that indicates the characteristic;

comparing the one or more generated references of the first security threat to the one or more generated references of the second security threat;

determining, based on the comparison, a correlation score that reflects a level of similarity between the first and second security threat; and

generating, based on the determined correlation score, a threat level indicator.

14. The non-transitory computer-readable storage medium of claim 13 further comprising:

comparing the threat indicator level to a threshold; and

initiating a security action if the threat indicator level exceeds the threshold.

15. The non-transitory computer-readable storage medium of claim 14 wherein initiating the security action comprises:

generating an alert; and

providing the alert to the protected social entity.

16. The non-transitory computer-readable storage medium of claim 15 wherein providing the alert to the protected social entity comprises providing a computer-based alert to the protected social entity.

17. The method of claim 1 further comprising:

scanning data that is maintained in a published disclosure file, wherein scanning comprises identifying, by one or more processors, a third security threat that is associated with a protected social entity;

determining one or more characteristics of the third security threat;

generating, for each of the one or more characteristics, a reference to the security threat that indicates the characteristic;

comparing the one or more generated references of the first security threat and second security threat to the one or more generated references of the third security threat;

determining, based on the comparison, a match;

generating, based on the determined match, an alert; and

providing the alert to the protected social entity.

Assignments (10)

Continuity (2)