Conceptio › Archive › Google Patents

Google Patentsopen access

Cyber threat defense system protecting email networks with machine learning … — Darktrace Holdings Limited (US11606373B2)

Darktrace Holdings Limited · Google Patents

Google Patents · Patents · License: Open Access

Open Source ↗

darktraceholdingslimited matthewdunn

patent, google patents, intellectual property, US11606373B2, Darktrace Holdings Limited, Matthew Dunn, en, 2023

ABSTRACT

Abstract

A cyber defense system using models that are trained on a normal behavior of email activity and user activity associated with an email system. A cyber-threat module may reference the models that are trained on the normal behavior of email activity and user activity. A determination is made of a threat risk parameter that factors in the likelihood that a chain of one or more unusual behaviors of the email activity and user activity under analysis fall outside of a derived normal benign behavior. An autonomous response module can be used, rather than a human taking an action, to cause one or more autonomous rapid actions to be taken to contain the cyber-threat when the threat risk parameter from the cyber-threat module is equal to or above an actionable threshold.

Description

NOTICE OF COPYRIGHT

A portion of this disclosure contains material that is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the material subject to copyright protection as it appears in the United States Patent & Trademark Office's patent file or records, but otherwise reserves all copyright rights whatsoever.

RELATED APPLICATION

This application claims priority to and the benefit of under 35 USC 119 of U.S. provisional patent application titled âA cyber-threat defense system with various improvements,â filed Feb. 20, 2018, Ser. No. 62/632,623, which is incorporated herein by reference in its entirety.

FIELD

Embodiments of the design provided herein generally relate to a cyber-threat defense system. In an embodiment, Artificial Intelligence analyzes Cyber Security threats coming from and/or associated with an email.

BACKGROUND

In the cyber security environment, firewalls, endpoint security methods and other tools such as SIEMs and sandboxes are deployed to enforce specific policies, and provide protection against certain threats. These tools currently form an important part of an organization's cyber defense strategy, but they are insufficient in the new age of cyber threat.

Cyber threat including email threats can be subtle and rapidly cause harm to a network. Having an automated response can allow a system to rapidly counter these threats.

SUMMARY

In an embodiment, a cyber-threat defense system protects a system from cyber threats coming from and/or associated with an email and/or an email system. One or more machine learning models are trained on a normal behavior of email activity and user activity associated with an email system and the normal behavior of the intended recipient of the email as perceived from their normal network behavior. The normal network behavior can be derived from other systems which operate outside of email interaction. A cyber-threat module can have one or more machine learning models trained on cyber threats in the email system, or cyber threats which may be present on the recipient's network. The cyber-threat module may reference the models that are trained on the normal behavior of email activity and user activity associated with the email system. The cyber-threat module determines a threat risk parameter that factors in the likelihood that a chain of one or more unusual behaviors of the email activity and user activity under analysis fall outside of derived normal benign behavior. Probes collect the user activity and the email activity and then feed that activity to the cyber-threat module to draw an understanding of the email activity and user activity in the email system. An autonomous response module, rather than a human taking an action, configured to cause one or more autonomous actions to be taken to contain the cyber-threat when the threat risk parameter from the cyber-threat module is equal to or above an actionable threshold.

These and other features of the design provided herein can be better understood with reference to the drawings, description, and claims, all of which form the disclosure of this patent application.

DRAWINGS

The drawings refer to some embodiments of the design provided herein in which:

FIG. 1 illustrates a block diagram of an embodiment of a cyber-threat defense system with a cyber-threat module that references machine learning models that are trained on the normal behavior of email activity and user activity associated with at least the email system, where the cyber-threat module determines a threat risk parameter that factors in âthe likelihood that a chain of one or more unusual behaviors of the email activity and user activity under analysis fall outside of derived normal benign behavior;â and thus, are likely malicious behavior.

FIG. 3 illustrates a block diagram of an embodiment of the cyber-threat module determining a threat risk parameter that factors in how the chain of unusual behaviors correlate to potential cyber threats and âthe likelihood that this chain of one or more unusual behaviors of the email activity and user activity under analysis fall outside of derived normal benign behavior;â and thus, is malicious behavior.

FIG. 4 illustrates a block diagram of an embodiment of the cyber-threat defense system referencing one or more machine learning models trained on gaining an understanding of a plurality of characteristics on an email itself and its related data including classifying the properties of the email and its meta data.

FIG. 5 illustrates a block diagram of an embodiment of an example chain of unusual behavior for the email(s) in connection with the rest of the network under analysis.

FIG. 6 illustrates a block diagram of an embodiment of an example window of the user interface for the cyber-threat defense system to allow emails in the e-mail system to be filterable, searchable, and sortable.

FIG. 7 illustrates a block diagram of an embodiment of example autonomous actions that the autonomous rapid response module can be configured to take without a human initiating that action.

FIG. 8 illustrates a block diagram of an embodiment of email module and network module cooperating a particular user's network activity tied to their email activity.

FIG. 9 illustrates an example cyber-threat defense system protecting an example network.

FIG. 10 illustrates an example of the network module informing the email module of a computer's network activity prior to the user of that computer receiving an email containing content relevant to that network activity.

FIG. 11 illustrates an example of the network module informing the email module of the deduced pattern of life information on the web browsing activity of a computer prior to the user of that computer receiving an email which contains content which is not in keeping with that pattern of life.

While the design is subject to various modifications, equivalents, and alternative forms, specific embodiments thereof have been shown by way of example in the drawings and will now be described in detail. It should be understood that the design is not limited to the particular embodiments disclosed, butâon the contraryâthe intention is to cover all modifications, equivalents, and alternative forms using the specific embodiments.

DESCRIPTION

In the following description, numerous specific details are set forth, such as examples of specific data signals, named components, number of servers in a system, etc., in order to provide a thorough understanding of the present design. It will be apparent, however, to one of ordinary skill in the art that the present design can be practiced without these specific details. In other instances, well known components or methods have not been described in detail but rather in a block diagram in order to avoid unnecessarily obscuring the present design. Further, specific numeric references such as a first server, can be made. However, the specific numeric reference should not be interpreted as a literal sequential order but rather interpreted that the first server is different than a second server. Thus, the specific details set forth are merely exemplary. Also, the features implemented in one embodiment may be implemented in another embodiment where logically possible. The specific details can be varied from and still be contemplated to be within the spirit and scope of the present design. The term coupled is defined as meaning connected either directly to the component or indirectly to the component through another component.

In general, Artificial Intelligence analyzes cyber security threats. The cyber defense system can use models that are trained on a normal behavior of email activity and user activity associated with an email system. A cyber-threat module may reference the models that are trained on the normal behavior of email activity and user activity. A determination is made of a threat risk parameter that factors in the likelihood that a chain of one or more unusual behaviors of the email activity and user activity under analysis fall outside of derived normal benign behavior. An autonomous response module can be used, rather than a human taking an action, to cause one or more autonomous rapid actions to be taken to contain the cyber-threat when the threat risk parameter from the cyber-threat module is equal to or above an actionable threshold.

The cyber-threat defense system 100 may protect against cyber security threats from an e-mail system as well as its network. The cyber-threat defense system 100 may include components such as i) a trigger module, ii) a gather module, iii) a data store, iv) a network module, v) an email module, vi) a network & email coordinator module, vii) a cyber-threat module, viii) a user interface and display module, ix) an autonomous response module, x) one or more machine learning models including a first Artificial Intelligence model trained on characteristics of an email itself and its related data, a second Artificial Intelligence model trained on potential cyber threats, and one or more Artificial Intelligence models each trained on different users, devices, system activities and interactions between entities in the system, and other aspects of the system, as well as xi) other similar components in the cyber-threat defense system.

