Unstructured security threat information analysis

Patent metadata

Field	Value
Publication number	US-10063573-B2
Application number	US-201715430713-A
Country	US
Kind code	B2
Filing date	Feb 13, 2017
Priority date	Aug 29, 2014
Publication date	Aug 28, 2018
Grant date	Aug 28, 2018

Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for creating structured data using data received from unstructured textual data sources. One of the methods includes receiving unstructured textual data, identifying one or more keywords in the unstructured textual data, determining one or more patterns included in the unstructured textual data using the identified keywords, identifying one or more intelligence types that correspond with the unstructured textual data using the determined patterns, and associating, for each of the identified intelligence types, a data subset from the unstructured textual data with the respective intelligence type.

First claim

What is claimed is:

1. A system comprising one or more computers and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:
receiving unstructured textual data;
parsing the unstructured textual data into a plurality of sections including a first section and a second section that is a different section in the unstructured textual data than the first section;
for each section in the plurality of sections:
identifying one or more keywords in data for the section in the plurality of sections;
determining one or more patterns that match the section using the identified one or more keywords; and
identifying one or more intelligence types that correspond to the section using the determined one or more patterns;

associating, for a first intelligence type from the identified one or more intelligence types for the first section, the data for the first section from the unstructured textual data with the first intelligence type;
associating, for a second intelligence type from the identified one or more intelligence types for the second section, the data for the second section from the unstructured textual data with the second intelligence type, wherein the second intelligence type is a different intelligence type than the first intelligence type;
determining a rule for a third party that indicates that the third party should receive data associated with a particular intelligence type of the one or more intelligence types;
determining that the first intelligence type is the particular intelligence type; and
providing the data for the first section to a system of the third party.

2. The system of claim 1 , the operations comprising:
determining that none of the rules for the third party indicates that the third party should receive data associated with the second intelligence type; and
determining to not provide data for the second section to the system of the third party in response to determining that none of the rules for the third party indicates that the third party should receive data associated with the second intelligence type.

3. The system of claim 1 , wherein providing the data for the first section to a system for the third party is responsive to determining the rule for the third party that indicates that the third party should receive data associated with the particular intelligence type of the one or more intelligence types and determining that the first intelligence types is the particular intelligence type.

4. The system of claim 3 , wherein providing the data for the first section to the system for the third party comprises providing instructions to the system for the third party for presentation of the data for the first section.

5. The system of claim 1 , wherein each of the plurality of sections comprises a sentence.

6. The system of claim 1 , wherein each of the plurality of sections comprises a paragraph.

7. The system of claim 1 , wherein associating, for the first intelligence type, the data for the first section from the unstructured textual data with the first intelligence type comprises storing, in a database, at least one new record specific to the first intelligence type that comprises the data for the first section.

8. The system of claim 1 , wherein identifying the one or more intelligence types that correspond to the section using the determined one or more patterns comprises:
determining one or more rules using the one or more patterns; and
identifying the one or more intelligence types that correspond to the section using the one or more rules.

9. A non-transitory computer storage medium encoded with instructions that, when executed by one or more computers, cause the one or more computers to perform operations comprising:
receiving unstructured textual data;
parsing the unstructured textual data into a plurality of sections including a first section and a second section that is a different section in the unstructured textual data than the first section;
for each section in the plurality of sections:
identifying one or more keywords in data for the section in the plurality of sections;
determining one or more patterns that match the section using the identified one or more keywords; and
identifying one or more intelligence types that correspond to the section using the determined one or more patterns;

associating, for a first intelligence type from the identified one or more intelligence types for the first section, the data for the first section from the unstructured textual data with the first intelligence type;
associating, for a second intelligence type from the identified one or more intelligence types for the second section, the data for the second section from the unstructured textual data with the second intelligence type, wherein the second intelligence type is a different intelligence type than the first intelligence type;
determining a rule for a third party that indicates that the third party should receive data associated with a particular intelligence type of the one or more intelligence types;
determining that the first intelligence type is the particular intelligence type; and
providing the data for the first section to a system of the third party.

10. The computer storage medium of claim 9 , the operations comprising:
determining that none of the rules for the third party indicates that the third party should receive data associated with the second intelligence type; and
determining to not provide data for the second section to the system of the third party in response to determining that none of the rules for the third party indicates that the third party should receive data associated with the second intelligence type.

11. The computer storage medium of claim 9 , wherein providing the data for the first section to a system for the third party is responsive to determining the rule for the third party that indicates that the third party should receive data associated with the particular intelligence type of the one or more intelligence types and determining that the first intelligence types is the particular intelligence type.

12. The computer storage medium of claim 11 , wherein providing the data for the first section to the system for the third party comprises providing instructions to the system for the third party for presentation of the data for the first section.

13. The computer storage medium of claim 9 , wherein each of the plurality of sections comprises a sentence.

14. The computer storage medium of claim 9 , wherein each of the plurality of sections comprises a paragraph.

15. The computer storage medium of claim 9 , wherein associating, for the first intelligence type, the data for the first section from the unstructured textual data with the first intelligence type comprises storing, in a database, at least one new record specific to the first intelligence type that comprises the data for the first section.

16. The computer storage medium of claim 9 , wherein identifying the one or more intelligence types that correspond to the section using the determined one or more patterns comprises:
determining one or more rules using the one or more patterns; and
identifying the one or more intelligence types that correspond to the section using the one or more rules.

17. A computer-implemented method comprising:
receiving unstructured textual data;
parsing the unstructured textual data into a plurality of sections including a first section and a second section that is a d

Assignees

• Accenture Global Services Ltd

Inventors

• Hovor Elvis
• Modi Shimon
• Sengupta Shubhashis
• Ramnani Roshni Ramesh
• Mohamedrasheed Annervaz Karukapadath

Classifications

• H04L63/14

  for detecting or protecting against malicious traffic · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• G06F21/55 Primary

  Detecting local intrusion or implementing counter-measures · CPC title

• G06F16/338

  Presentation of query results · CPC title

• G06F16/3344

  using natural language analysis · CPC title