AI cybersecurity system monitoring wireless data transmissions
A coordinator module, a cyber threat analyst module, and AI models trained to model a normal pattern of life for entities in a wireless domain and a normal pattern of life for entities in a second domain cooperate with a combination of wireless sensors with RF protocol adapters to monitor and analyze wireless activity and probes to monitor activity in the second domain in order to analyze an anomaly of interest in a wider view of another domain's activity. These modules and models understand and assess the wireless activity and the activity from the second domain in light of the AI models modelling the pattern of life for entities in a wireless domain and/or a in the second domain in order to detect a cyber threat indicated by at least by the anomaly of interest. A formatting model generates an alert and/or a report.
1. An Artificial Intelligence based cyber security system, comprising:
a coordinator module, a cyber threat analyst module, and one or more Artificial Intelligence models trained to model a normal pattern of life for entities in a wireless domain and a normal pattern of life for entities in a second domain are configured to cooperate with a combination of 1) wireless sensors with one or more Radio Frequency protocol adapters to monitor and analyze wireless activity, including wireless transmissions transmitted through airspace in the wireless domain, and 2) probes to monitor activity in the second domain, which includes any of i) an Information Technology network, ii) an Operational Technology network, iii) a Cloud service, iv) a SaaS service, v) an endpoint device, and vi) an email domain in order to analyze at least an anomaly of interest in one of 1) the wireless activity from the wireless sensors in view of the activity in the second domain from the probes, 2) the activity from the second domain from the probes in view of the wireless activity in the wireless domain from the wireless sensors, and 3) and any combination of both in order for the coordinator module, the cyber threat analyst module, and the one or more Artificial Intelligence models to cooperate to analyse the anomaly of interest in a wider view of another domain's activity;
where the coordinator module and the cyber threat analyst module are configured to cooperate to understand and assess the wireless activity from the wireless sensors as well as the activity from the second domain from the probes from the second domain in light of the one or more Artificial Intelligence models trained to model a normal pattern of life for entities in a wireless domain and a normal pattern of life for entities in a second domain in order to detect a cyber threat indicated by at least by the anomaly of interest, where the coordinator module and the cyber threat analyst module are implemented in hardware electronic components, software components, and any combination of both;
a formatting model is configured to generate at least one of i) an alert to a user and ii) a report that includes details of activities assessed to be relevant activities to the anomaly of interest to the user when a possibility of the cyber threat is above a threshold based upon input from the cyber threat analyst module, where the formatting model is configured to deliver the alert and/or the report via a medium of at least one of 1) a printable report, 2) presented digitally on a graphical user interface, 3) presented digitally in an email on a display, 4) presented digitally in a message on the display, and 5) in a machine readable format for further reinforcement of machine learning, where the Artificial Intelligence models and the formatting model are implemented in hardware electronic components, software components, and any combination of both;
where the anomaly of interest is a suspicious wireless transmission from a wireless transmission source;
where a portable hunter device is configured to have one or more wireless receivers, one or more antennas, one or more Radio Frequency protocol adapters, a battery, a directional indicator to the wireless transmission source as well as a signal strength of the suspicious wireless transmission that is the anomaly of interest from the wireless transmission source; and
where the portable hunter device is configured to factor in at least one of i) an increase of signal strength of the suspicious wireless transmission, ii) a decrease of signal strength of the suspicious wireless transmission that is the anomaly of interest from the wireless transmission source, and iii) any combination of both in determining a physical location of the wireless transmission source.
2. The Artificial Intelligence based cyber security system of claim 1 , further comprising:
where the anomaly of interest is a suspicious wireless transmission in the airspace from at least one of 1) transmitted from a wireless transmitter device, which was not known previously to the Artificial Intelligence models trained to model a normal pattern of life for entities in the wireless domain, and 2) transmitted in a frequency range not within frequency ranges associated with WiFi protocol standards known by the Artificial Intelligence models trained to model a normal pattern of life for entities in the wireless domain; and
a portable hunter device having one or more wireless receivers configured to allow an operator to physically move with the portable hunter device to determine a physical location of the wireless transmission source.