A trigger module may detect time stamped data indicating one or more i) events and/or ii) alerts from I) unusual or II) suspicious behavior/activity are occurring and then triggers that something unusual is happening. Accordingly, the gatherer module is triggered by specific events and/or alerts of i) an abnormal behavior, ii) a suspicious activity, and iii) any combination of both. The inline data may be gathered on the deployment from a data store when the traffic is observed. The scope and wide variation of data available in this location results in good quality data for analysis. The collected data is passed to the cyber-threat module.

The gatherer module may consist of multiple automatic data gatherers that each look at different aspects of the data depending on the particular hypothesis formed for the analyzed event and/or alert. The data relevant to each type of possible hypothesis will be automatically pulled from additional external and internal sources. Some data is pulled or retrieved by the gatherer module for each possible hypothesis. A feedback loop of cooperation occurs between the gatherer module, the email module monitoring email activity, the network module monitoring network activity, and the cyber-threat module to apply one or more models trained on different aspects of this process. Each hypothesis of typical threats, e.g. human user insider attack/inappropriate network and/or email behavior, malicious software/malware attack/inappropriate network and/or email behavior, can have various supporting points of data and other metrics associated with that possible threat, and a machine learning algorithm will look at the relevant points of data to support or refute that particular hypothesis of what the suspicious activity and/or abnormal behavior related for each hypothesis on what the suspicious activity and/or abnormal behavior relates to. Networks have a wealth of data and metrics that can be collected and then the mass of data is filtered/condensed down into the important features/salient features of data by the gatherers.

In an embodiment, the network module, the email module, and the network & email coordinator module may be portions of the cyber-threat module.

The cyber-threat module may also use one or more machine learning models trained on cyber threats in the email system. The cyber-threat module may reference the models that are trained on the normal behavior of email activity and user activity associated with the email system. The cyber-threat module can reference these various trained machine learning models and data from the network module, the email module, and the trigger module. The cyber-threat module can determine a threat risk parameter that factors in how the chain of unusual behaviors correlate to potential cyber threats and âwhat is a likelihood of this chain of one or more unusual behaviors of the email activity and user activity under analysis that fall outside of derived normal benign behavior;â and thus, is malicious behavior.

The one or more machine learning models can be self-learning models using unsupervised learning and trained on a normal behavior of different aspects of the system, for example, email activity and user activity associated with an email system. The self-learning models of normal behavior are regularly updated. The self-learning model of normal behavior is updated when new input data is received that is deemed within the limits of normal behavior. A normal behavior threshold is used by the model as a moving benchmark of parameters that correspond to a normal pattern of life for the computing system. The normal behavior threshold is varied according to the updated changes in the computer system allowing the model to spot behavior on the computing system that falls outside the parameters set by the moving benchmark.

FIG. 10 illustrates a block diagram of an embodiment of the cyber-threat module comparing the analyzed metrics on the user network and computer activity and email activity compared to their respective moving benchmark of parameters that correspond to the normal pattern of life for the computing system used by the self-learning machine learning models and the corresponding potential cyber threats. The cyber-threat module can then determine, in accordance with the analyzed metrics and the moving benchmark of what is considered normal behavior, a cyber-threat risk parameter indicative of a likelihood of a cyber-threat.

The cyber-threat defense system 100 may also include one or more machine learning models trained on gaining an understanding of a plurality of characteristics on an email itself and its related data including classifying the properties of the email and its meta data.

The cyber-threat module can also reference the machine learning models trained on an email itself and its related data to determine if an email or a set of emails under analysis h

NOTICE OF COPYRIGHT

RELATED APPLICATION

FIELD

BACKGROUND

Cyber threat including email threats can be subtle and rapidly cause harm to a network. Having an automated response can allow a system to rapidly counter these threats.

SUMMARY

These and other features of the design provided herein can be better understood with reference to the drawings, description, and claims, all of which form the disclosure of this patent application.

DRAWINGS

The drawings refer to some embodiments of the design provided herein in which:

FIG. 5 illustrates a block diagram of an embodiment of an example chain of unusual behavior for the email(s) in connection with the rest of the network under analysis.

FIG. 7 illustrates a block diagram of an embodiment of example autonomous actions that the autonomous rapid response module can be configured to take without a human initiating that action.

FIG. 8 illustrates a block diagram of an embodiment of email module and network module cooperating a particular user's network activity tied to their email activity.

FIG. 9 illustrates an example cyber-threat defense system protecting an example network.

DESCRIPTION

In an embodiment, the network module, the email module, and the network & email coordinator module may be portions of the cyber-threat module.

The cyber-threat module can also reference the machine learning models trained on an email itself and its related data to determine if an email or a set of emails under analysis have potentially malicious characteristics. The cyber-threat module can also factor this email characteristics analysis into its determination of the threat risk parameter.

The network module may have one or more machine learning models trained on a normal behavior of users, devices, and interactions between them, on a network, which is tied to the email system. A user interface has one or more windows to display network data and one or more windows to display emails and cyber security details about those emails through the same user interface on a display screen, which allows a cyber professional to pivot between network data and email cyber security details within one platform, and consider them as an interconnected whole rather than separate realms on the same display screen.

The cyber-threat module can also factor this network analysis into its determination of the threat risk parameter.

The cyber-threat defense system 100 may use at least three separate machine learning models. (Also see FIG. 9 ) Each machine learning model may be trained on specific aspects of the normal pattern of life for the system such as devices, users, network traffic flow, outputs from one or more cyber security analysis tools analyzing the system, etc. One or more machine learning models may also be trained on characteristics and aspects of all manner of types of cyber threats. One or more machine learning models may also be trained on characteristics of emails themselves.

The email module monitoring email activity and the network module monitoring network activity may both feed their data to a network & email coordinator module to correlate causal links between these activities to supply this input into the cyber-threat module. The application of these causal links is demonstrated in the block diagrams FIG. 10 and FIG. 11 .

The cyber-threat module can also factor this network activity link to a particular email causal link analysis into its determination of the threat risk parameter (see FIG. 11 ).

The cyber-threat defense system 100 uses various probes to collect the user activity and the email activity and then feed that activity to the data store and as needed to the cyber-threat module and the machine learning models. The cyber-threat module uses the collected data to draw an understanding of the email activity and user activity in the email system as well as updates a training for the one or more machine learning models trained on this email system and its users. For example, email traffic can be collected by putting hooks into the e-mail application, such as Outlook or Gmail, and/or monitoring the internet gateway from which the e-mails are routed through. Additionally, probes may collect network data and metrics via one of the following methods: port spanning the organizations existing network equipment; inserting or re-using an in-line network tap, and/or accessing any existing repositories of network data. (e.g. See FIG. 2 )

The cyber-threat defense system 100 may use multiple user interfaces. A first user interface may be constructed to present an inbox-style view of all of the emails coming in/out of the email system and any cyber security characteristics known about one or more emails under analysis. The user interface with the inbox-style view of emails has a first window/column that displays the one or more emails under analysis and a second window/column with all of the relevant security characteristics known about that email or set of emails under analysis. The complex machine learning techniques determine anomaly scores which describe any deviation from normal that the email represents, these are rendered graphically in a familiar way that users and cyber professionals can recognize and understand.

The cyber-threat defense system 100 can then take actions to counter detected potential cyber threats.

