Granted Patent B2

US 12,388,865 · App. 18/305,898 · Granted Aug 12, 2025

Inventor: Awalin Nabila Sopan (Reston, VA)

Assignee: GOOGLE LLC

H04L63/1466G06F11/327G06F18/24G06N20/00

Abstract

Claims (49)

1. A computer-implemented method to perform self-learning for a predictive machine learning model of a cyber-security alert system, the method comprising:

obtaining, by a computing system, the predictive machine learning model, the predictive machine learning model trained based on data in a knowledge store;

receiving, by the computing system, an alert associated with a monitored network;

classifying, by the computing system, the received alert according to the predictive machine learning model to generate at least one alert classification;

automatically generating, by the computing system, a one or more recommended actions responsive to, and associated with, the received alert based on the alert classification;

automatically causing, by the computing system, execution of the one or more recommended actions;

updating, by the computing system, the knowledge store to include a result of the one or more recommended actions in the knowledge store; and

generating an updated predictive machine learning model based on the updated knowledge store.

2. The computer-implemented method of claim 1 , wherein the result indicates a success or failure of the one or more recommended actions.

3. The computer-implemented method of claim 1 , further comprising surfacing, by the computing system, the at least one alert classification or the one or more recommended actions for modification by an analyst.

4. The computer-implemented method of claim 3 , wherein said surfacing is performed in response to the result of the one or more recommended actions indicating a failure of the one or more recommended actions.

5. The computer-implemented method of claim 3 , further comprising, prior to generating the updated predictive machine learning model: updating the knowledge store based on a modification entered by the analyst.

6. The computer-implemented method of claim 1 , wherein the predictive machine learning model comprises an artificial neural network.

7. The computer-implemented method of claim 1 , wherein the predictive machine learning model generates a confidence score for the at least one alert classification and wherein automatically causing, by the computing system, execution of the one or more recommended actions occurs in response to the confidence score exceeding a confidence threshold.

8. The computer-implemented method of claim 1 , wherein the one or more recommended actions comprise communication with a conventional external computing device that is configured to effectuate the one or more recommended actions.

9. The computer-implemented method of claim 8 , wherein said communication occurs via an Application Programming Interface (API) call.

10. A computing system configured to perform a self-learning loop for a predictive machine learning model of a cyber-security alert system, the computing system comprising:

one or more processors; and

one or more non-transitory computer-readable media that collectively store:

a knowledge store;

a predictive machine learning model; and

instructions that, when executed by the one or more processors cause the computing system to perform operations, the operations comprising:

obtaining, by the computing system, the predictive machine learning model, the predictive machine learning model trained based on data in the knowledge store;

receiving, by the computing system, an alert associated with a monitored network;

classifying, by the computing system, the received alert according to the predictive machine learning model to generate at least one alert classification;

automatically generating, by the computing system, a one or more recommended actions responsive to, and associated with, the received alert based on the alert classification;

automatically causing, by the computing system, execution of the one or more recommended actions;

updating, by the computing system, the knowledge store to include a result of the one or more recommended actions in the knowledge store; and

generating an updated predictive machine learning model based on the updated knowledge store.

11. The computing system of claim 10 , wherein the result indicates a success or failure of the one or more recommended actions.

12. The computing system of claim 10 , further comprising surfacing, by the computing system, the at least one alert classification or the one or more recommended actions for modification by an analyst.

13. The computing system of claim 12 , wherein said surfacing is performed in response to the result of the one or more recommended actions indicating a failure of the one or more recommended actions.

14. The computing system of claim 12 , further comprising, prior to generating the updated predictive machine learning model: updating the knowledge store based on a modification entered by the analyst.

15. The computing system of claim 10 , wherein the predictive machine learning model comprises an artificial neural network.

16. The computing system of claim 10 , wherein the predictive machine learning model generates a confidence score for the at least one alert classification and wherein automatically causing, by the computing system, execution of the one or more recommended actions occurs in response to the confidence score exceeding a confidence threshold.

17. The computing system of claim 10 , wherein the one or more recommended actions comprise communication with a conventional external computing device that is configured to effectuate the one or more recommended actions.

18. The computing system of claim 17 , wherein said communication occurs via an Application Programming Interface (API) call.

19. The computing system of claim 10 , wherein the operations further comprise employing the updated predictive machine learning model to process a new alert.

20. One or more non-transitory computer-readable media that collectively store:

a knowledge store;

a predictive machine learning model; and

instructions that, when executed by one or more processors of a computing system cause the computing system to perform operations, the operations comprising:

obtaining, by the computing system, the predictive machine learning model, the predictive machine learning model trained based on data in the knowledge store;

receiving, by the computing system, an alert associated with a monitored network;

classifying, by the computing system, the received alert to generate at least one alert classification;

automatically generating, by the computing system and using the predictive machine learning model, one or more recommended actions responsive to, and associated with, the received alert based on the alert classification;

automatically causing, by the computing system, execution of the one or more recommended actions;

updating, by the computing system, the knowledge store to include a result of the one or more recommended actions in the knowledge store; and

generating an updated predictive machine learning model based on the updated knowledge store.

Assignments (3)

Continuity (2)

References Cited (400)