Granted Patent B2

US 12,229,263 · App. 18/130,167 · Granted Feb 18, 2025

Inventors: Brian P. Murphy (Tampa, FL); Joe Partlow (Tampa, FL); Colin O′Connor (Tampa, FL); Jason Pfeiffer (Tampa, FL); Brian Philip Murphy (St. Petersburg, FL)

Assignee: RELIAQUEST HOLDINGS, LLC

G06F21/566H04L63/1416H04L63/1441H04L63/20G06F2221/034

Abstract

Claims (138)

1. A computer-implemented method, executed on a computing device, comprising:

monitoring and logging activity with respect to a computing platform by a plurality of security-relevant subsystems;

detecting a plurality of detection events by the plurality of security-relevant subsystems;

receiving the plurality of detection events concerning a plurality of security events occurring on two or more of the plurality of security-relevant subsystems within the computing platform, wherein the plurality of security events are detected on the plurality of security-relevant subsystems via detection rules native to, and executed on, each of the respective plurality of security-relevant subsystems;

associating one or more artifacts with each of the plurality of detection events;

identifying two or more associated detection events included within the plurality of detection events, including identifying two or more detection events included within the plurality of detection events that have common artifacts/log entries;

grouping the two or more associated detection events to define a security incident, including:

grouping the one or more overlapping artifacts/log entries associated with each of the two or more associated detection events resulting in identifying the two or more associated detection events; and

grouping differing artifacts/log entries associated with each of the two or more associated detection events that did not result in identifying the two or more associated detection events;

processing an event repository including at least a portion of the grouped associated detection events to define one or more identified attack patterns;

one or more of defining a new detection rule and modifying an existing detection rule based upon one or more identified attack patterns; and

automatically initiating an investigation of current activity within the computing platform based upon the current activity being similar to one or more of the identified attack patterns as part of remedial action.

2. The computer-implemented method of claim 1 wherein the plurality of security events includes one or more of:

Denial of Service (DOS) events;

Distributed Denial of Service DDOS events;

Man-in-the-Middle (MitM) events;

phishing events;

Password Attack events;

SQL Injection events;

Cross-Site Scripting (XSS) events;

Insider Threat events;

spamming events;

malware events;

web attacks; and

exploitation events.

3. The computer-implemented method of claim 1 wherein the security-relevant subsystem includes one or more of:

CDN (i.e., Content Delivery Network) systems;

DAM (i.e., Database Activity Monitoring) systems;

UBA (i.e., User Behavior Analytics) systems;

MDM (i.e., Mobile Device Management) systems;

IAM (i.e., Identity and Access Management) systems;

DNS (i.e., Domain Name Server) systems;

Antivirus systems;

operating systems;

data lakes;

data logs;

security-relevant software applications;

security-relevant hardware systems; and

resources external to the computing platform.

4. The computer-implemented method of claim 1 further comprising:

receiving one or more additional detection events concerning one or more additional security events occurring on the two or more security-relevant subsystems within the computing platform; and

adding the one or more additional detection events to the security incident if the one or more additional detection events are related to the two or more associated detection events.

5. The computer-implemented method of claim 1 further comprising:

normalizing the plurality of detection events into a common ontology.

6. The computer-implemented method of claim 5 wherein normalizing the plurality of detection events into a common ontology includes:

translating a syntax of each of the plurality of detection events into a common syntax.

7. A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:

monitoring and logging activity with respect to a computing platform by a plurality of security-relevant subsystems;

detecting a plurality of detection events by the plurality of security-relevant subsystems;

receiving the plurality of detection events concerning a plurality of security events occurring on two or more of the plurality of security-relevant subsystems within the computing platform, wherein the plurality of security events are detected on the plurality of security-relevant subsystems via detection rules native to, and executed on, each of the respective plurality of security-relevant subsystems;

associating one or more artifacts with each of the plurality of detection events;

identifying two or more associated detection events included within the plurality of detection events, including identifying two or more detection events included within the plurality of detection events that have common artifacts/log entries;

grouping the two or more associated detection events to define a security incident, including:

grouping the one or more overlapping artifacts/log entries associated with each of the two or more associated detection events resulting in identifying the two or more associated detection events; and

grouping differing artifacts/log entries associated with each of the two or more associated detection events that did not result in identifying the two or more associated detection events;

processing an event repository including at least a portion of the grouped associated detection events to define one or more identified attack patterns;

one or more of defining a new detection rule and modifying an existing detection rule based upon one or more identified attack patterns; and

automatically initiating an investigation of current activity within the computing platform based upon the current activity being similar to one or more of the identified attack patterns as part of remedial action.