The autonomous response module, rather than a human taking an action, can be configured to cause one or more rapid autonomous actions to be taken to contain the cyber-threat when the threat risk parameter from the cyber-threat module is equal to or above an actionable threshold. The cyber-threat module's configured cooperation with the autonomous response module, to cause one or more autonomous actions to be taken to contain the cyber threat, improves computing devices in the email system by limiting an impact of the cyber-threat from consuming unauthorized CPU cycles, memory space, and power consumption in the computing devices via responding to the cyber-threat without waiting for some human intervention. (Also see FIG. 6 )

The cyber-threat defense system 100 may be hosted on a device, on one or more servers, and/or in its own cyber-threat appliance platform. (e.g. see FIG. 2 )

FIG. 2 illustrates a block diagram of an embodiment of the cyber-threat defense system monitoring email activity and network activity to feed this data to correlate causal links between these activities to supply this input into the cyber-threat analysis. The network can include various computing devices such as desktop units, laptop units, smart phones, firewalls, network switches, routers, servers, databases, Internet gateways, the cyber-threat defense system 100 , etc.

The network module uses the probes to monitor network activity and can reference the machine learning models trained on a normal behavior of users, devices, and interactions between them or the internet which is subsequently tied to the email system.

The user interface has both i) one or more windows to present/display network data, alerts, and events, and ii) one or more windows to display email data, alerts, events, and cyber security details about those emails through the same user interface on a display screen. These two sets of information shown on the same user interface on the display screen allows a cyber professional to pivot between network data and email cyber security details within one platform, and consider them as an interconnected whole rather than separate realms.

The network module and its machine learning models are utilized to determine potentially unusual network activity in order to provide an additional input of information into the cyber-threat module in order to determine the threat risk parameter (e.g. a score or probability) indicative of the level of threat.

A particular user's network activity can be tied to their email activity because the network module observes network activity and the network & email coordinator module receives the network module observations to draw that into an understanding of this particular user's email activity to make an appraisal of potential email threats with a resulting threat risk parameter tailored for different users in the e-mail system. The network module tracks each user's network activity and sends that to the network & email coordinator component to interconnect the network activity and email activity to closely inform one-another's behavior and appraisal of potential email threats.

The cyber-threat defense system 100 can now track possible malicious activity observed by the network module on an organization's network back to a specific email event observed by the e-mail module, and use the autonomous rapid response module to shut down any potentially harmful activity on the network itself, and also freeze any similar email activity triggering the harmful activity on the network.

The probes collect the user activity as well as the email activity. The collected activity is supplied to the data store and evaluated for unusual or suspicious behavioral activity, e.g. alerts, events, etc., which is evaluated by the cyber-threat module to draw an understanding of the email activity and user activity in the email system. The collected data can also be used to potentially update the training for the one or more machine learning models trained on the normal pattern of life for this email system, its users and the network and its entities.

An example probe for the email system may be configured to work directly with an organization's email application, such as an Office 365 Exchange domain and receive a Blind Carbon Copy (BCC) of all ingoing and outgoing communications. The email module will inspect the emails to provide a comprehensive awareness of the pattern of life of an organization's email usage.

The user interface 150 can graphically display logic, data, and other details that the cyber-threat module goes through.

The user interface 150 displays an example email that when undergoing analysis exhibits characteristics, such as header, address, subject line, sender, recipient, domain, etc. that are not statistically consistent with the normal emails similar to this one.

Thus, the user interface 150 displays an example email's unusual activity that has it classified as a behavioral anomaly.

During the analysis, the email module can reference the one or more machine learning models that are self-learning models trained on a normal behavior of email activity and user activity associated with an email system. This can include various e-mail policies and rules that are set for this email system. The cyber-threat module may also reference the models that are trained on the normal characteristics of the email itself. The cyber-threat module can apply these various trained machine learning models to data including metrics, alerts, events, meta data from the network module and the email module. In addition, a set of AI models may be responsible for learning the normal âpattern of lifeâ for internal and external address identities in connection with the rest of the network, for each email user. (see e.g. FIG. 8 for a visual display of this data) This allows the system to neutralize malicious emails which deviate from the normal âpattern of lifeâ for a given address identity for that user in relation to its past, its peer group, and the wider organization.

Next, the email module has at least a first email probe to inspect an email at the point it transits through the email application, such as Office 365, and extracts hundreds of data points from the raw email content and historical email behavior of the sender and the recipient. These metrics are combined with pattern of life data of the intended recipient, or sender, sourced from the data store. The combined set of the metrics are passed through machine learning algorithms to produce a single anomaly score of the email, and various combinations of metrics will attempt to generate notifications which will help define the âtypeâ of email.

Email threat alerts, including the type notifications, triggered by anomalies and/or unusual behavior of âemails and any associated properties of those emailsâ are used by the cyber-threat module to better identify any network events which may have resulted from an email borne attack.

In conjunction with the specific threat alerts and the anomaly score, the system may provoke actions upon the email designed to prevent delivery of the email or to neutralize potentially malicious content.

Next, the data store stores the metrics and previous threat alerts associated with each email for a period of time, which is, by default, at least 27 days. This corpus of data is fully searchable from within the user interface 150 and presents an invaluable insight into mail flow for email administrators and security professionals.

Next, the cyber-threat module can issue an anomaly rating even when an unusual email does not closely relate to any identifiable malicious email. This value indicates how unusual the cyber-threat module considers this email to be in comparison to the normal pattern of life for the organization and the specific internal user (either inbound recipient or outbound sender). The cyber-threat module considers over 750 metrics and the organizational pattern of life for unusual behavior for a window of time. For example, the cyber-threat module considers metrics and the organizational pattern of life for unusual behavior and other supporting metrics for the past 7 days when computing the anomaly score, which is also factored into the final threat risk parameter.

The user interface 150 can graphically display logic, data, and other details that the cyber-threat defense system goes through.

The cyber-threat module in cooperation with the machine learning models analyzes these metrics in order to develop a rich pattern of life for the email activity in that email system. This allows the cyber-threat module in cooperation with the email module to spot unusual anomalous emails that have bypassed/gotten past the existing email gateway defenses.

The email module detects emails whose content is not in keeping with the normal pattern of content as received by this particular recipient.

An example analysis may be as follows.

To what level has the sender of this email been previously communicated with from individuals within the receiving organization?

How closely are the recipients of this mail related to those individuals who have previously communicated with the sender?

Is the content of this email consistent with other emails that the indented recipient sends or receives?

If any links or attachments present in the email were to be clicked or opened by the intended recipient, would this constitute anomalous activity for that individual's normal network behavior?

Are the email properties consistent with this particular user's recent network activities?

Thus, the cyber-threat module can also reference the machine learning models trained on an email itself and its related data to determine if an email or a set of emails under analysis have potentially malicious characteristics. The cyber-threat module can also factor this email characteristics analysis into its determination of the threat risk parameter.

The email module can retrospectively process an email application's metadata, such as Office 365 metadata, to gain an intimate knowledge of each of their users, and their email addresses, correspondents, and routine operations. The power of the cyber-threat module lies in leveraging this unique understanding of day-to-day user email behavior, of each of the email users, in relation to their past, to their peer group, and to the wider organization. (see e.g. FIG. 8 for a visual representation of an email address's association data) Armed with the knowledge of what is ânormalâ for a specific organization and specific individual, rather than what fits a predefined template of malicious communications, the cyber-threat module can identify subtle, sophisticated email campaigns which mimic benign communications and locate threats concealed as everyday activity.

Next, the email module provides comprehensive email logs for every email observed. These logs can be filtered with complex logical queries and each email can be interrogated on a vast number of metrics in the email information stored in the data store.