3. An Artificial Intelligence based cyber security system, comprising:
a coordinator module, a cyber threat analyst module, and one or more Artificial Intelligence models trained to model a normal pattern of life for entities in a wireless domain and a normal pattern of life for entities in a second domain are configured to cooperate with a combination of 1) wireless sensors with one or more Radio Frequency protocol adapters to monitor and analyze wireless activity, including wireless transmissions transmitted through airspace in the wireless domain, and 2) probes to monitor activity in the second domain, which includes any of i) an Information Technology network, ii) an Operational Technology network, iii) a Cloud service, iv) a SaaS service, v) an endpoint device, and vi) an email domain in order to analyze at least an anomaly of interest in one of 1) the wireless activity from the wireless sensors in view of the activity in the second domain from the probes, 2) the activity from the second domain from the probes in view of the wireless activity in the wireless domain from the wireless sensors, and 3) and any combination of both in order for the coordinator module, the cyber threat analyst module, and the one or more Artificial Intelligence models to cooperate to analyse the anomaly of interest in a wider view of another domain's activity;
where the coordinator module and the cyber threat analyst module are configured to cooperate to understand and assess the wireless activity from the wireless sensors as well as the activity from the second domain from the probes from the second domain in light of the one or more Artificial Intelligence models trained to model a normal pattern of life for entities in a wireless domain and a normal pattern of life for entities in a second domain in order to detect a cyber threat indicated by at least by the anomaly of interest, where the coordinator module and the cyber threat analyst module are implemented in hardware electronic components, software components, and any combination of both;
a formatting model is configured to generate at least one of i) an alert to a user and ii) a report that includes details of activities assessed to be relevant activities to the anomaly of interest to the user when a possibility of the cyber threat is above a threshold based upon input from the cyber threat analyst module, where the formatting model is configured to deliver the alert and/or the report via a medium of at least one of 1) a printable report, 2) presented digitally on a graphical user interface, 3) presented digitally in an email on a display, 4) presented digitally in a message on the display, and 5) in a machine readable format for further reinforcement of machine learning, where the Artificial Intelligence models and the formatting model are implemented in hardware electronic components, software components, and any combination of both;
where the anomaly of interest is a suspicious wireless transmission in the airspace from at least one of 1) transmitted from a wireless transmitter device, which was not known previously to the Artificial Intelligence models trained to model a normal pattern of life for entities in the wireless domain, where the Artificial Intelligence models are configured to use at least an unsupervised machine learning algorithm to update a training data for the Artificial Intelligence models trained to model a normal pattern of life in light of the wireless activity supplied by the wireless sensors, and 2) transmitted from a known wireless transmitter device, which is known previously to the Artificial Intelligence models trained to model the normal pattern of life for entities in the wireless domain, but is interacting with a wireless network that is not normally part of the wireless domain being protected by the cyber security system; and
where a portable hunter device having one or more wireless receivers is configured to cooperate with the one or more wireless sensors to find a physical location of the wireless transmitter device, where the portable hunter device is configured to use 1) a location of a wireless sensor closest to the suspicious wireless transmission in the airspace that is the anomaly of interest and 2) identifying details of the suspicious wireless transmission in the airspace that is the anomaly of interest in order to indicate a general geographical area of a source of the suspicious wireless could be in order to assist the portable hunter device in finding an exact physical location of the wireless transmitter device.
4. The Artificial Intelligence based cyber security system of claim 1 , where the coordinator module, the cyber threat analyst module, the formatting module, and the one or more Artificial Intelligence models trained to model the normal pattern of life for entities in the wireless domain and the normal pattern of life for entities in the second domain are located in a cyber security appliance,
where the formatting module is configured to generate the alert to the user on a user interface of the cyber security appliance and/or a device associated with the user whenever the anomaly of interest is a suspicious wireless transmission in the airspace from at least one of 1) transmitted from a wireless transmitter device, which was not known previously to the Artificial Intelligence models trained to model the normal pattern of life for entities in the wireless domain, and 2) transmitted from a known wireless transmitter device, which is known previously to the Artificial Intelligence models trained to model the normal pattern of life for entities in the wireless domain, but is interacting with a wireless network that is not normally part of the wireless domain being protected by the cyber security system; as well as
where the coordinator module is configured to determine how links exist between the wireless activities that include alerts, events and the suspicious wireless transmission, from the wireless domain to the activities that include alerts and events from the second domain supplied by the probes.
