Autonomous report composer

Patent metadata

Field	Value
Publication number	US-11689557-B2
Application number	US-201916279022-A
Country	US
Kind code	B2
Filing date	Feb 19, 2019
Priority date	Feb 20, 2018
Publication date	Jun 27, 2023
Grant date	Jun 27, 2023

Abstract

An autonomous report composer composes a type of report on cyber threats that is composed in a human-readable format with natural language prose, terminology, and level of detail on the cyber threats aimed at a target audience. The autonomous report composer cooperates with libraries with prewritten text templates with i) standard pre-written sentences written in the natural language prose and ii) prewritten text templates with fillable blanks that are populated with data for the cyber threats specific for a current report being composed, where a template for the type of report contains two or more sections in that template. Each section having different standard pre-written sentences written in the natural language prose.

First claim

What is claimed is:

1. An apparatus, comprising
a formatting module that at least has an autonomous report composer and a set of one or more libraries,
where the autonomous report composer is configured to compose a type of report on cyber threats that is composed in a human-readable format with natural language prose, terminology, and a level of detail on the cyber threats aimed at a target audience, where the autonomous report composer is configured to select a first type of report from different types of possible reports,
where the autonomous report composer cooperates with the one or more libraries of sets of prewritten text templates with i) one or more standard pre-written sentences written in the natural language prose derived from previously generated reports of the first type as well as ii) one or more of the prewritten text templates with fillable blanks, also derived from previously generated reports of the first type, but have fillable blanks that are populated with data for the cyber threats specific for a current report being composed, where a template for the first type of report contains two or more sections in that template, each section having different standard pre-written sentences written in the natural language prose as well as one or more of the prewritten text templates with fillable blanks for that section of the first type of report on cyber threats, where the autonomous report composer is implemented with logic, and
where the autonomous report composer is configured to cooperate with a natural language processing engine, where after the autonomous report composer composes the first type of report on cyber threats that is composed in the human-readable format with the natural language prose, terminology, and the level of detail on the cyber threats aimed at the target audience, then the autonomous report composer sends a draft of that report to the natural language processing engine to identify any sections of text that do not have a level of confidence equal to or above a set threshold value, in a meaning of the generated sentence in light of the rest of the sentences in that section, where the natural language processing engine is configured to analyze the composed sentences pulled from the libraries and populated with the relevant data to check for human understandability and whether the composed sentences would make sense to a human reader as assembled versus being merely an assembly of incoherent words and sentences,
where the apparatus further comprises software instructions that are implemented in the formatting module, the autonomous report composer, and the set of one or more libraries, the software instructions are stored in an executable form in a memory and are configured to be executed by one or more processors.

2. The apparatus of claim 1 , where the formatting module and the autonomous report composer are part of system to protect a network from the cyber threats that uses one or more Artificial Intelligence models trained with machine learning on a normal behavior of entities in the network, where a breach of the AI models with its data and description are used to map specific incidents to related fillable blanks in the sentences.

3. The apparatus of claim 2 , where the first type of report on the cyber threats is a threat assessment drafted by the autonomous report composer with natural language prose, terminology, and the level of detail on the cyber threats aimed at a cyber professional with details on and data from making, testing, and refining a series of successive hypotheses on potential cyber threats and salient points to support or refute each hypothesis, which are assessed using a combination of supervised machine learning, unsupervised machine learning, and algorithms, which is formatted and written at a level to capture relevant details and the language of the cyber professional.

4. The apparatus of claim 2 , where the autonomous report composer is configured to cooperate with a library of suggested actionable actions to take in light of the cyber threats, and then populate suggested actionable actions to take into the report.

5. The apparatus of claim 2 , where the autonomous report composer cooperating with the one or more libraries at least includes a first library with a multitude of templates of the different types of reports and the sections found in each report template, where each different type of report and the section found in each report has its own i) library of prose for sentences found in that section and ii) library of other information than the prose for sentences found in that section of that type of report.

6. The apparatus of claim 2 , where a second type of report on the cyber threats is an executive level threat-landscape drafted by the autonomous report composer with natural language prose, terminology, and the level of detail on the cyber threats aimed at a business executive audience that summarizes the cyber threats encountered by an organization with individual incidents mapped to overall incident categories over a defined time period with an analysis and explanation of the summarized cyber threats, where the natural language prose and terminology are selected by the autonomous report composer from a set of libraries corresponding to a report template for the second type of report.

7. The apparatus of claim 2 , where the autonomous report composer cooperating with the one or more libraries is configured to take in machine data and machine process, understand that machine data and machine process, and then choose the first type of report from the libraries of the first type of report on cyber threats that is composed in the human-readable format with the natural language prose, terminology, and the level of detail on the cyber threats aimed at the target audience based on an identified potential cyber threat.

8. An apparatus, comprising a formatting module that at least has an autonomous report composer and a set of one or more libraries,
where the autonomous report composer is configured to compose a type of report on cyber threats that is composed in a human-readable format with natural language prose, terminology, and a level of detail on the cyber threats aimed at a target audience, where the autonomous report composer is configured to select a first type of report from different types of possible reports,
where the autonomous report composer cooperates with the one or more libraries of sets of prewritten text templates with i) one or more standard pre-written sentences written in the natural language prose derived from previously generated reports of the first type as well as ii) one or more of the prewritten text templates with fillable blanks, also derived from previously generated reports of the first type, but have fillable blanks that are populated with data for the cyber threats specific for a current report being composed, where a template for the first type of report contains two or more sections in that template, each section having different standard pre-written sentences written in the natural language prose as well as one or more of the prewritten text templates with fillable blanks for that section of the first type of report on cyber threats, where the autonomous report composer is implemented with logic, and
where the autonomous report composer is further configured to cooperate with one or more machine learning models trained on composing reports on cyber threats, where the autonomous report composer cooperating with the one or more machine learning models compose the first type of report by 1) initially choosing the first type of report from a category of the different types of possible reports to be generated, 2) where each different type of possible report is created to eff

Assignees

• Darktrace Ltd
• Darktrace Holdings Ltd

Inventors

• Humphrey Dickon
• Bazalgette Timothy
• Palmer David

Classifications

• H04L63/1483

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/0209

  Architectural arrangements, e.g. perimeter networks or demilitarized zones · CPC title

• H04L41/22

  comprising specially adapted graphical user interfaces [GUI] · CPC title