Some example email characteristics that can be stored and analyzed are:

Email direction: Message directionâoutbound emails and inbound emails. Send Time: The send time is the time and date the email was originally sent according to the message metadata. Links: Every web link present in an email has its own properties. Links to web sites are extracted from the body of the email. Various attributes are extracted including, but not limited to, the position in the text, the domain, the frequency of appearance of the domain in other emails and how it relates to the anomaly score of those emails, how well that domain fits into the normal pattern of life of the intended recipient of the email, their deduced peer group and their organization. Recipient: The recipient of the email. If the email was addressed to multiple recipients, these can each be viewed as the âRecipientsâ. The known identify properties of the email recipient, including how well known the recipient was to the sender, descriptors of the volume of mail, and how the email has changed over time, to what extend the recipient's email domain is interacted with inside the network. Subject: The email subject line. Attachment: Every attachment associated with the message will appear in the user interface here as individual entries, with each entry interrogatable against both displayed and advanced metrics. These include, but are not limited to, the attachment file name, detected file types, descriptors of the likelihood of the recipient receiving such a file, descriptors of the distribution of files such of these in all email against the varying anomaly score of those emails. Headers: Email headers are lines of metadata that accompany each message, providing key information such as sender, recipient, message content type for example.

The user interface can display a graph 220 of an example chain of unusual behavior for the email(s) in connection with the rest of the network under analysis.

The network & email module can tie the alerts and events from the email realm to the alerts and events from the network realm.

The cyber-threat module cooperates with one or more machine learning models. The one or more machine learning models are trained and otherwise configured with mathematical algorithms to infer, for the cyber-threat analysis, âwhat is possibly happening with the chain of distinct alerts and/or events, which came from the unusual pattern,â and then assign a threat risk associated with that distinct item of the chain of alerts and/or events forming the unusual pattern.

This is âa behavioral pattern analysisâ of what are the unusual behaviors of the network/system/device/user/email under analysis by the cyber-threat module and the machine learning models. The cyber defense system uses unusual behavior deviating from the normal behavior and then builds a chain of unusual behavior and the causal links between the chain of unusual behavior to detect cyber threats. An example behavioral pattern analysis of what are the unusual behaviors may be as follows. The unusual pattern may be determined by filtering out what activities/events/alerts that fall within the window of what is the normal pattern of life for that network/system/device/user/email under analysis, and then the pattern of the behavior of the activities/events/alerts that are left, after the filtering, can be analyzed to determine whether that pattern is indicative of a behavior of a malicious actorâhuman, program, email, or other threat. The defense system can go back and pull in some of the filtered out normal activities to help support or refute a possible hypothesis of whether that pattern is indicative of a behavior of a malicious actor. An example behavioral pattern included in the chain is shown in the graph over a time frame of, an example, 7 days. The defense system detects a chain of anomalous behavior of unusual data transfers three times, unusual characteristics in emails in the monitored system three times which seem to have some causal link to the unusual data transfers. Likewise, twice unusual credentials attempted the unusual behavior of trying to gain access to sensitive areas or malicious IP addresses and the user associated with the unusual credentials trying unusual behavior has a causal link to at least one of those three emails with unusual characteristics. When the behavioral pattern analysis of any individual behavior or of the chain as a group is believed to be indicative of a malicious threat, then a score of how confident is the defense system in this assessment of identifying whether the unusual pattern was caused by a malicious actor is created. Next, also assigned is a threat level parameter (e.g. score or probability) indicative of what level of threat does this malicious actor pose to the system. Lastly, the cyber-threat defense system is configurable in its user interface of the defense system on what type of automatic response actions, if any, the defense system may take when for different types of cyber threats that are equal to or above a configurable level of threat posed by this malicious actor.

The cyber-threat module may chain the individual alerts and events that form the unusual pattern into a distinct item for cyber-threat analysis of that chain of distinct alerts and/or events. The cyber-threat module may reference the one or more machine learning models trained on e-mail threats to identify similar characteristics from the individual alerts and/or events forming the distinct item made up of the chain of alerts and/or events forming the unusual pattern.

One or more machine learning models may also be trained on characteristics and aspects of all manner of types of cyber threats to analyze the threat risk associated with the chain/cluster of alerts and/or events forming the unusual pattern. The machine learning technology, using advanced mathematics, can detect previously unidentified threats, without rules, and automatically defend networks.

The models may perform by the threat detection through a probabilistic change in normal behavior through the application of an unsupervised Bayesian mathematical model to detect behavioral change in computers and computer networks. The core threat detection system is termed the âBayesian probabilisticâ. The Bayesian probabilistic approach can determine periodicity in multiple time series data and identify changes across single and multiple time series data for the purpose of anomalous behavior detection. From the email and network raw sources of data, a large number of metrics can be derived each producing time series data for the given metric.

The detectors in the cyber-threat module including its network module and email module components can be discrete mathematical models that implement a specific mathematical method against different sets of variables with the target. Thus, each model is specifically targeted on the pattern of life of alerts and/or events coming from, for example, i) that cyber security analysis tool, ii) analyzing various aspects of the emails, iii) coming from specific devices and/or users within a system, etc.

At its core, the cyber-threat defense system mathematically characterizes what constitutes ânormalâ behavior based on the analysis of a large number/set of different measures of a device's network behavior. The cyber-threat defense system can build a sophisticated âpattern of lifeââthat understands what represents normality for every person, device, email activity, and network activity in the system being protected by the cyber-threat defense system.

As discussed, each machine learning model may be trained on specific aspects of the normal pattern of life for the system such as devices, users, network traffic flow, outputs from one or more cyber security analysis tools analyzing the system, email contact associations for each user, email characteristics, etc. The one or more machine learning models may use at least unsupervised learning algorithms to establish what is the normal pattern of life for the system. The machine learning models can train on both i) the historical normal distribution of alerts and events for that system as well as ii) factored in is a normal distribution information from similar peer systems to establish the normal pattern of life of the behavior of alerts and/or events for that system. Another set of machine learning models train on characteristics of emails and the activities and behavior of its email users to establish a normal for these.

Note, when the models leverage at least two different approaches to detecting anomalies: e.g. comparing each system's behavior to its own history, and comparing that system to its peers' history and/or e.g. comparing an email to both characteristics of emails and the activities and behavior of its email users, this multiple source comparison allows the models to avoid learning existing bad behavior as âa normalâ because compromised devices/users/components/emails will exhibit behavior different to their immediate peers.

In addition, the one or more machine learning models can use the comparison of i) the normal pattern of life for that system corresponding to the historical normal distribution of alerts and events for that system mapped out in the same multiple dimension space to ii) the current chain of individual alerts and events behavior under analysis. This comparison can yield detection of the one or more unusual patterns of behavior within the plotted individual alerts and/or events, which allows the detection of previously unidentified cyber threats compared to finding cyber threats with merely predefined descriptive objects and/or signatures. Thus, increasingly intelligent malicious cyber threats that try to pick and choose when they take their actions in order to generate low level alerts and event will still be detected, even though they have not yet been identified by other methods of cyber analysis. These intelligent malicious cyber threats can include malware, spyware, key loggers, malicious links in an email, malicious attachments in an email, etc. as well as nefarious internal information technology staff who know intimately how to not set off any high level alerts or events.

In essence, the plotting and comparison is way to filter out what is normal for that system and then be able to focus the analysis on what is abnormal or unusual for that system. Then, for each hypothesis of what could be happening with the chain of unusual events and/or alerts, the gatherer module may gather additional metrics from the data store including the pool of metrics originally considered ânormal behaviorâ to support or refute each possible hypothesis of what could be happening with this chain of unusual behavior under analysis.

Note, each of the individual alerts and/or events in a chain of alerts and/or events that form the unusual pattern can indicate subtle abnormal behavior; and thus, each alert and/or event can have a low threat risk associated with that individual alert and/or event. However, when analyzed as a distinct chain/grouping of alerts and/or events behavior forming the chain of unusual pattern by the one or more machine learning models, then that distinct chain of alerts and/or events can be determine to now have a much higher threat risk than any of the individual alerts and/or events in the chain.