5. The Artificial Intelligence based cyber security system of claim 1 , further comprising:
where the cyber threat analyst module is further configured to cooperate with one or more AI models trained on how human cyber security analysts conduct cyber investigations to conduct initial investigations regarding at least the anomaly of interest, and then to collect additional information to form a chain of potentially related information under analysis from either prior wireless transmissions and/or activity from the second domain that have a probability above a threshold of a logical nexus to the anomaly of interest, where the cyber threat analyst module is configured to cooperate with the one or more Al models trained on how the human cyber security analysts conduct cyber investigations to form one or more hypotheses on potential cyber threats that could have this chain of potentially related information under analysis, where the cyber threat analyst module is configured to perform additional rounds of gathering additional information in order to refute or to support each of the one or more hypotheses to re-check cyber threat indications for the chain of potentially related information under analysis until the one or more hypotheses on potential cyber threats are one of refuted, supported, or included in the report that includes details of activities assessed to be relevant activities to the anomaly of interest to the user, and that also conveys at least a first hypothesis is neither supported or refuted; and thus, needs a human to further investigate the anomaly of interest.
6. The Artificial Intelligence based cyber security system of claim 1 , further comprising:
where the cyber threat analyst module is further configured to cooperate with a first Artificial Intelligence model trained to model the normal pattern of life for entities in the wireless domain supplied by the wireless sensors as well as a second Artificial Intelligence model trained to model the normal pattern of life for entities in the second domain from the probes from the second domain in order to autonomously investigate a combined activity from the wireless domain and activity from the second domain in order to support or refute one or more cyber threat hypotheses on whether the cyber threat has been detected, where the coordinator module is configured to assess activity including events occurring in the second domain compared to activity occurring in the wireless domain, where the first Artificial Intelligence model and the second Artificial Intelligence model are part of the one or more Artificial Intelligence models; and
where the cyber threat analyst module is configured to form and investigate the cyber threat hypotheses on what are a possible set of cyber threats, where the cyber threat analyst module is also configured to cooperate with one or more Al models trained on how human cyber security analysts conduct an investigation on a possible set of cyber threats hypotheses that would include at least the anomaly of interest, one or more scripts outlining how to conduct an investigation on a possible set of cyber threats hypotheses that would include at least the anomaly of interest, one or more rules based models on an investigation on a possible set of cyber threats hypotheses how to conduct an investigation on a possible set of cyber threats hypotheses that would include at least the anomaly of interest, and any combination of these, where the anomaly of interest was identified through cooperation with one or more Al models trained with machine learning on the normal pattern of life in the wireless domain.
7. The Artificial Intelligence based cyber security system of claim 1 , further comprising:
where a first wireless sensor is configured to have two or more Radio Frequency protocol adapters in order to be able to monitor the wireless transmissions in the airspace in the wireless domain consisting of various types of wireless transmissions both 1) a first type of wireless transmissions in a first known radio frequency protocol at a standard frequency range dictated by that first Radio Frequency protocol through to 2) a second known radio frequency protocol at a standard frequency range dictated by that second Radio Frequency protocol.
8. The Artificial Intelligence based cyber security system of claim 7 , where the two or more Radio Frequency protocol adapters are configured to include two or more Radio Frequency protocols from i) a WiFi protocol transmitted on 2.4 GHz channel, ii) a WiFi protocol transmitted on and 5 GHz channel, iii) a ZigBee or other mesh network protocol transmitted on a 2.4 GHz channel, iv) a ZigBee or other mesh network protocol transmitted on a 900 MHz channel, v) a ZigBee or other mesh network protocol transmitted on an 868 MHz channel; vi) a 4G protocol transmitted on a 600 MHz channel, vii) a 4G protocol transmitted on a 700 MHz channel, viii) a 4G protocol transmitted on a 1.7 GHZ channel, ix) a 4G protocol transmitted on a 2.1 GHz channel, x) a 4G protocol transmitted on a 2.3 GHZ channel, xi) a 4G protocol transmitted on a 2.5 GHz channel; xii) a 5G protocol in a first frequency range from 450 MHz to 6 GHZ, xiii) a 5G protocol in a second frequency range from 24.25 GHz to 52.6 GHZ, as well as xiv) a Z-Wave protocol transmitted on an 800-900 MHz frequency range, and
where each different radio frequency protocol adapter is configured both i) to understand one or more particular radio frequency protocols and ii) to have one or more frequency filters, where a first radio frequency protocol adapter is configured to cooperate with one or more antennas in the first wireless sensor to capture the wireless transmissions in the one or more particular radio frequency protocols.
