System and methods for automated detection, reasoning and recommendations for resilient cyber systems
US-10855706-B2 · Dec 1, 2020 · US
US11823019B2 · US · B2
| Field | Value |
|---|---|
| Publication number | US-11823019-B2 |
| Application number | US-202117370434-A |
| Country | US |
| Kind code | B2 |
| Filing date | Jul 8, 2021 |
| Priority date | Mar 22, 2021 |
| Publication date | Nov 21, 2023 |
| Grant date | Nov 21, 2023 |
A practical reading order for non-experts. Skip the full description unless you need deep technical detail.
What the patent document calls the invention.
A short plain-language summary of the technical disclosure.
Who owns or filed the patent and who is credited as inventor.
Filing, priority, publication, and grant dates set the timeline.
The legal scope of protection — read this for what is actually claimed.
Technology tags used to group this patent with similar filings.
Prior art links and similar publications in this corpus.
Official abstract text for this publication.
Implementations of the present disclosure include receiving a goal, providing a problem-specific knowledge graph that is responsive to at least a portion of the goal, determining a set of events from the problem-specific knowledge graph, processing data representative of events in the set of events through a first machine learning (ML) model to provide a set of event scores, each event score in the set of event scores being associated with a respective event in the set of events, determining a sub-set of events based on the set of event scores, for each event in the sub-set of events, determining at least one action by processing a sequence of actions through a second ML model, and outputting the sub-set of events and a set of actions for execution of at least one action in the set of actions.
Opening claim text (preview).
What is claimed is: 1. A computer-implemented method for generating events and actions based on pattern recognition in data of connected networks, the method comprising: receiving a goal; providing a problem-specific knowledge graph that is responsive to at least a portion of the goal; determining a set of events from the problem-specific knowledge graph, wherein determining the set of events comprises: mapping at least a portion of entities identified from the goal to corresponding nodes in the problem-specific knowledge graph, and identifying a path within the problem-specific knowledge graph that includes the corresponding nodes, wherein the identified path is a minimal path with shortest distances connecting the corresponding nodes; processing data representative of events in the set of events through a first machine learning (ML) model to provide a set of event scores, wherein: each event score in the set of event scores being associated with a respective event in the set of events, and the first ML model i) processes at least a portion of a sparse feature set of a respective event through an embedding layer to botain a first set of values, ii) processes a dense feature set of the respective event through a hidden layer to obtain a second set of value, and iii) processes the first set of values and the second set of values to provide an event score for the respective event; determing a sub-set of events based on the set of event scores; for each event in the sub-set of events, determining at least one action by processing a sequence of actions through a second ML model; and outputting the sub-set of events and a set of actions for execution of at least one action in the set of actions. 2. The computer-implemented method of claim 1 , wherein events are determined as respective instances of at least one node in the problem-specific knowledge graph. 3. The computer-implemented method of claim 1 , wherein the second ML model receives a sequence of actions associated with a respective event and predicts a next action in the sequence of actions for the respective event. 4. The computer-implemented method of claim 1 , wherein the second ML model comprises a set of transformers that process the sequence of actions. 5. The computer-implemented method of claim 1 , further comprising, for each event in the set of events, extracting data representative of the event through web sensing. 6. A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for generating events and actions based on pattern recognition in data of connected networks, the operations comprising: receiving a goal; providing a problem-specific knowledge graph that is responsive to at least a portion of the goal; determining a set of events from the problem-specific knowledge graph, wherein determining the set of events comprises: mapping at least a portion of entities identified from the goal to corresponding nodes in the problem-specific knowledge graph, and identifying a path within the problem-specific knowledge graph that includes the corresponding nodes, wherein the identified path is a minimal path with shortest distances connecting the corresponding nodes; processing data representative of events in the set of events through a first machine learning (ML) model to provide a set of event scores, wherein: each event score in the set of event scores being associated with a respective event in the set of events; and the first ML and i) processes at least a portion of a sparse feature set of a respective event through an embedding layer to obtain a first set of values, ii) processes a dense feature set of the respective event through a hidden layer to obtain a second set of value, and iii) processes the first set of values and the second set of values to provide an event score for the respective event; determining a sub-set of events based on the set of event scores; for each event in the sub-set of events, determining at least one action by processing a sequence of actions through a second ML model; and outputting the sub-set of events and a set of actions for execution of at least one action in the set of actions. 7. The non-transitory computer-readable storage medium of claim 6 , wherein events are determined as respective instances of at least one node in the problem-specific knowledge graph. 8. The non-transitory computer-readable storage medium of claim 6 , wherein the second ML model receives a sequence of actions associated with a respective event and predicts a next action in the sequence of actions for the respective event. 9. The non-transitory computer-readable storage medium of claim 6 , wherein the second ML model comprises a set of transformers that process the sequence of actions. 10. The non-transitory computer-readable storage medium of claim 6 , wherein operations further comprise, for each event in the set of events, extracting data representative of the event through web sensing. 11. A system, comprising: a computing device; and a computer-readable storage device coupled to the computing device and having instructions stored thereon which, when executed by the computing device, cause the computing device to perform operations for generating events and actions based on pattern recognition in data of connected networks, the operations comprising: receiving a goal; providing a problem-specific knowledge graph that is responsive to at least a portion of the goal; determining a set of events from the problem-specific knowledge graph, wherein determining the set of events comprises: mapping at least a portion of entities identified from the goal to corresponding nodes in the problem-specific knowledge graph, and identifying a path within the problem-specific knowledge graph that includes the corresponding nodes, wherein the identified path is a minimal path with shortest distances connecting the corresponding nodes; processing data representative of events in the set of events through a first machine learning (ML) model to provide a set of event scores, wherein: each event score in the set of event scores being associated with a respective event in the set of events; and the first ML model i) processes at least a portion of a sparse feature set of a respective event through an embedding layer to obtain a first set of values, ii) processing a dense feature set of the respective event through a hidden layer to obtain a second set of value, and iii) processes the first set of values and the second set of values to provide an event score for the respective event; determining a sub-set of events based on the set of event scores; for each event in the sub-set of events, determining at least one action by processing a sequence of actions through a second ML model; and outputting the sub-set of events and a set of actions for execution of at least one action in the set of actions. 12. The system of claim 11 , wherein events are determined as respective instances of at least one node in the problem-specific knowledge graph. 13. The system of claim 11 , wherein the second ML model receives a sequence of actions associated with a respective event and predicts a next action in the sequence of actions for the respective event. 14. The system of claim 11 , wherein the second ML model comprises a set of transformers that process the sequence of actions.
Machine learning · CPC title
Knowledge representation; Symbolic representation · CPC title
Workflow analysis · CPC title
Market modelling; Market analysis; Collecting market data · CPC title
Electronic shopping [e-shopping] · CPC title
Related publications grouped by family.
Answers are generated from the same data shown on this page.