Note, in addition, today's cyberattacks can be of such severity and speed that a human response cannot happen quickly enough. Thanks to these self-learning advances, it is now possible for a machine to uncover these emerging threats and deploy appropriate, real-time responses to fight back against the most serious cyber threats.

The threat detection system has the ability to self-learn and detect normality in order to spot true anomalies, allowing organizations of all sizes to understand the behavior of users and machines on their networks at both an individual and group level. Monitoring behaviors, rather than using predefined descriptive objects and/or signatures, means that more attacks can be spotted ahead of time and extremely subtle indicators of wrongdoing can be detected. Unlike traditional legacy defenses, a specific attack type or new malware does not have to have been seen first before it can be detected. A behavioral defense approach mathematically models both machine, email, and human activity behaviorally, at and after the point of compromise, in order to predict and catch today's increasingly sophisticated cyber-attack vectors. It is thus possible to computationally establish what is normal, in order to then detect what is abnormal. In addition, the machine learning constantly revisits assumptions about behavior, using probabilistic mathematics. The cyber-threat defense system's unsupervised machine learning methods do not require training data with pre-defined labels. Instead, they are able to identify key patterns and trends in the data, without the need for human input.

The user interface and output module may also project the individual alerts and/or events forming the chain of behavior onto the user interface with at least three-dimensions of i) a horizontal axis of a window of time, ii) a vertical axis of a scale indicative of the threat risk assigned for each alert and/or event in the chain and a third dimension of iii) a different color (e.g. red, blue, yellow, etc., and if gray scaleâdifferent shades of gray black and white with potentially different hashing patterns) for the similar characteristics shared among the individual alerts and events forming the distinct item of the chain. These similarities of events and/or alerts in the chain may be, for example, alerts or events are coming from same device, same user credentials, same group, same source ID, same destination IP address, same types of data transfers, same type of unusual activity, same type of alerts, same rare connection being made, same type of events, etc., so that a human can visually see what spatially and content-wise is making up a particular chain rather than merely viewing a textual log of data. Note, once the human mind visually sees the projected pattern and corresponding data, then the human can ultimately decide if a cyber-threat is posed. Again, the at least three-dimensional projection helps a human synthesize this information more easily. The visualization onto the User Interface allows a human to see data that supports or refutes why the cyber-threat defense system thinks these aggregated alerts and/or events could be potentially malicious. Also, instead of generating the simple binary outputs âmaliciousâ or âbenign,â the cyber-threat defense system's mathematical algorithms produce outputs that indicate differing degrees of potential compromise.

The cyber-threat defense system 100 may use at least three separate machine-learning models. Each machine-learning model may be trained on specific aspects of the normal pattern of life for the system such as devices, users, network traffic flow, outputs from one or more cyber security analysis tools analyzing the system, etc. One or more machine learning models may also be trained on characteristics and aspects of all manner of types of cyber threats. One or more machine learning models may also be trained on characteristics of emails themselves.

In an embodiment, the one or more models may be trained on specific aspects of these broader concepts. For example, the models may be specifically trained on associations, attachments, compliances, data loss & transfers, general, meta data, hygiene, links, proximity, spoof, type, validation, and other anomalies.

Thus, for example, a first email model can retrospectively process Office 365 metadata to gain an intimate knowledge of users, email addresses, correspondents and routine operations. Even in environments with encrypted email, the cyber defense system can derive key markers from metadata and provide valuable insights into correspondent identity, frequency of communication and potential risk.

In addition, the one or more machine learning models can be self-learning using unsupervised learning algorithms. For example, a set of the one or more machine learning models can be trained on the normal behavior of users and their emails use data from the probes to train on; and therefore, regularly update what a base line for the normal behavior is. This autonomous, self-learning defense system protects against malicious activity in the email domainâwhether the malicious activity is from any of i) standard threat actors from email, such as phishing and malware emails, and ii) insider threat from users, which does not rely solely on pre-recognized, arbitrary ideas of malicious email domain activity but instead autonomously contextualizes each communication to assess its anomaly compared to standard behavior of the user and organization.

As discussed above one or m

CLAIMS

Claims ( 20 )

What is claimed is:

1. An apparatus, comprising:

one or more machine learning models that are trained on a normal behavior of both email activity and user activity associated with an email system;

a cyber-threat module with one or more machine learning models trained on cyber threats in the email system to understand characteristics of cyber threats in the email system, where the cyber-threat module is further configured to reference the models that are trained on the normal behavior of both email activity and user activity associated with the email system and issue an anomaly rating value to indicate how unusual the cyber-threat module considers an email under analysis to be in comparison to a normal pattern of life for an organization and a specific user, where the cyber-threat module determines a threat risk parameter that factors in a likelihood that a chain of one or more unusual behaviors of the email activity and user activity under analysis that fall outside of a derived normal benign behavior and how the chain of one or more unusual behaviors of the email activity and user activity under analysis correlate to a potential cyber threat;

probes configured to collect both the user activity and the email activity and then feed that activity to the cyber-threat module to draw an understanding of the email activity and user activity in the email system; and

an autonomous response module, rather than a human taking an action, is configured to cause one or more autonomous actions to be taken to contain the cyber-threat when the threat risk parameter from the cyber-threat module is equal to or above an actionable threshold,

where the apparatus further comprises one or more processors and one or more memories configured to store software instructions that are implemented in the autonomous response module, the cyber-threat module, and the one or more machine learning models, where the software instructions are stored in an executable form in the one or more memories and are configured to be executed by the one or more processors.

2. The apparatus of claim 1 , further comprising:

one or more machine learning models trained on gaining an understanding of a plurality of characteristics of an email itself and its related data; and

where the cyber-threat module can also reference the machine learning models trained on an email itself and its related data to determine if an email under analysis has potentially malicious characteristics and can then also factor this analysis into the determination of the threat risk parameter.

3. The apparatus of claim 1 , further comprising:

a user interface with an inbox-style view of emails coming in/out of the email system and cyber security characteristics known about one or more emails under analysis, where the user interface with the inbox-style view of emails has a first window that displays the one or more emails under analysis and a second window with security characteristics known about those one or more emails under analysis.

4. The apparatus of claim 3 , wherein the user interface for the cyber-threat defense system is configured to allow emails in the email system to be filterable, searchable, and sortable to customize and target the one or more emails under analysis in the first window alongside the relevant security characteristics known about those one or more emails, where these two windows displaying their respective information on the same display screen with this user interface allows a cyber professional analyzing the emails under analysis to better assess whether those one or more emails are in fact a cyber threat.

5. The apparatus of claim 1 , where the autonomous response module is configurable to know when the response module should take the autonomous actions to contain the cyber-threat when i) a known malicious email or ii) at least highly likely malicious email is determined by the cyber-threat module, where the autonomous response module has an administrative tool, configurable through the user interface, to set what autonomous actions the autonomous response module can take, including types of actions and specific actions the autonomous response module is capable of, when the cyber-threat module indicates the threat risk parameter is equal to or above the actionable threshold, selectable by the cyber professional, that the one or more emails under analysis are at least highly likely to be malicious.

6. The apparatus of claim 5 , wherein the autonomous response module has a library of response actions types of actions and specific actions the autonomous response module is capable of, including focused response actions selectable through the user interface that are contextualized to autonomously act on specific email elements of a malicious email, rather than a blanket quarantine or block approach on that email, to avoid disruption to a particular user of the email system.

7. The apparatus of claim 1 , further comprising:

a network module that has one or more machine learning models trained on normal behavior of users, devices, and interactions between them, on a network, which is tied to the email system, where a user interface has one or more windows to display network data and one or more windows to display emails and cyber security details about those emails through the same user interface on a display screen.