9. The Artificial Intelligence based cyber security system of claim 1 , further comprising:
where a first wireless sensor has one or more radio frequency adapters that have wireless receivers configured to pull down raw data information from a first wireless transmission in the airspace in the wireless domain as well as one or more algorithms, a memory, and one or more processors, configured to then make an initial meta data analysis of the first wireless transmission in the airspace in the wireless domain.
10. A method for an Artificial Intelligence based cyber security system, comprising:
configuring a coordinator module, a cyber threat analyst module, and one or more Artificial Intelligence models trained to model a normal pattern of life for entities in a wireless domain and a normal pattern of life for entities in a second domain to cooperate with a combination of 1) wireless sensors with one or more Radio Frequency protocol adapters to monitor and analyze wireless activity, including wireless transmissions transmitted through airspace in the wireless domain, and 2) probes to monitor activity in the second domain, which includes any of i) an Information Technology network, ii) an Operational Technology network, iii) a Cloud service, iv) a SaaS service, v) an endpoint device, and vi) an email domain in order to analyze at least an anomaly of interest in one of 1) the wireless activity from the wireless sensors in view of the activity in the second domain from the probes, 2) the activity from the second domain from the probes in view of the wireless activity in the wireless domain from the wireless sensors, and 3) and any combination of both in order for the coordinator module, the cyber threat analyst module, and the one or more Artificial Intelligence models to cooperate to analyse the anomaly of interest in a wider view of another domain's activity;
configuring the coordinator module and the cyber threat analyst module to cooperate to understand and assess the wireless activity from the wireless sensors as well as the activity from the second domain from the probes from the second domain in light of the one or more Artificial Intelligence models trained to model a normal pattern of life for entities in the wireless domain and a normal pattern of life for entities in a second domain in order to detect a cyber threat indicated by at least by the anomaly of interest, where the coordinator module and the cyber threat analyst module are implemented in hardware electronic components, software components, and any combination of both;
configuring a formatting model to generate at least one of i) an alert to a user and ii) a report that includes details of activities assessed to be relevant activities to the anomaly of interest to the user when a possibility of the cyber threat is above a threshold based upon input from the cyber threat analyst module, where the formatting model is configured to deliver at least one of the alert and the report via a medium of at least one of 1) a printable report, 2) presented digitally on a graphical user interface, 3) presented digitally in an email on a display, 4) presented digitally in a message on the display, and 5) in a machine readable format for further reinforcement of machine learning, where the Artificial Intelligence models and the formatting model are implemented in hardware electronic components, software components, and any combination of both;
configuring where the coordinator module, the cyber threat analyst module, the formatting module, and the one or more Artificial Intelligence models trained to model the normal pattern of life for entities in the wireless domain and the normal pattern of life for entities in the second domain to be located in a cyber security appliance;
configuring the formatting module to generate the alert to the user on a user interface of at least one of the cyber security appliance and a device associated with the user, whenever the anomaly of interest is a suspicious wireless transmission in the airspace from at least one of 1) transmitted from a wireless transmitter device, which was not known previously to the Artificial Intelligence models trained to model the normal pattern of life for entities in the wireless domain, and 2) transmitted from a known wireless transmitter device, which is known previously to the Artificial Intelligence models trained to model the normal pattern of life for entities in the wireless domain, but is interacting with a wireless network that is not normally part of the wireless domain being protected by the cyber security system; as well as
configuring the coordinator module to determine how links exist between the wireless activities that include alerts, events and the suspicious wireless transmission, from the wireless domain to the activities that include alerts and events from the second domain supplied by the probes.
11. The method for the Artificial Intelligence based cyber security system of claim 10 , further comprising:
where the anomaly of interest is the suspicious wireless transmission in the airspace from at least one of 1) transmitted from a wireless transmitter device, which was not known previously to the Artificial Intelligence models trained to model a normal pattern of life for entities in the wireless domain, and 2) transmitted in a frequency range not within frequency ranges associated with WiFi protocol standards known by the Artificial Intelligence models trained to model a normal pattern of life for entities in the wireless domain; and
configuring a portable hunter device having one or more wireless receivers to allow an operator to physically move with the portable hunter device to determine a physical location of a wireless transmission source of the suspicious wireless transmission.
