Threat mitigation system and method

Patent metadata

Field	Value
Publication number	US-11057419-B2
Application number	US-202017016108-A
Country	US
Kind code	B2
Filing date	Sep 9, 2020
Priority date	Sep 9, 2019
Publication date	Jul 6, 2021
Grant date	Jul 6, 2021

Abstract

A computer-implemented method, computer program product and computing system for: detecting one or more security events within a computing platform of a client; notifying the client of the one or more security events within the computing platform; determining how long it took the client to resolve the one or more security events within the computing platform; and providing a resolution report to the client that quantifies client resolution performance based, at least in part, upon how long it took the client to resolve the one or more security events within the computing platform.

First claim

What is claimed is:

1. A computer-implemented method, executed on a computing device, comprising:
monitoring, by a Security Information and Event Management (SIEM) system, activity of one or more security-relevant subsystems;
detecting, by the SIEM system, one or more security events within a computing platform of a client;
notifying the client of the one or more security events within the computing platform;
determining how long it took the client to resolve the one or more security events within the computing platform; and
providing a resolution report to the client that quantifies client resolution performance based, at least in part, upon how long it took the client to resolve the one or more security events within the computing platform, wherein the resolution report defines a client resolution time with respect to how long it took the client to resolve the one or more security events within the computing platform and compares the client resolution time to a resolution time of third parties.

2. The computer-implemented method of claim 1 wherein the third-parties include one or more of:
other clients regardless of industry; and
other clients in the same industry as the client.

3. The computer-implemented method of claim 1 wherein the resolution report defines time-based resolution performance over a defined period of time.

4. The computer-implemented method of claim 3 wherein the time-based resolution performance includes time-based resolution performance for the client and for third parties.

5. The computer-implemented method of claim 4 wherein the time-based resolution performance for the client includes time-based resolution performance for the client sorted by severity of the one or more security events.

6. The computer-implemented method of claim 4 wherein the third-parties include one or more of:
other clients regardless of industry; and
other clients in the same industry as the client.

7. A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
monitoring, by a Security Information and Event Management (SIEM) system, activity of one or more security-relevant subsystems;
detecting, by the SIEM system, one or more security events within a computing platform of a client;
notifying the client of the one or more security events within the computing platform;
determining how long it took the client to resolve the one or more security events within the computing platform; and
providing a resolution report to the client that quantifies client resolution performance based, at least in part, upon how long it took the client to resolve the one or more security events within the computing platform, wherein the resolution report defines a client resolution time with respect to how long it took the client to resolve the one or more security events within the computing platform and compares the client resolution time to a resolution time of third parties.

8. The computer program product of claim 7 wherein the third-parties include one or more of:
other clients regardless of industry; and
other clients in the same industry as the client.

9. The computer program product of claim 7 wherein the resolution report defines time-based resolution performance over a defined period of time.

10. The computer program product of claim 9 wherein the time-based resolution performance includes time-based resolution performance for the client and for third parties.

11. The computer program product of claim 10 wherein the time-based resolution performance for the client includes time-based resolution performance for the client sorted by severity.

12. The computer program product of claim 10 wherein the third-parties include one or more of:
other clients regardless of industry; and
other clients in the same industry as the client.

13. A computing system including a processor and memory configured to perform operations comprising:
monitoring, by a Security Information and Event Management (SIEM) system, activity of one or more security-relevant subsystems;
detecting, by the SIEM system, one or more security events within a computing platform of a client;
notifying the client of the one or more security events within the computing platform;
determining how long it took the client to resolve the one or more security events within the computing platform; and
providing a resolution report to the client that quantifies client resolution performance based, at least in part, upon how long it took the client to resolve the one or more security events within the computing platform, wherein the resolution report defines a client resolution time with respect to how long it took the client to resolve the one or more security events within the computing platform and compares the client resolution time to a resolution time of third parties.

14. The computing system of claim 13 wherein the third-parties include one or more of:
other clients regardless of industry; and
other clients in the same industry as the client.

15. The computing system of claim 13 wherein the resolution report defines time-based resolution performance over a defined period of time.

16. The computing system of claim 15 wherein the time-based resolution performance includes time-based resolution performance for the client and for third parties.

17. The computing system of claim 16 wherein the time-based resolution performance for the client includes time-based resolution performance for the client sorted by severity.

18. The computing system of claim 16 wherein the third-parties include one or more of:
other clients regardless of industry; and
other clients in the same industry as the client.

Assignees

• Reliaquest Holdings Llc

Inventors

• Murphy Brian P
• Partlow Joe
• O'Connor Colin
• Pfeiffer Jason
• Murphy Brian Philip

Classifications

• G06N7/01

  Probabilistic graphical models, e.g. probabilistic networks · CPC title

• H04L67/60

  Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources (admission control or resource allocation H04L47/70) · CPC title

• G06N20/00

  Machine learning · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• G06F11/3409

  for performance assessment · CPC title