8. The apparatus of claim 7 , wherein the network module and its machine learning models being utilized to determine potentially unusual network activity provides an additional input of information into the cyber-threat module to determine the threat risk parameter, where a particular user's network activity is tied to their email activity in response to the network module observing network activity and the cyber-threat module receiving the network module observations to draw that into an understanding of this particular user's email activity to make an appraisal of potential email threats with a resulting threat risk parameter.

9. The apparatus of claim 1 , wherein the one or more machine learning models trained on the normal behavior of users and their emails use data from the probes to train on; and therefore, regularly update what a base line for the normal behavior is.

10. The apparatus of claim 1 , wherein the cyber-threat module's configured cooperation with the autonomous response module, to cause one or more autonomous actions to be taken to contain the cyber threat, improves computing devices in the email system by limiting an impact of the cyber-threat from consuming CPU cycles, memory space, and power consumption in the computing devices via responding to the cyber-threat without waiting for some human intervention.

11. A method for a cyber-threat defense system, comprising:

using one or more machine learning models that are trained on a normal behavior of both email activity and user activity associated with an email system;

using a cyber-threat module with one or more machine learning models trained on cyber threats in the email system to understand characteristics of cyber threats in the email system, where the cyber-threat module is further configured to reference the models that are trained on the normal behavior of both email activity and user activity associated with the email system and issue an anomaly rating value to indicate how unusual the cyber-threat module considers an email under analysis to be in comparison to a normal pattern of life for an organization and a specific user;

determining a threat risk parameter that factors in the likelihood that a chain of one or more unusual behaviors of the email activity and user activity under analysis that fall outside of a derived normal benign behavior, and how the chain of one or more unusual behaviors of the email activity and user activity under analysis correlate to a potential cyber threat;

using probes to collect both the user activity and the email activity and then feed that activity to the cyber-threat module to draw an understanding of the email activity and user activity in the email system; and

using an autonomous response module, rather than a human taking an action, to cause one or more autonomous actions to be taken to contain the cyber-threat when the threat risk parameter from the cyber-threat module is equal to or above an actionable threshold,

where when any software instructions are implemented in the autonomous response module, the cyber-threat module, and the one or more machine learning models, that are then the software instructions are stored in an executable form in one or more memories and are configured to be executed by one or more processors.

12. The method of claim 11 , further comprising:

using one or more machine learning models trained on gaining an understanding of a plurality of characteristics of an email itself and its related data, where the cyber-threat module with the one or more machine learning models trained on cyber threats in the email system can also reference the machine learning models trained on an email itself and its related data to determine if an email under analysis has potentially malicious characteristics, and can then also factor this analysis into the determination of the threat risk parameter.

13. The method of claim 11 , further comprising:

using a user interface with an inbox-style view of emails coming in/out of the email system and cyber security characteristics known about one or more emails under analysis, where the user interface with the inbox-style view of emails has a first window that displays the one or more emails under analysis and a second window with security characteristics known about those one or more emails under analysis.

14. The method of claim 13 , further comprising:

configuring the user interface for the cyber-threat defense system to allow emails in the email system to be filterable, searchable, and sortable to customize and target the one or more emails under analysis in the first window alongside the relevant security characteristics known about those one or more emails, where these two windows displaying their respective information on the same display screen with this user interface allows a cyber professional analyzing the emails under analysis to better assess whether those one or more emails are in fact a cyber threat.

15. The method of claim 11 ,

making the autonomous response module configurable to know when the response module should take the autonomous actions to contain the cyber threat; and

taking the autonomous actions to contain the cyber-threat when the cyber-threat module determines the chain of one or more unusual behaviors of the email activity and user activity under analysis are highly likely to be malicious, where the autonomous response module has an administrative tool, configurable through the user interface, to set what autonomous actions the autonomous response module can take, including types of actions and specific actions the autonomous response module is capable of, when the cyber-threat module indicates the threat risk parameter is equal to or above the actionable threshold, selectable by the cyber professional, that the chain of one or more unusual behaviors of the email activity and user activity are at least highly likely to be malicious.

16. The method of claim 15 , further comprising:

using a library of response actions types of actions and specific actions the autonomous response module is capable of, including focused response actions selectable through the user interface that are contextualized to autonomously act on specific email elements of a malicious email, rather than a blanket quarantine or block approach on that email, to avoid disruption to a particular user of the email system.

17. The method of claim 11 , further comprising:

using one or more machine learning models trained on a normal behavior of users, devices, and interactions between them, on a network, which is tied to the email system, where a user interface has one or more windows to display network data and one or more windows to display emails and cyber security details about those emails through the same user interface on a display screen.

18. The method of claim 17 , wherein a particular user's network activity is tied to their email activity in response to a network module observing network activity and a cyber-threat module receiving the network module observations to draw that into an understanding of this particular user's email activity to make an appraisal of potential email threats with a resulting threat risk parameter.

19. The method of claim 11 , wherein the one or more machine learning models trained on the normal behavior of users and their emails use data from the probes to train on; and therefore, regularly update what a base line for the normal behavior is.

20. A non-transitory computer-readable medium including executable instructions that, when executed with one or more processors, cause a cyber defense system to perform the operations of:

using a cyber-threat module with one or more machine learning models trained on cyber threats in the email system, where the cyber-threat module is configured to reference the models that are trained on both the normal behavior of email activity and user activity associated with the email system to understand characteristics of cyber threats in the email system and issue an anomaly rating value to indicate how unusual the cyber-threat module considers an email under analysis to be in comparison to a normal pattern of life for an organization and a specific user;

determining a threat risk parameter that factors in a likelihood that a chain of one or more unusual behaviors of the email activity and user activity under analysis fall outside of a derived normal benign behavior, and how the chain of one or more unusual behaviors of the email activity and user activity under analysis correlate to a potential cyber threat;

US16/278,932

2018-02-20

2019-02-19

Cyber threat defense system protecting email networks with machine learning models

Active

2041-07-13

US11606373B2

( en )

Priority Applications (15)

Application Number

Priority Date

Filing Date

Title

US16/278,932

US11606373B2

( en )

2018-02-20

2019-02-19

Cyber threat defense system protecting email networks with machine learning models

JP2019028818A

JP7614715B2

( en )

2018-02-20

2019-02-20

Cyber threat defense system that uses machine learning models to protect email networks

US16/732,644

US11477222B2

( en )

2018-02-20

2020-01-02

Cyber threat defense system protecting email networks with machine learning models using a range of metadata from observed email communications

US16/941,874

US11716347B2

( en )

2018-02-20

2020-07-29

Malicious site detection for a cyber threat response system

US16/941,878

US12063243B2

( en )

2018-02-20

2020-07-29

Autonomous email report generator

US17/004,398

US11962552B2

( en )

2018-02-20

2020-08-27

Endpoint agent extension of a machine learning cyber defense system for email

US17/859,847

US12634340B2

( en )

2022-07-07

Method and system for determining and acting on an email cyber threat campaign

US17/966,708

US11962608B2

( en )

2018-02-20

2022-10-14

Cyber threat defense system protecting email networks with machine learning models using a range of metadata from observed email communications

US18/117,348

US20230224327A1

( en )

2018-02-20

2023-03-03

System to detect malicious emails and email campaigns

US18/219,552

US20230421602A1

( en )

2018-02-20

2023-07-07

Malicious site detection for a cyber threat response system

JP2023155537A

JP7607720B2

( en )

2018-02-20

2023-09-21

Cyber threat defense system that uses machine learning models to protect email networks

US18/400,640

US20240137378A1

( en )

2018-02-20

2023-12-29

User Importance Metric for Email

US18/603,064

US20240223523A1

( en )

