Systems and methods for intelligently generating cybersecurity contextual intelligence and generating a cybersecurity intelligence interface

Patent metadata

Field	Value
Publication number	US-11799887-B2
Application number	US-202318095754-A
Country	US
Kind code	B2
Filing date	Jan 11, 2023
Priority date	Jan 11, 2022
Publication date	Oct 24, 2023
Grant date	Oct 24, 2023

Abstract

A system and method for adapting one or more cybersecurity microservices to accelerate cybersecurity threat mitigation includes constructing a subscriber-specific data corpus comprising a plurality of distinct pieces of computing environment-informative data of a target subscriber; adapting a subscriber-agnostic microservice of the cybersecurity service to a subscriber-specific microservice, wherein: the subscriber-agnostic microservice includes a plurality of subscriber-agnostic cybersecurity event handling instructions, and adapting the subscriber-agnostic microservice to the subscriber-specific microservice includes generating a plurality of context-informed cybersecurity event handling instructions; augmenting the subscriber-agnostic microservice to include the plurality of context-informed cybersecurity event handling instructions; computing for a target cybersecurity event a subscriber-specific threat severity level based on one or more of the plurality of context-informed cybersecurity event handling instructions; executing, by one or more computers, a threat mitigation action or threat disposal action based on the computing of the subscriber-specific threat severity level for the target cybersecurity event.

First claim

We claim:

1. A method for intelligently adapting one or more cybersecurity microservices of a cybersecurity service to accelerate cybersecurity threat mitigation, the method comprising:
constructing a subscriber-specific data corpus comprising a plurality of distinct pieces of computing environment-informative data associated with one or more computing environments of a target subscriber;
adapting a subscriber-agnostic microservice of the cybersecurity service to a subscriber-specific microservice based on the subscriber-specific data corpus, wherein:
(1) the subscriber-agnostic microservice includes a plurality of distinct subscriber-agnostic cybersecurity event handling instructions, and
(2) the adapting the subscriber-agnostic microservice to the subscriber-specific microservice includes:
(2-a) generating a plurality of distinct context-informed cybersecurity event handling instructions based on at least a subset of the plurality of distinct pieces of computing environment-informative data of the target subscriber; and
(2-b) augmenting the subscriber-agnostic microservice to include the plurality of distinct context-informed cybersecurity event handling instructions;

routing, to the subscriber-specific microservice, a target cybersecurity event that includes a plurality of distinct pieces of event data; and
based on the routing, computing for the target cybersecurity event one of:
(i) a subscriber-specific threat severity level based on one or more of the plurality of distinct context-informed cybersecurity event handling instructions if at least one piece of event data of the target cybersecurity event is equivalent to one of the plurality of distinct pieces of computing environment-informative data of the subscriber-specific data corpus; and
(ii) a subscriber-agnostic threat severity level based on one or more of the plurality of distinct subscriber-agnostic cybersecurity event handling instructions if each piece of event data of the plurality of distinct pieces of event data is excluded from the subscriber-specific data corpus; and

executing, by one or more computers, a threat mitigation action or threat disposal action that resolves or mitigates a threat of the target cybersecurity event based on the computing of the subscriber-specific threat severity level or the subscriber-agnostic threat severity level for the target cybersecurity event.

2. The method according to claim 1 , wherein:
a subset of the plurality of distinct pieces of computing environment-informative data of the subscriber-specific data corpus includes one or more critical cybersecurity entities of the target subscriber; and
the generating the plurality of distinct context-informed cybersecurity event handling instructions includes creating at least one cybersecurity event handling instruction that, when executed, causes an automatic escalation of a threat severity level of a suspect cybersecurity event that involves the one or more critical cybersecurity entities.

3. The method according to claim 1 , wherein:
a subset of the plurality of distinct pieces of computing environment-informative data of the subscriber-specific data corpus includes one or more non-critical cybersecurity entities of the target subscriber; and
the generating the plurality of distinct context-informed cybersecurity event handling instructions includes creating at least one cybersecurity event handling instruction that, when executed, causes an automatic de-escalation of a threat severity level of a suspect cybersecurity event that involves the one or more non-critical cybersecurity entities.

4. The method according to claim 1 , wherein:
a subset of the plurality of distinct pieces of computing environment-informative data of the subscriber-specific data corpus includes one or more temporary user location adjustments for one or more digital users associated with the target subscriber; and
the generating the plurality of distinct context-informed cybersecurity event handling instructions includes creating at least one ephemeral cybersecurity event handling instruction that, when executed, causes an automatic escalation or de-escalation of a threat severity level of a suspect cybersecurity event that involves the one or more temporary location adjustments.

5. The method according to claim 1 , wherein:
a subset of the plurality of distinct pieces of computing environment-informative data of the subscriber-specific data corpus includes one or more critical cybersecurity entities of the target subscriber; and
the generating the plurality of distinct context-informed cybersecurity event handling instructions includes creating at least one cybersecurity event handling instruction that, when executed, automatically activates an automated remediations microservice of the cybersecurity service that automatically remediates or mitigates a suspect cybersecurity event that involves the one or more critical cybersecurity entities.

6. The method according to claim 1 , wherein:
a subset of the plurality of distinct pieces of computing environment-informative data of the subscriber-specific data corpus includes one or more non-critical cybersecurity entities of the target subscriber; and
the generating the plurality of distinct context-informed cybersecurity event handling instructions includes creating at least one cybersecurity event handling instruction that, when executed, causes an automatic suppression of a suspect cybersecurity event that involves the one or more non-critical cybersecurity entities.

7. The method according to claim 1 , wherein:
one piece of event data of the target cybersecurity event is equivalent to one of the plurality of distinct pieces of computing environment-informative data of the subscriber-specific data corpus,
the method further includes:
displaying, via a web-accessible user interface, the target cybersecurity event that includes the plurality of distinct pieces of event data; and
visually emphasizing the one piece of event data based on the one piece of event data being equivalent to the one of the plurality of distinct pieces of computing environment-informative data of the subscriber-specific data corpus.

8. The method according to claim 7 , wherein:
each distinct piece of computing environment-informative data of the plurality of distinct pieces of computing environment-informative data includes one or more strings of subscriber-informed text,
the method further comprising:
based on receiving a subscriber input directed to the one piece of event data, displaying a contextual intelligence graphical user interface that is overlaid on the web-accessible user interface that includes the one or more strings of subscriber-informed text associated with the one piece of event data.

9. The method according to claim 8 , further comprising:
mitigating, via an execution of one or more cybersecurity threat mitigation actions, a threat of the target cybersecurity event based on an evaluation of the contextual intelligence graphical user interface.

10. The method according to claim 8 , further comprising:
routing the target cybersecurity event to a cybersecurity event disposal queue based on an evaluation of the contextual intelligence graphical user interface.

11. A method for intelligently adapting one or more cybersecurity microservices of a cybersecurity service to accelerate cybersecurity threat mitigation, the method comprising:
identifying a subscriber-specific data corpus comprising a plurality of distinct pieces of computing environment-informative data associated with one or more computing environments of a target subscriber;
adapting a subscriber-agnostic microservice of the cybersecurity

Assignees

• Expel Inc

Inventors

• Duffy Patrick
• Mitchell Kelsey
• Silberman Peter

Classifications

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L41/22

  comprising specially adapted graphical user interfaces [GUI] · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title