System event detection system and method

Patent metadata

Field	Value
Publication number	US-11874872-B2
Application number	US-201916660217-A
Country	US
Kind code	B2
Filing date	Oct 22, 2019
Priority date	Oct 4, 2019
Publication date	Jan 16, 2024
Grant date	Jan 16, 2024

Abstract

A method, performed by one or more processors, including: receiving one or more event records; generating, using the one or more event records, an event descriptor object descriptive of one or more events occurring in a networked system, wherein the event descriptor object comprises a plurality of event properties; receiving one or more entity records; generating, using the one or more entity records, an entity descriptor object descriptive of one or more entities relevant to the security of the networked system, wherein the entity descriptor object comprises a plurality of entity properties; incorporating, into an object graph, the event descriptor object and the entity descriptor object; and associating, in the object graph, the event descriptor object with the entity descriptor object using at least one of the plurality of event properties and at least one of the plurality of entity properties.

First claim

What is claimed is:

1. A method, performed by one or more processors, comprising:
receiving one or more event records;
generating, using the one or more event records, an event descriptor object descriptive of one or more potential suspicious system events indicative of a cybersecurity threat occurring in a networked system, wherein the event descriptor object comprises a plurality of event properties;
receiving one or more entity records;
generating, using the one or more entity records, an entity descriptor object descriptive of one or more entities relevant to a security of the networked system, wherein the entity descriptor object comprises a plurality of entity properties;
incorporating, into an object graph, the event descriptor object as a first node and the entity descriptor object as a second node;
in response to determining that a value of an entity property of the plurality of entity properties matches a value of an event property of the plurality of event properties, associating, in the object graph, the event descriptor object with the entity descriptor object; and
determining a course of action entity descriptor object descriptive of one or more actions for mitigating the cybersecurity threat, wherein the object graph comprises a link between the event descriptor object and the course of action entity descriptor object.

2. The method of claim 1 , wherein receiving the one or more entity records comprises:
receiving a first one or more entity records from a first entity record source; and
receiving a second one or more entity records from a second entity record source.

3. The method of claim 2 , wherein the first entity record source is a system log and the second entity record source is a security monitoring application.

4. The method of claim 2 , wherein generating the entity descriptor object comprises:
determining that a first entity property of the plurality of entity properties is to be extracted from the first one or more entity records;
extracting the first entity property from the first one or more entity records;
determining that a second entity property of the plurality of entity properties is to be extracted from the second one or more entity records; and
extracting the second entity property from the second one or more entity re cords.

5. The method of claim 2 , wherein generating the entity descriptor object comprises:
determining that a value for an entity property of the plurality of entity properties is contained in both the first one or more entity records and the second one or more entity records;
determining that the first entity record source is a more reliable entity record source for the event property; and
extracting the entity property from the first one or more entity records.

6. The method of claim 1 , wherein associating the entity descriptor object with the event descriptor object uses the value for the entity property contained in the second one or more entity records.

7. The method of claim 1 , further comprising:
receiving one or more second entity records;
generating, using the one or more second entity records, a second entity descriptor object descriptive of a second one or more entities relevant to the security of the networked system, wherein the second entity descriptor object comprises a plurality of second entity properties;
incorporating, into the object graph, the second entity descriptor object; and
associating, in the object graph, the second entity descriptor object with the entity descriptor object using at least one of the plurality of second entity properties and at least one of the plurality of entity properties.

8. The method of claim 1 , further comprising:
analyzing, using one or more data analysis software components, at least part of the object graph, wherein analyzing the at least part of the object graph comprises deriving one or more cybersecurity indicators for the one or more entities using the association between the event descriptor object and the entity descriptor object.

9. The method of claim 1 , further comprising:
sending, to a client device, a representation of the event descriptor object for display;
receiving, from the client device, a request for information associated with the event descriptor object;
in response to the request, locating, in the object graph, one or more objects associated with the event descriptor object, wherein the one or more objects comprise the entity descriptor object; and
sending, to the client device, a representation of the one or more objects for display.

10. The method of claim 9 , further comprising:
receiving, from the client device, a second requestor information associated with the entity descriptor object;
in response to the second request, locating, in the object graph, a second one or more objects associated with the entity descriptor object, wherein the second one or more objects comprise another entity descriptor object; and
sending, to the client device, a representation of the second one or more objects for display.

11. The method of claim 9 , further comprising:
receiving, from the client device, a request for details of the one or more actions for mitigating a cybersecurity threat indicated by the event descriptor object;
in response to the request, locating, in the object graph, one or more course of action entity descriptor objects descriptive of the one or more actions for mitigating the cybersecurity threat, wherein the object graph comprises a path between the event descriptor object and the course of action entity descriptor object; and
sending, to the client device, a representation of the course of action entity descriptor objector display.

12. The method of claim 10 , wherein the second request for information associated with the entity descriptor object is a request for details of actions for mitigating a cybersecurity threat indicated by the event descriptor object.

13. The method of claim 1 , wherein the one or more event records and the one or more entity records are preexisting records.

14. A method, performed by one or more processors, comprising:
receiving, from a server device, a representation of an event descriptor object descriptive of one or more potential suspicious system events indicative of a cybersecurity threat occurring in a networked system, wherein the representation of the event descriptor object comprises a plurality of event properties;
displaying the plurality of event properties;
receiving an input indicative of a request for information associated with the event descriptor object;
sending, to the server device, the request for information associated with the event descriptor object; and
receiving, from the server device, a representation of an entity descriptor object descriptive of one or more entities relevant to a security of the networked system wherein:
the representation of the entity descriptor object comprises a plurality of entity properties;

in response to determining that a value of an entity property of the plurality of entity properties matches a value of an event property of the plurality of event properties, the entity descriptor object as a first node is associated with the event descriptor object as a second node in an object graph at the server device;
determining a course of action entity descriptor object descriptive of one or more actions for mitigating the cybersecurity threat, wherein the object graph comprises a link between the event descriptor object and the course of action entity descriptor object; and
displaying the plurality of entity properties.

15. The method of claim

Assignees

• Palantir Technologies Inc

Inventors

• Eggleton Andrew
• Serenhov Alexandra
• Shankar Ankit
• Helms Brandon
• Keohane Brian
• Zhao Darren
• Colquhoun Elliot
• Punukollu Gautam
• Kromann Morten
• Seetharaman Nikhil
• Highet Ranec
• Krishnan Raj
• Tang Xiao
• Krishnan Sriram
• Vahr Simon
• Alkhatib Tareq
• Mathew Thomas

Classifications

• G06F16/9024 Primary

  Graphs; Linked lists (G06F16/9027 takes precedence) · CPC title

• G06F21/552 Primary

  involving long-term monitoring or reporting · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title