2018-02-20

2024-03-12

Endpoint agent extension of a machine learning cyber defense system for email

US18/603,056

US20240267399A1

( en )

2018-02-20

2024-03-12

Cyber Threat Defense System Protecting Email Networks with Machine Learning Models using a Range of Metadata from Observed Email Communications

US18/781,841

US20240380781A1

( en )

2018-02-20

2024-07-23

Autonomous email report generator

Applications Claiming Priority (2)

Application Number

Priority Date

Filing Date

Title

US201862632623P

2018-02-20

US16/278,932

US11606373B2

( en )

2018-02-20

2019-02-19

Cyber threat defense system protecting email networks with machine learning models

Related Child Applications (6)

Application Number

Title

Priority Date

Filing Date

US16/732,644

Continuation-In-Part

US11477222B2

( en )

2018-02-20

2020-01-02

Cyber threat defense system protecting email networks with machine learning models using a range of metadata from observed email communications

US16/941,878

Continuation-In-Part

US12063243B2

( en )

2018-02-20

2020-07-29

Autonomous email report generator

US16/941,874

Continuation

US11716347B2

( en )

2018-02-20

2020-07-29

Malicious site detection for a cyber threat response system

US16/941,874

Continuation-In-Part

US11716347B2

( en )

2018-02-20

2020-07-29

Malicious site detection for a cyber threat response system

US17/004,398

Continuation-In-Part

US11962552B2

( en )

2018-02-20

2020-08-27

Endpoint agent extension of a machine learning cyber defense system for email

US18/117,348

Continuation-In-Part

US20230224327A1

( en )

2018-02-20

2023-03-03

System to detect malicious emails and email campaigns

Publications (2)

Publication Number

Publication Date

US20190260780A1

US20190260780A1 ( en )

2019-08-22

US11606373B2

true

US11606373B2 ( en )

2023-03-14

Family

ID=65516440

Family Applications (27)

Application Number

Title

Priority Date

Filing Date

US16/279,067

Active

2041-04-24

US11522887B2

( en )

2018-02-20

2019-02-19

Artificial intelligence controller orchestrating network components for a cyber threat defense

US16/279,031

Active

2040-04-12

US11336670B2

( en )

2018-02-20

2019-02-19

Secure communication platform for a cybersecurity system

US16/278,920

Active

2041-07-10

US11546359B2

( en )

2018-02-20

2019-02-19

Multidimensional clustering analysis and visualizing that clustered analysis on a user interface

US16/278,991

Active

2041-07-22

US11689556B2

( en )

2018-02-20

2019-02-19

Incorporating software-as-a-service data into a cyber threat defense system

US16/278,918

Active

2040-03-07

US11336669B2

( en )

2018-02-20

2019-02-19

Artificial intelligence cyber security analyst

US16/278,982

Active

2041-06-08

US11546360B2

( en )

2018-02-20

2019-02-19

Cyber security appliance for a cloud infrastructure

US16/279,039

Active

2040-09-04

US11477219B2

( en )

2018-02-20

2019-02-19

Endpoint agent and system

US16/278,957

Active

2041-03-23

US11457030B2

( en )

2018-02-20

2019-02-19

Artificial intelligence researcher assistant for cybersecurity analysis

US16/278,953

Active

2042-03-17

US11843628B2

( en )

2018-02-20

2019-02-19

Cyber security appliance for an operational technology network

US16/278,932

Active

2041-07-13

US11606373B2

( en )

2018-02-20

2019-02-19

Cyber threat defense system protecting email networks with machine learning models

US16/279,013

Active

2041-04-10

US11418523B2

( en )

2018-02-20

2019-02-19

Artificial intelligence privacy protection for cybersecurity analysis

US16/279,022

Active

2040-06-12

US11689557B2

( en )

2018-02-20

2019-02-19

Autonomous report composer

US16/278,998

Active

2040-02-07

US11075932B2

( en )

2018-02-20

2019-02-19

Appliance extension for remote communication with a cyber security appliance

US16/278,969

Active

2040-05-30

US11799898B2

( en )

2018-02-20

2019-02-19

Method for sharing cybersecurity threat analysis and defensive measures amongst a community

US16/941,874

Active

2039-06-12

US11716347B2

( en )

2018-02-20

2020-07-29

Malicious site detection for a cyber threat response system

US17/745,255

Active

US11902321B2

( en )

2018-02-20

2022-05-16

Secure communication platform for a cybersecurity system

US17/745,250

Active

US12407712B2

( en )

2018-02-20

2022-05-16

Artificial intelligence cyber security analyst

US17/966,720

Active

US12563087B2

( en )

2018-02-20

2022-10-14

Endpoint agent and system

US18/213,123

Active

2039-04-09

US12225045B2

( en )

2018-02-20

2023-06-22

Incorporating software-as-a-service data into a cyber threat defense system

US18/213,128

Active

US12407713B2

( en )

2018-02-20

2023-06-22

Autonomous report composer

US18/373,157

Pending

US20240022595A1

( en )

2018-02-20

2023-09-26

Method for sharing cybersecurity threat analysis and defensive measures amongst a community

US18/387,322

Active

2039-04-25

US12363157B2

( en )

2018-02-20

2023-11-06

Cyber security appliance for an operational technology network

US18/414,786

Pending

US20240372889A1

( en )

2018-02-20

2024-01-17

A Secure Communication Platform for A Cybersecurity System

US19/025,773

Pending

US20250175493A1

( en )

2018-02-20

2025-01-16

Incorporating software-as-a-service data into a cyber threat defense system

US19/242,732

Pending

US20250317472A1

( en )

2018-02-20

2025-06-18

Cyber security appliance for an operational technology network

US19/292,707

Pending

US20250365309A1

( en )

2018-02-20

2025-08-06

Artificial intelligence cyber security analyst

US19/298,027

Pending

US20250373652A1

( en )

2018-02-20

2025-08-12

Autonomous Report Composer

Family Applications Before (9)

Application Number

Title

Priority Date

Filing Date

US16/279,067

Active

2041-04-24

US11522887B2

( en )

2018-02-20

2019-02-19

Artificial intelligence controller orchestrating network components for a cyber threat defense

US16/279,031

Active

2040-04-12

US11336670B2

( en )

2018-02-20

2019-02-19

Secure communication platform for a cybersecurity system

US16/278,920

Active

2041-07-10

US11546359B2

( en )

2018-02-20

2019-02-19

Multidimensional clustering analysis and visualizing that clustered analysis on a user interface

US16/278,991

Active

2041-07-22

US11689556B2

( en )

2018-02-20

2019-02-19

Incorporating software-as-a-service data into a cyber threat defense system

US16/278,918

Active

2040-03-07

US11336669B2

( en )

2018-02-20

2019-02-19

Artificial intelligence cyber security analyst

US16/278,982

Active

2041-06-08

US11546360B2

( en )

2018-02-20

2019-02-19

Cyber security appliance for a cloud infrastructure

US16/279,039

Active

2040-09-04

US11477219B2

( en )

2018-02-20

2019-02-19

Endpoint agent and system

US16/278,957

Active

2041-03-23

US11457030B2

( en )

2018-02-20

2019-02-19

Artificial intelligence researcher assistant for cybersecurity analysis

US16/278,953

Active

2042-03-17

US11843628B2

( en )

2018-02-20

2019-02-19

Cyber security appliance for an operational technology network

Family Applications After (17)

Application Number

Title

Priority Date

Filing Date

US16/279,013

Active

2041-04-10

US11418523B2

( en )

2018-02-20

2019-02-19

Artificial intelligence privacy protection for cybersecurity analysis

US16/279,022

Active

2040-06-12

US11689557B2

( en )

2018-02-20

2019-02-19

Autonomous report composer

US16/278,998

Active

2040-02-07

US11075932B2

( en )