12. The method for the Artificial Intelligence based cyber security system of claim 10 , further comprising:
configuring the Artificial Intelligence models to use at least an unsupervised machine learning algorithm to update a training data for the Artificial Intelligence models trained to model a normal pattern of life in light of the wireless activity supplied by the wireless sensors;
where the anomaly of interest is a suspicious wireless transmission in the airspace from at least one of 1) transmitted from a wireless transmitter device, which was not known previously to the Artificial Intelligence models trained to model a normal pattern of life for entities in the wireless domain, and 2) transmitted from a known wireless transmitter device, which is known previously to the Artificial Intelligence models trained to model the normal pattern of life for entities in the wireless domain, but is interacting with a wireless network that is not normally part of the wireless domain being protected by the cyber security system;
configuring a portable hunter device having one or more wireless receivers to cooperate with the one or more wireless sensors to find a physical location of the wireless transmitter device; and
configuring the portable hunter device to use 1) a location of a wireless sensor closest to the suspicious wireless transmission in the airspace that is the anomaly of interest and 2) identifying details of the suspicious wireless transmission in the airspace that is the anomaly of interest in order to indicate a general geographical area of where a wireless transmission source of the suspicious wireless transmission could be in order to assist the portable hunter device in finding an exact physical location of the wireless transmitter device.
13. The method for the Artificial Intelligence based cyber security system of claim 10 , further comprising:
where the anomaly of interest is a suspicious wireless transmission from a wireless transmission source;
configuring a portable hunter device to have one or more wireless receivers, one or more antennas, one or more Radio Frequency protocol adapters, a battery, a directional indicator to the wireless transmission source as well as a signal strength of the suspicious wireless transmission that is the anomaly of interest from the wireless transmission source; and
configuring the portable hunter device to factor in at least one of i) an increase of signal strength of the suspicious wireless transmission, ii) a decrease of signal strength of the suspicious wireless transmission that is the anomaly of interest from the wireless transmission source, and iii) any combination of both in determining a physical location of the wireless transmission source.
14. The method for the Artificial Intelligence based cyber security system of claim 10 , further comprising:
configuring the cyber threat analyst module to cooperate with one or more Al models trained on how human cyber security analysts conduct cyber investigations to conduct initial investigations regarding at least the anomaly of interest, and then to collect additional information to form a chain of potentially related information under analysis from either prior wireless transmissions and/or activity from the second domain that have a probability above a threshold of a logical nexus to the anomaly of interest;
configuring the cyber threat analyst module to cooperate with the one or more Al models trained on how the human cyber security analysts conduct cyber investigations to form one or more hypotheses on potential cyber threats that could have this chain of potentially related information under analysis; and
configuring the cyber threat analyst module to perform additional rounds of gathering additional information in order to refute or to support each of the one or more hypotheses to re-check cyber threat indications for the chain of potentially related information under analysis until the one or more hypotheses on potential cyber threats are one of refuted, supported, or included in the report that includes details of activities assessed to be relevant activities to the anomaly of interest to the user but that also conveys at least a first hypothesis is neither supported or refuted; and thus, needs a human to further investigate the anomaly of interest.
15. The method for the Artificial Intelligence based cyber security system of claim 10 , further comprising:
configuring the cyber threat analyst module to cooperate with a first Artificial Intelligence model trained to model the normal pattern of life for entities in the wireless domain supplied by the wireless sensors as well as a second Artificial Intelligence model trained to model the normal pattern of life for entities in the second domain from the probes from the second domain in order to autonomously investigate a combined activity from the wireless domain and activity from the second domain in order to support or refute one or more cyber threat hypotheses on whether the cyber threat has been detected, where the first Artificial Intelligence model and the second Artificial Intelligence model are part of the one or more Artificial Intelligence models;
configuring where the coordinator module to assess activity including events occurring in the second domain compared to activity occurring in the wireless domain; and
configuring the cyber threat analyst module to form and investigate the cyber threat hypotheses on what are a possible set of cyber threats, where the cyber threat analyst module is also configured to cooperate with one or more Al models trained on how human cyber security analysts conduct an investigation on a possible set of cyber threats hypotheses that would include at least the anomaly of interest, one or more scripts outlining how to conduct an investigation on a possible set of cyber threats hypotheses that would include at least the anomaly of interest, one or more rules based models on an investigation on a possible set of cyber threats hypotheses how to conduct an investigation on a possible set of cyber threats hypotheses that would include at least the anomaly of interest, and any combination of these, where the anomaly of interest was identified through cooperation with one or more Al models trained with machine learning on the normal pattern of life in the wireless domain.
