Systems and methods for predicting the likelihood of cyber-threats leveraging intelligence associated with hacker communities

Patent metadata

Field	Value
Publication number	US-12170684-B2
Application number	US-201916522001-A
Country	US
Kind code	B2
Filing date	Jul 25, 2019
Priority date	Jul 25, 2018
Publication date	Dec 17, 2024
Grant date	Dec 17, 2024

Abstract

Various embodiments of a system and methods for reasoning about enterprise-related external cyber threats using a rule-leaning approach are disclosed.

First claim

What is claimed is:

1. A method of predicting likelihood of exploitation for cyber threats before they occur, the method, comprising:
providing a processor in communication with a tangible storage medium;
storing instructions that are executed by the processor to perform operations comprising:
accessing a first dataset defining communications from forums and marketplaces associated with a hacker community;
deriving a plurality of temporal rules by correlating a plurality of indicators generated from the first dataset and ground truth information associated with known cyberattacks by:
filtering out data that is not related to cybersecurity;
retaining data that is related to cybersecurity;
recognizing entities from the context of postings and assigning a confidence score;
using the confidence score and potential impact of concept drift to filter for relevant entities; and
using machine learning to derive the temporal rules;

the plurality of indicators including mappings between a vulnerability and a platform known to be susceptible to the vulnerability; and
predicting a cyber threat, including:
identifying an indicator of the plurality of indicators from a second dataset, the second dataset defining additional communications from the hacker community and the indicator being a precondition to a corresponding rule of the plurality of temporal rules, and applying information associated with the indicator to the corresponding rule of the plurality of temporal rules to output at least one prediction of a future attack associated with the cyber threat.

2. The method of claim 1 , further comprising generating the plurality of rules by deriving a set of probability boundaries of future actions using an annotated probabilistic temporal logic rules framework and narrowing the set of probability boundaries.

3. The method of claim 2 , wherein one of the plurality of rules defines a probability value for the attack associated with the cyber threat occurring within a predetermined time interval of a condition being true.

4. The method of claim 3 , wherein a point frequency function of the annotated probabilistic temporal logic rules framework is applied to output a frequency value for the attack following identification of the indicator from the second dataset in an exact time interval and defines a predetermined precise temporal relationship between the attack and the indicator.

5. The method of claim 4 , wherein the frequency value for the attack following the indicator in an exact time interval is calculated using a probability interval.

6. The method of claim 2 , wherein an existential frequency function of the annotated probabilistic temporal logic rules framework is applied to output a frequency value for the attack following identification of the indicator within a predetermined number of time points and defines a specified temporal relationship between the attack and the indicator.

7. The method of claim 6 , wherein the frequency value for the attack following the indicator within a predetermined number of time points is calculated using a probability interval.

8. The method of claim 1 , wherein a plurality of rule-learning approaches are applied to learn a set of temporal correlations between the first dataset and the known cyberattacks.

Assignees

• Almukaynizi Mohammed
• Marin Ericsson
• Shakarian Paulo
• Simari Gerardo
• Nunes Eric
• Univ Arizona State

Inventors

• Almukaynizi Mohammed
• Marin Ericsson
• Shakarian Paulo
• Simari Gerardo
• Nunes Eric

Classifications

• H04L63/302

  gathering intelligence information for situation awareness or reconnaissance · CPC title

• G06N5/025 Primary

  Extracting rules from data · CPC title

• G06N3/044

  Recurrent networks, e.g. Hopfield networks · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title