2018-02-20

2019-02-19

Appliance extension for remote communication with a cyber security appliance

US16/278,969

Active

2040-05-30

US11799898B2

( en )

2018-02-20

2019-02-19

Method for sharing cybersecurity threat analysis and defensive measures amongst a community

US16/941,874

Active

2039-06-12

US11716347B2

( en )

2018-02-20

2020-07-29

Malicious site detection for a cyber threat response system

US17/745,255

Active

US11902321B2

( en )

2018-02-20

2022-05-16

Secure communication platform for a cybersecurity system

US17/745,250

Active

US12407712B2

( en )

2018-02-20

2022-05-16

Artificial intelligence cyber security analyst

US17/966,720

Active

US12563087B2

( en )

2018-02-20

2022-10-14

Endpoint agent and system

US18/213,123

Active

2039-04-09

US12225045B2

( en )

2018-02-20

2023-06-22

Incorporating software-as-a-service data into a cyber threat defense system

US18/213,128

Active

US12407713B2

( en )

2018-02-20

2023-06-22

Autonomous report composer

US18/373,157

Pending

US20240022595A1

( en )

2018-02-20

2023-09-26

Method for sharing cybersecurity threat analysis and defensive measures amongst a community

US18/387,322

Active

2039-04-25

US12363157B2

( en )

2018-02-20

2023-11-06

Cyber security appliance for an operational technology network

US18/414,786

Pending

US20240372889A1

( en )

2018-02-20

2024-01-17

A Secure Communication Platform for A Cybersecurity System

US19/025,773

Pending

US20250175493A1

( en )

2018-02-20

2025-01-16

Incorporating software-as-a-service data into a cyber threat defense system

US19/242,732

Pending

US20250317472A1

( en )

2018-02-20

2025-06-18

Cyber security appliance for an operational technology network

US19/292,707

Pending

US20250365309A1

( en )

2018-02-20

2025-08-06

Artificial intelligence cyber security analyst

US19/298,027

Pending

US20250373652A1

( en )

2018-02-20

2025-08-12

Autonomous Report Composer

Country Status (7)

Country

Link

( 27 )

US11522887B2

( en )

( 8 )

EP4312420A3

( en )

( 2 )

JP7614715B2

( en )

( 1 )

AU2019201137B2

( en )

( 2 )

CA3034176C

( en )

( 4 )

DK3528462T3

( en )

( 1 )

SG10201901386UA

( en )

Cited By (3)

* Cited by examiner, â Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

US20230350900A1

( en )

2022-04-29

2023-11-02

Microsoft Technology Licensing, Llc

Observation stream engine in a security management system

US20240179167A1

( en )

2022-11-25

2024-05-30

Sony Interactive Entertainment Europe Limited

Autonomous anomalous device operation detection

US12149553B1

( en )

2021-10-29

2024-11-19

Mimecast North America, Inc.

Visibility into security

Families Citing this family (550)

* Cited by examiner, â Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

WO2015094372A1

( en )

2013-12-20

2015-06-25

Mcafee, Inc.

Intelligent firewall access rules

US10671470B2

( en )

2015-06-11

2020-06-02

Instana, Inc.

Application performance management system with dynamic discovery and extension

US12500929B2

( en )

2023-07-28

2025-12-16

Qomplx Llc

Host-level ticket forgery detection and extension to network endpoints

US10607004B2

( en )

2016-09-29

2020-03-31

Intel Corporation

Methods and apparatus to improve feature engineering efficiency with metadata unit operations

US10999296B2

( en )

2017-05-15

2021-05-04

Forcepoint, LLC

Generating adaptive trust profiles using information derived from similarly situated organizations

US10992652B2

( en )

2017-08-25

2021-04-27

Keysight Technologies Singapore (Sales) Pte. Ltd.

Methods, systems, and computer readable media for monitoring encrypted network traffic flows

US10903985B2

( en )

2017-08-25

2021-01-26

Keysight Technologies Singapore (Sales) Pte. Ltd.

Monitoring encrypted network traffic flows in a virtual environment using dynamic session key acquisition techniques

US10769306B2

( en )

2017-09-21

2020-09-08

International Business Machines Corporation

Applying a differential privacy operation on a cluster of data

US12489771B1

( en )

2017-11-27

2025-12-02

Fortinet, Inc.

Detecting anomalous behavior of nodes in a hierarchical cloud deployment

US10616260B2

( en )

2017-11-30

2020-04-07

Bank Of America Corporation

System for information security threat assessment

US10635822B2

( en )

2017-11-30

2020-04-28

Bank Of America Corporation

Data integration system for triggering analysis of connection oscillations

US10826929B2

( en )

2017-12-01

2020-11-03

Bank Of America Corporation

Exterior data deployment system using hash generation and confirmation triggering

US10666666B1

( en )

2017-12-08

2020-05-26

Logichub, Inc.

Security intelligence automation platform using flows

US10735272B1

( en )

2017-12-08

2020-08-04

Logichub, Inc.

Graphical user interface for security intelligence automation platform using flows

US11403958B2

( en )

2017-12-13

2022-08-02

T-Mobile Usa, Inc.

Lesson determination for dynamic gamification application

US11855971B2

( en )

2018-01-11

2023-12-26

Visa International Service Association

Offline authorization of interactions and controlled tasks

US10834111B2

( en )

2018-01-29

2020-11-10

International Business Machines Corporation

Method and system for email phishing attempts identification and notification through organizational cognitive solutions

DK3528462T3

( en )

2018-02-20

2024-02-26

Darktrace Holdings Ltd

Approach to share a cybersecurity threat analysis and defensive measures in a community

US10862912B2

( en )

2018-03-23

2020-12-08

Juniper Networks, Inc.

Tracking host threats in a network and enforcing threat policy actions for the host threats

US10887327B2

( en )

2018-03-23

2021-01-05

Juniper Networks, Inc.

Enforcing threat policy actions based on network addresses of host threats

US12261870B2

( en )

2018-03-23

2025-03-25

Juniper Networks, Inc.

Tracking host threats in a network and enforcing threat policy actions for the host threats

US11003773B1

( en )

2018-03-30

2021-05-11

Fireeye, Inc.

System and method for automatically generating malware detection rule recommendations

US10749882B2

( en )

2018-04-19

2020-08-18

Raytheon Bbn Technologies Corp.

Network security system and methods for encoding network connectivity for activity classification

RU2715025C2

( en )

2018-04-19

2020-02-21

Method for automated testing of software and hardware systems and complexes

US11575688B2

( en )

2018-05-02

2023-02-07

Sri International

Method of malware characterization and prediction

US12081567B2

( en )

2018-05-03

2024-09-03

Siemens Aktiengesellschaft

Analysis device, method and system for operational technology system and storage medium

US11544374B2

( en )

2018-05-07

2023-01-03

Micro Focus Llc

Machine learning-based security threat investigation guidance

US10397272B1

( en )

2018-05-10

2019-08-27

Capital One Services, Llc

Systems and methods of detecting email-based attacks through machine learning

US11586711B2

( en )

2018-05-14

2023-02-21

Cisco Technology, Inc.

Systems and methods for securing and controlling access to electronic data, electronic systems, and digital accounts

US11438357B2

( en )

2018-06-22

2022-09-06

Senseon Tech Ltd

Endpoint network sensor and related cybersecurity infrastructure

GB201810294D0

( en )

2018-06-22

2018-08-08

Senseon Tech Ltd

Cybe defence system

GB2602254B

( en )

2020-12-15

2023-04-05

Senseon Tech

Cyber threat defense system protecting email networks with machine learning … — Darktrace Holdings Limited (US11606373B2)

Related documents