Granted Patent B2

US 12,411,950 · App. 19/058,833 · Granted Sep 9, 2025

Inventors: Tomer Schwartz (Tel Aviv, IL); Eshel Yaron (Amsterdam, NL); Barak Bercovitz (Even-Yehuda, IL)

Assignee: Wiz, Inc.

G06F21/554G06F8/70G06F16/245G06F16/9024G06F40/242G06F40/30G06F2221/033

Abstract

Claims (50)

1. A method for remediating cybersecurity events, comprising:

creating a semantic concepts dictionary, wherein the semantic concepts dictionary defines a plurality of semantic concepts representing characteristics of software components;

creating an entity graph based on a plurality of correlations between entities among a plurality of entities, wherein the entity graph has a plurality of nodes representing respective entities of the plurality of entities, wherein the plurality of entities includes a plurality of software components of a software infrastructure and a plurality of event logic components of cybersecurity event logic deployed with respect to the software infrastructure;

building a knowledge base such that the knowledge base includes the semantic concepts dictionary and the entity graph;

querying the knowledge base using a query generated based on at least one semantic concept and at least one entity-identifying value extracted from cybersecurity event data indicating a cybersecurity event for the software infrastructure, wherein the knowledge base returns at least one query result, wherein the query includes at least one semantic concept and at least one entity-identifying value; and

performing at least one remedial action based on the at least one query result.

2. The method of claim 1 , wherein creating the entity graph further comprises:

embedding at least one entity-defining dataset into the entity graph, wherein each entity-defining dataset provides a plurality of explicit definitions of entity features.

3. The method of claim 1 , wherein the plurality of nodes includes data indicating software component characteristics.

4. The method of claim 1 , further comprising:

identifying at least one path in the entity graph based on the at least one query result, wherein each identified path is between one of the plurality of software components and one of the plurality of event logic components; and

identifying a root cause entity based on the identified at least one path, wherein the at least one remedial action is performed based further on the identified root cause entity.

5. The method of claim 1 , further comprising:

deriving the plurality of correlations by analyzing software development lifecycle pipeline data.

6. The method of claim 5 , wherein the plurality of correlations is derived based on references between software components among the plurality of software components indicated in the software development lifecycle pipeline data.

7. The method of claim 1 , further comprising:

linking source code to binaries of at least one application based on the plurality of correlations between the entities among the plurality of entities, wherein the entity graph is created based further on the linking of the source code to the binaries.

8. The method of claim 1 , wherein the plurality of correlations is identified based on an analysis of log files, wherein the analysis of the log files includes identifying at least one action and at least one event related to the at least one action indicated in a plurality of log files.

9. The method of claim 1 , further comprising:

performing natural language processing on the cybersecurity event data in order to identify the at least one semantic concept in the cybersecurity event data based on the plurality of semantic concepts defined in the semantic concepts dictionary; and

extracting the identified at least one semantic concept from the cybersecurity event data.

10. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:

creating a semantic concepts dictionary, wherein the semantic concepts dictionary defines a plurality of semantic concepts representing characteristics of software components;

creating an entity graph based on a plurality of correlations between entities among a plurality of entities, wherein the entity graph has a plurality of nodes representing respective entities of the plurality of entities, wherein the plurality of entities includes a plurality of software components of a software infrastructure and a plurality of event logic components of cybersecurity event logic deployed with respect to the software infrastructure;

building a knowledge base such that the knowledge base includes the semantic concepts dictionary and the entity graph;

querying the knowledge base using a query generated based on at least one semantic concept and at least one entity-identifying value extracted from cybersecurity event data indicating a cybersecurity event for the software infrastructure, wherein the knowledge base returns at least one query result, wherein the query includes at least one semantic concept and at least one entity-identifying value; and

performing at least one remedial action based on the at least one query result.

11. A system for remediating cybersecurity events, comprising:

a processing circuitry; and

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

create a semantic concepts dictionary, wherein the semantic concepts dictionary defines a plurality of semantic concepts representing characteristics of software components;

create an entity graph based on a plurality of correlations between entities among a plurality of entities, wherein the entity graph has a plurality of nodes representing respective entities of the plurality of entities, wherein the plurality of entities includes a plurality of software components of a software infrastructure and a plurality of event logic components of cybersecurity event logic deployed with respect to the software infrastructure;

build a knowledge base such that the knowledge base includes the semantic concepts dictionary and the entity graph;

query the knowledge base using a query generated based on at least one semantic concept and at least one entity-identifying value extracted from cybersecurity event data indicating a cybersecurity event for the software infrastructure, wherein the knowledge base returns at least one query result, wherein the query includes at least one semantic concept and at least one entity-identifying value; and

perform at least one remedial action based on the at least one query result.

12. The system of claim 11 , wherein the system is further configured to:

embed at least one entity-defining dataset into the entity graph, wherein each entity-defining dataset provides a plurality of explicit definitions of entity features.

13. The system of claim 11 , wherein the plurality of nodes includes data indicating software component characteristics.

14. The system of claim 11 , wherein the system is further configured to:

identify at least one path in the entity graph based on the at least one query result, wherein each identified path is between one of the plurality of software components and one of the plurality of event logic components; and

identify a root cause entity based on the identified at least one path, wherein the at least one remedial action is performed based further on the identified root cause entity.

15. The system of claim 11 , wherein the system is further configured to:

derive the plurality of correlations by analyzing software development lifecycle pipeline data.

16. The system of claim 15 , wherein the plurality of correlations is derived based on references between software components among the plurality of software components indicated in the software development lifecycle pipeline data.

17. The system of claim 11 , wherein the system is further configured to:

link source code to binaries of at least one application based on the plurality of correlations between the entities among the plurality of entities, wherein the entity graph is created based further on the linking of the source code to the binaries.

18. The system of claim 11 , wherein the plurality of correlations is identified based on an analysis of log files, wherein the analysis of the log files includes identifying at least one action and at least one event related to the at least one action indicated in a plurality of log files.

19. The system of claim 11 , wherein the system is further configured to:

perform natural language processing on the cybersecurity event data in order to identify the at least one semantic concept in the cybersecurity event data based on the plurality of semantic concepts defined in the semantic concepts dictionary; and

extract the identified at least one semantic concept from the cybersecurity event data.

Continuity (2)

References Cited (63)