Threat mitigation system and method

Patent metadata

Field	Value
Publication number	US-12355799-B2
Application number	US-202217857461-A
Country	US
Kind code	B2
Filing date	Jul 5, 2022
Priority date	Sep 9, 2019
Publication date	Jul 8, 2025
Grant date	Jul 8, 2025

Abstract

A computer-implemented method, computer program product and computing system for: defining a threat mitigation platform for a client, wherein the threat mitigation platform includes a plurality of threat detection capability modules; defining a rollout schedule for at least a portion of the plurality of threat detection capability modules; and presenting the rollout schedule to the client.

First claim

What is claimed is:

1. A computer-implemented method, executed on a computing device, comprising:
monitoring, by a plurality of security-relevant subsystems, the activity of each respective security-relevant subsystem with respect to a computing platform, wherein the plurality of security-relevant subsystems include one or more of CDN (Content Delivery Network) systems; DAM (Database Activity Monitoring) systems; UBA (User Behavior Analytics) systems; MDM (Mobile Device Management) systems; IAM (Identity and Access Management) systems; DNS (Domain Name Server) systems, antivirus systems, operating systems, data lakes; data logs; security-relevant software applications; security-relevant hardware systems; and resources external to the computing platform;
generating at least a first set of platform information based upon, at least in part, the monitored activity of at least a portion of the plurality of security-relevant subsystems;
defining a threat mitigation platform for a client based upon, at least in part, the first set of platform information, so as to define at least one threat detection capability module for future installation on the computing platform, including applying a probabilistic process including artificial intelligence/machine learning to the first set of platform information, so as to define at least one threat detection capability module for installation on the computing platform;
defining a rollout schedule for at least a portion of the plurality of threat detection capability modules;
determining a difference between current security-relevant capabilities of the computing platform and possible security-relevant capabilities of the computing platform, including:
determining possible security-relevant capabilities of the computing platform using currently-deployed security relevant subsystem; and
determining possible security-relevant capabilities of the computing platform using one or more supplemental security-relevant subsystems; and

presenting the rollout schedule to the client and an identification of one or more security-relevant deficiencies of the computing platform.

2. The computer-implemented method of claim 1 wherein the rollout schedule is a graphical rollout schedule.

3. The computer-implemented method of claim 1 wherein the rollout schedule is a text-based rollout schedule.

4. The computer-implemented method of claim 1 wherein presenting the rollout schedule to the client includes:
providing the rollout schedule to the client as a periodic platform status update.

5. The computer-implemented method of claim 1 wherein presenting the rollout schedule to the client includes:
providing the rollout schedule to the client as an ad hoc platform status update.

6. The computer-implemented method of claim 1 wherein presenting the rollout schedule to the client includes:
enabling the client to view the rollout schedule via a user interface.

7. The computer-implemented method of claim 1 wherein the rollout schedule defines a date for each of the plurality of threat detection capability modules.

8. The computer-implemented method of claim 1 wherein the rollout schedule defines a content for each of the plurality of threat detection capability modules.

9. A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
monitoring, by a plurality of security-relevant subsystems, the activity of each respective security-relevant subsystem with respect to a computing platform, wherein the plurality of security-relevant subsystems include one or more of CDN (Content Delivery Network) systems; DAM (Database Activity Monitoring) systems; UBA (User Behavior Analytics) systems; MDM (Mobile Device Management) systems; IAM (Identity and Access Management) systems; DNS (Domain Name Server) systems, antivirus systems, operating systems, data lakes; data logs; security-relevant software applications; security-relevant hardware systems; and resources external to the computing platform;
generating at least a first set of platform information based upon, at least in part, the monitored activity of at least a portion of the plurality of security-relevant subsystems;
defining a threat mitigation platform for a client based upon, at least in part, the first set of platform information, so as to define at least one threat detection capability module for future installation on the computing platform, including applying a probabilistic process including artificial intelligence/machine learning to the first set of platform information, so as to define at least one threat detection capability module for installation on the computing platform;
defining a rollout schedule for at least a portion of the plurality of threat detection capability modules;
determining a difference between current security-relevant capabilities of the computing platform and possible security-relevant capabilities of the computing platform, including:
determining possible security-relevant capabilities of the computing platform using currently-deployed security relevant subsystem; and
determining possible security-relevant capabilities of the computing platform using one or more supplemental security-relevant subsystems; and

presenting the rollout schedule to the client and an identification of one or more security-relevant deficiencies of the computing platform.

10. The computer program product of claim 9 wherein the rollout schedule is a graphical rollout schedule.

11. The computer program product of claim 9 wherein the rollout schedule is a text-based rollout schedule.

12. The computer program product of claim 9 wherein presenting the rollout schedule to the client includes:
providing the rollout schedule to the client as a periodic platform status update.

13. The computer program product of claim 9 wherein presenting the rollout schedule to the client includes:
providing the rollout schedule to the client as an ad hoc platform status update.

14. The computer program product of claim 9 wherein presenting the rollout schedule to the client includes:
enabling the client to view the rollout schedule via a user interface.

15. The computer program product of claim 9 wherein the rollout schedule defines a date for each of the plurality of threat detection capability modules.

16. The computer program product of claim 9 wherein the rollout schedule defines a content for each of the plurality of threat detection capability modules.

17. A computing system including a processor and memory configured to perform operations comprising:
monitoring, by a plurality of security-relevant subsystems, the activity of each respective security-relevant subsystem with respect to a computing platform, wherein the plurality of security-relevant subsystems include one or more of CDN (Content Delivery Network) systems; DAM (Database Activity Monitoring) systems; UBA (User Behavior Analytics) systems; MDM (Mobile Device Management) systems; IAM (Identity and Access Management) systems; DNS (Domain Name Server) systems, antivirus systems, operating systems, data lakes; data logs; security-relevant software applications; security-relevant hardware systems; and resources external to the computing platform;
generating at least a first set of platform information based upon, at least in part, the monitored activity of at least a portion of the plurality of security-relevant subsystems;
defining a threat mitigation platform for a client based u

Assignees

• Reliaquest Holdings Llc

Inventors

• Murphy Brian P
• Partlow Joe
• O'Connor Colin
• Pfeiffer Jason
• Murphy Brian Philip

Classifications

• H04L67/60

  Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources (admission control or resource allocation H04L47/70) · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06N5/04

  Inference or reasoning models · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F11/3409

  for performance assessment · CPC title