8. The computer program product of claim 7 wherein the plurality of security events includes one or more of:

Denial of Service (DOS) events;

Distributed Denial of Service DDOS events;

Man-in-the-Middle (MitM) events;

phishing events;

Password Attack events;

SQL Injection events;

Cross-Site Scripting (XSS) events;

Insider Threat events;

spamming events;

malware events;

web attacks; and

exploitation events.

9. The computer program product of claim 7 wherein the security-relevant subsystem includes one or more of:

CDN (i.e., Content Delivery Network) systems;

DAM (i.e., Database Activity Monitoring) systems;

UBA (i.e., User Behavior Analytics) systems;

MDM (i.e., Mobile Device Management) systems;

IAM (i.e., Identity and Access Management) systems;

DNS (i.e., Domain Name Server) systems;

Antivirus systems;

operating systems;

data lakes;

data logs;

security-relevant software applications;

security-relevant hardware systems; and

resources external to the computing platform.

10. The computer program product of claim 7 further comprising:

receiving one or more additional detection events concerning one or more additional security events occurring on the two or more security-relevant subsystems within the computing platform; and

adding the one or more additional detection events to the security incident if the one or more additional detection events are related to the two or more associated detection events.

11. The computer program product of claim 7 further comprising:

normalizing the plurality of detection events into a common ontology.

12. The computer program product of claim 11 wherein normalizing the plurality of detection events into a common ontology includes:

translating a syntax of each of the plurality of detection events into a common syntax.

13. A computing system including a processor and memory configured to perform operations comprising:

monitoring and logging activity with respect to a computing platform by a plurality of security-relevant subsystems;

detecting a plurality of detection events by the plurality of security-relevant subsystems;

receiving the plurality of detection events concerning a plurality of security events occurring on two or more of the plurality of security-relevant subsystems within the computing platform, wherein the plurality of security events are detected on the plurality of security-relevant subsystems via detection rules native to, and executed on, each of the respective plurality of security-relevant subsystems;

associating one or more artifacts with each of the plurality of detection events;

identifying two or more associated detection events included within the plurality of detection events, including identifying two or more detection events included within the plurality of detection events that have common artifacts/log entries;

grouping the two or more associated detection events to define a security incident, including:

grouping the one or more overlapping artifacts/log entries associated with each of the two or more associated detection events resulting in identifying the two or more associated detection events; and

grouping differing artifacts/log entries associated with each of the two or more associated detection events that did not result in identifying the two or more associated detection events;

processing an event repository including at least a portion of the grouped associated detection events to define one or more identified attack patterns;

one or more of defining a new detection rule and modifying an existing detection rule based upon one or more identified attack patterns; and

automatically initiating an investigation of current activity within the computing platform based upon the current activity being similar to one or more of the identified attack patterns as part of remedial action.

14. The computing system of claim 13 wherein the plurality of security events includes one or more of:

Denial of Service (DOS) events;

Distributed Denial of Service DDOS events;

Man-in-the-Middle (MitM) events;

phishing events;

Password Attack events;

SQL Injection events;

Cross-Site Scripting (XSS) events;

Insider Threat events;

spamming events;

malware events;

web attacks; and

exploitation events.

15. The computing system of claim 13 wherein the security-relevant subsystem includes one or more of:

CDN (i.e., Content Delivery Network) systems;

DAM (i.e., Database Activity Monitoring) systems;

UBA (i.e., User Behavior Analytics) systems;

MDM (i.e., Mobile Device Management) systems;

IAM (i.e., Identity and Access Management) systems;

DNS (i.e., Domain Name Server) systems;

Antivirus systems;

operating systems;

data lakes;

data logs;

security-relevant software applications;

security-relevant hardware systems; and

resources external to the computing platform.

16. The computing system of claim 13 further comprising:

receiving one or more additional detection events concerning one or more additional security events occurring on the two or more security-relevant subsystems within the computing platform; and

adding the one or more additional detection events to the security incident if the one or more additional detection events are related to the two or more associated detection events.

17. The computing system of claim 13 further comprising:

normalizing the plurality of detection events into a common ontology.

18. The computing system of claim 17 wherein normalizing the plurality of detection events into a common ontology includes:

translating a syntax of each of the plurality of detection events into a common syntax.

Assignments (2)

Continuity (2)

References Cited (60)