Risk-based cyber detection system
View Patent ↗A system that comprises a computer including a processor and a memory is disclosed. The memory includes instructions such that the processor is programmed to: determine a risk level corresponding to an alert, the alert corresponding to at least one node of a plurality of nodes of a communication network; calculate a risk level propagation based on the risk level; and generate a response corresponding to a node type of the at least one node when the risk level exceeds a response threshold.
1. A system comprising a computer including a processor and a memory, the memory including instructions such that the processor is programmed to:
determine a risk level corresponding to an alert, the alert corresponding to at least one node of a plurality of nodes of a communication network, wherein the risk level is determined according to
R
i
(
t
+
1
)
=
∑
j
∈
𝒩
i
ℱ
(
R
j
(
t
)
,
R
i
(
t
)
decay
i
,
W
ij
)
,
where Σj∈ is a summation over all nodes j in a set Ni, R i (t+1) is the risk level corresponding to the at least one node at time t+1, is the risk level function, R j (t) is a risk level at time t for a node adjacent to the at least one node, R i (t) is a risk level at time t for the at least one node, decay i is a decay constant corresponding to the at least one node, W ij is a likelihood of communication between the at least one node and the adjacent node, and is the set of all nodes connected to node V i ;
calculate a risk level propagation based on the risk level;
generate a response corresponding to a node type of the at least one node when the risk level exceeds a response threshold; and
update a risk level of another node of the plurality of nodes based on the risk level propagation.
2. The system as recited in claim 1 , wherein the processor is further programmed to receive the alert from an endpoint monitoring agent corresponding to the at least one node.
3. The system as recited in claim 1 , wherein the processor is further programmed to generate a graph representing the plurality of nodes of the communication network.
4. The system as recited in claim 1 , wherein the processor is further programmed to generate a risk graph, the risk graph including one or more nodes of the plurality of nodes, wherein the one or more nodes comprise a risk value exceeding a predefined risk threshold.
5. The system as recited in claim 1 , wherein the response comprises deprovisioning of the at least one node.
6. The system as recited in claim 1 , wherein the response comprises isolating the at least one node.
7. The system as recited in claim 1 , wherein the processor is further programmed to access a data structure to determine the risk level, wherein the data structure includes a mapping of the alert to the risk level.
8. A method comprising:
determining a risk level corresponding to an alert, the alert corresponding to at least one node of a plurality of nodes of a communication network, wherein the risk level is determined according to
R
i
(
t
+
1
)
=
∑
j
∈
𝒩
i
ℱ
(
R
j
(
t
)
,
R
i
(
t
)
decay
i
,
W
ij
)
,
where Σj∈ is a summation over all nodes j in a set Ni, R i (t+1) is the risk level corresponding to the at least one node at time t+1, is the risk level function, R j (t) is a risk level at time t for a node adjacent to the at least one node, R i (t) is a risk level at time t for the at least one node, decay i is a decay constant corresponding to the at least one node, W ij is a likelihood of communication between the at least one node and the adjacent node, and is the set of all nodes connected to node V i ;
calculating a risk level propagation based on the risk level;
generating a response corresponding to a node type of the at least one node when the risk level exceeds a response threshold; and
updating a risk level of another node of the plurality of nodes based on the risk level propagation.
9. The method as recited in claim 8 , further comprising receiving the alert from an endpoint monitoring agent corresponding to the at least one node.
10. The method as recited in claim 8 , further comprising generating a graph representing the plurality of nodes of the communication network.
11. The method as recited in claim 8 , further comprising generating a risk graph, the risk graph including one or more nodes of the plurality of nodes, wherein the one or more nodes comprise a risk value exceeding a predefined risk threshold.
12. The method as recited in claim 8 , wherein the response comprises deprovisioning of the at least one node.
13. The method as recited in claim 8 , wherein the response comprises isolating the at least one node.
14. The method as recited in claim 8 , further comprising accessing a data structure to determine the risk level, wherein the data structure includes a mapping of the alert to the risk level.
15. A system comprising a computer including a processor and a memory, the memory including instructions such that the processor is programmed to:
determine a risk level corresponding to an alert, the alert corresponding to at least one node of a plurality of nodes of a communication network, wherein the risk level is determined according to
R
i
(
t
+
1
)
=
∑
j
∈
𝒩
i
ℱ
(
R
j
(
t
)
,
R
i
(
t
)
decay
i
,
W
ij
)
,
where Σj∈ is a summation over all nodes j in a set Ni, R i (t+1) is the risk level corresponding to the at least one node at time t+1, is the risk level function, R j (t) is a risk level at time t for a node adjacent to the at least one node, R i (t) is a risk level at time t for the at least one node, decay i is a decay constant corresponding to the at least one node, W ij is a likelihood of communication between the at least one node and the adjacent node, and is the set of all nodes connected to node V i ;
calculate a risk level propagation based on the risk level;
generate a response corresponding to a node type of the at least one node when the risk level exceeds a response threshold, the response comprising at least one of deprovisioning of the at least one node or isolating the at least one node; and
update a risk level of another node of the plurality of nodes based on the risk level propagation.
16. The system as recited in claim 15 , wherein the processor is further programmed to determine the likelihood of risk propagation based on a communication type between the first node and the second node.
17. The system as recited in claim 15 , wherein the processor is further programmed to calculate the risk value for each node based on an alert type corresponding to each node.