16. The method for the Artificial Intelligence based cyber security system of claim 10 , further comprising:
configuring a first wireless sensor to have two or more Radio Frequency protocol adapters in order to be able to monitor the wireless transmissions in the airspace in the wireless domain consisting of various types of wireless transmissions both 1) a first type of wireless transmissions in a first known radio frequency protocol at a standard frequency range dictated by that first Radio Frequency protocol through to 2) a second known radio frequency protocol at a standard frequency range dictated by that second Radio Frequency protocol.
17. The method for the Artificial Intelligence based cyber security system of claim 10 , further comprising:
configuring a first wireless sensor to have one or more radio frequency adapters that have wireless receivers configured to pull down raw data information from a first wireless transmission in the airspace in the wireless domain as well as one or more algorithms, a memory, and one or more processors, configured to then make an initial meta data analysis of the first wireless transmission in the airspace in the wireless domain.
18. A machine readable medium configured to store instructions and data to be executed by one or more processors, where the instructions when executed cause a cyber security appliance to perform steps as follows, comprising:
causing a coordinator module, a cyber threat analyst module, and one or more Artificial Intelligence models trained to model a normal pattern of life for entities in a wireless domain and a normal pattern of life for entities in a second domain to cooperate with a combination of 1) wireless sensors with one or more Radio Frequency protocol adapters to monitor and analyze wireless activity, including wireless transmissions transmitted through airspace in the wireless domain, and 2) probes to monitor activity in the second domain, which includes any of i) an Information Technology network, ii) an Operational Technology network, iii) a Cloud service, iv) a SaaS service, v) an endpoint device, and vi) an email domain in order to analyze at least an anomaly of interest in one of 1) the wireless activity from the wireless sensors in view of the activity in the second domain from the probes, 2) the activity from the second domain from the probes in view of the wireless activity in the wireless domain from the wireless sensors, and 3) and any combination of both in order for the coordinator module, the cyber threat analyst module, and the one or more Artificial Intelligence models to cooperate to analyse the anomaly of interest in a wider view of another domain's activity;
causing the coordinator module and the cyber threat analyst module to cooperate to understand and assess the wireless activity from the wireless sensors as well as the activity from the second domain from the probes from the second domain in light of the one or more Artificial Intelligence models trained to model a normal pattern of life for entities in a wireless domain and a normal pattern of life for entities in a second domain in order to detect a cyber threat indicated by at least by the anomaly of interest, where the coordinator module and the cyber threat analyst module are implemented in hardware electronic components, software components, and any combination of both;
causing a formatting model to generate at least one of i) an alert to a user and ii) a report that includes details of activities assessed to be relevant activities to the anomaly of interest to the user when a possibility of the cyber threat is above a threshold based upon input from the cyber threat analyst module, where the formatting model is configured to deliver at least one of the alert and the report via a medium of at least one of 1) a printable report, 2) presented digitally on a graphical user interface, 3) presented digitally in an email on a display, 4) presented digitally in a message on the display, and 5) in a machine readable format for further reinforcement of machine learning, where the Artificial Intelligence models and the formatting model are implemented in hardware electronic components, software components, and any combination of both;
causing a cyber threat analyst module to cooperate with one or more Al models trained on how human cyber security analysts conduct cyber investigations to conduct initial investigations regarding at least the anomaly of interest, and then to collect additional information to form a chain of potentially related information under analysis from either prior wireless transmissions and/or activity from the second domain that have a probability above a threshold of a logical nexus to the anomaly of interest;
causing the cyber threat analyst module to cooperate with the one or more Al models trained on how the human cyber security analysts conduct cyber investigations to form one or more hypotheses on potential cyber threats that could have this chain of potentially related information under analysis; and
causing the cyber threat analyst module to perform additional rounds of gathering additional information in order to refute or to support each of the one or more hypotheses to re-check cyber threat indications for the chain of potentially related information under analysis until the one or more hypotheses on potential cyber threats are one of refuted, supported, or included in the report that includes details of activities assessed to be relevant activities to the anomaly of interest to the user but that also conveys at least a first hypothesis is neither supported or refuted; and thus, needs a human to further investigate the anomaly of interest.