Granted Patent B1

US 12,706,931 · App. 17/884,791 · Granted Aug 11, 2026

Inventors: Úlfar Erlingsson (Palo Alto, CA); Yijou Chen (Cupertino, CA)

Assignee: FORTINET, INC.

H04L63/1425G06F9/455G06F9/545G06F16/9024G06F16/9038G06F16/9535G06F16/9537G06F21/57H04L41/06H04L63/10H04L67/306H04L67/535G06F16/2456

Abstract

Claims (34)

1 . A method of identifying threats in event data, the method comprising:

receiving, via an event streaming platform, a plurality of records of event data;

generating, from at least a portion of the plurality of records of event data, a logical entity graph comprising nodes representing entities within a computing environment and edges representing behavioral relationships between the entities;

clustering nodes of the logical entity graph based on behavioral similarity to produce a behavioral model of the computing environment, the behavioral model comprising a polygraph representing aggregated behaviors of the entities;

establishing a behavioral baseline based on historical polygraphs representing prior behaviors of the entities;

identifying, based on the behavioral model, a deviation between current behavior represented in a current polygraph and the behavioral baseline;

identifying, based on the deviation, a record in the plurality of records of event data having one or more attributes matching one or more threat indicators obtained from one or more threat assessment resources; and

generating an alert based on the identified deviation and the identified record.

2 . The method of claim 1 , wherein the one or more attributes comprise one or more of: an internet protocol (IP) address, a hostname, or a file hash.

3 . The method of claim 1 , wherein generating the alert comprises providing, via the event streaming platform, data associated with the identified record to an alert generation platform.

4 . The method of claim 1 , wherein the plurality of records of event data are received from a data ingestion platform.

5 . The method of claim 4 , wherein the plurality of records of event data are generated by the data ingestion platform based on another plurality of records of event data received from one or more agents.

6 . The method of claim 1 , wherein filtering the plurality of records of event data comprises selecting, as the filtered set of records, a subset of the plurality of records describing one or more external network connections.

7 . The method of claim 1 , wherein identifying the record in the filtered set of records comprises querying, based on the filtered plurality of records, the one or more threat assessment resources.

8 . The method of claim 7 , further comprising caching data received from the one or more threat assessment resources.

9 . The method of claim 1 , further comprising adding one or more fields to the filtered plurality of records.

10 . The method of claim 9 , wherein the one or more fields comprises one or more of a hostname or a process identifier.

11 . A non-transitory computer readable medium having stored thereon a computer program product for identifying threats in event data, the computer program product comprising computer program instructions configurable to cause a computing system to:

receive, via an event streaming platform, a plurality of records of event data;

generate, from at least a portion of he plurality of records of event data, a logical entity graph comprising nodes representing entities within a computing environment and edges representing behavioral relationships between the entities;

cluster nodes of the logical entity graph based on behavioral similarity to produce a behavioral model of the computing environment, the behavioral model comprising a polygraph representing aggregated behaviors of the entities;

establish a behavioral baseline based on historical polygraphs representing prior behaviors of the entities;

identify, based on the behavioral model, a deviation between current behavior represented in a current polygraph and the behavioral baseline;

identify, based on the deviation, a record in the plurality of records of event data having one or more attributes matching one or more threat indicators obtained from one or more threat assessment resources; and

generate an alert based on the identified record.

12 . The non-transitory computer readable medium of claim 11 , wherein the one or more attributes comprise one or more of: an internet protocol (IP) address, a hostname, or a file hash.

13 . The non-transitory computer readable medium of claim 11 , wherein generating the alert comprises providing, via the event streaming platform, data associated with the identified record to an alert generation platform.

14 . The non-transitory computer readable medium of claim 11 , wherein the plurality of records of event data are received from a data ingestion platform.

15 . The non-transitory computer readable medium of claim 14 , wherein the plurality of records of event data are generated by the data ingestion platform based on another plurality of records of event data received from one or more agents.

16 . The non-transitory computer readable medium of claim 11 , wherein filtering the plurality of records of event data comprises selecting, as the filtered set of records, a subset of the plurality of records describing one or more external network connections.

17 . The non-transitory computer readable medium of claim 11 , wherein identifying the record in the filtered set of records comprises querying, based on the filtered plurality of records, the one or more threat assessment resources.

18 . The non-transitory computer readable medium of claim 17 , wherein the steps further comprise caching data received from the one or more threat assessment resources.

19 . The non-transitory computer readable medium of claim 11 , wherein the steps further comprise one or more fields to the filtered plurality of records.

20 . The non-transitory computer readable medium of claim 19 , wherein the one or more fields comprises one or more of a hostname or a process identifier.

Assignments (2)

Continuity (7)

References Cited (400)