Threat mitigation system and method

Patent metadata

Field	Value
Publication number	US-12373566-B2
Application number	US-202217747086-A
Country	US
Kind code	B2
Filing date	May 18, 2022
Priority date	Jun 6, 2018
Publication date	Jul 29, 2025
Grant date	Jul 29, 2025

Abstract

A computer-implemented method, computer program product and computing system for: receiving platform information from a plurality of security-relevant subsystems; processing the platform information to generate processed platform information; identifying less threat-pertinent content included within the processed content; and routing the less threat-pertinent content to a long term storage system.

First claim

What is claimed is:

1. A computer-implemented method, executed on a computing device, comprising:
receiving platform information from a plurality of security-relevant subsystems including searching the plurality of security-relevant subsystems;
processing the platform information to generate processed platform information, including detecting a security event, including
obtaining one or more artifacts concerning the security event;
obtaining artifact information concerning the one or more artifacts from one or more investigation resources; and
generating a conclusion concerning the security event;

assigning a threat level to the security event;
identifying less threat-pertinent content included within the processed platform information associated with the security event;
routing the less threat-pertinent content to a long term storage system; and
receiving threat event information for the plurality of security-relevant subsystems within the computing platform; and
retroactively applying the threat event information to the processed platform information associated with the one or more of the plurality of security-relevant subsystems.

2. The computer-implemented method of claim 1 wherein processing the platform information to generate processed platform information includes:
parsing the platform information into a plurality of subcomponents to allow for compensation of varying formats and/or nomenclature.

3. The computer-implemented method of claim 1 wherein processing the platform information to generate processed platform information includes:
enriching the platform information by including supplemental information from external information resources.

4. The computer-implemented method of claim 1 wherein processing the platform information to generate processed platform information includes:
utilizing artificial intelligence/machine learning to identify one or more patterns/behaviors defined within the platform information.

5. The computer-implemented method of claim 1 wherein the plurality of security-relevant subsystems includes one or more of:
a data lake;
a data log;
a security-relevant software application;
a security-relevant hardware system; and
a resource external to the computing platform.

6. The computer-implemented method of claim 1 wherein identifying less threat-pertinent content included within the processed platform information includes:
processing the processed platform information to identify non-actionable content within the processed platform information that is not usable by a threat analysis engine.

7. The computer-implemented method of claim 1 further comprising:
allowing a third-party to access and search the long term storage system.

8. A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
receiving platform information from a plurality of security-relevant subsystems including searching the plurality of security-relevant subsystems;
processing the platform information to generate processed platform information, including detecting a security event, including
obtaining one or more artifacts concerning the security event;
obtaining artifact information concerning the one or more artifacts from one or more investigation resources; and
generating a conclusion concerning the security event;

assigning a threat level to the security event;
identifying less threat-pertinent content included within the processed platform information associated with the security event;
routing the less threat-pertinent content to a long term storage system; and
receiving threat event information for the plurality of security-relevant subsystems within the computing platform; and
retroactively applying the threat event information to the processed platform information associated with the one or more of the plurality of security-relevant subsystems.

9. The computer program product of claim 8 wherein processing the platform information to generate processed platform information includes:
parsing the platform information into a plurality of subcomponents to allow for compensation of varying formats and/or nomenclature.

10. The computer program product of claim 8 wherein processing the platform information to generate processed platform information includes:
enriching the platform information by including supplemental information from external information resources.

11. The computer program product of claim 8 wherein processing the platform information to generate processed platform information includes:
utilizing artificial intelligence/machine learning to identify one or more patterns/behaviors defined within the platform information.

12. The computer program product of claim 8 wherein the plurality of security-relevant subsystems includes one or more of:
a data lake;
a data log;
a security-relevant software application;
a security-relevant hardware system; and
a resource external to the computing platform.

13. The computer program product of claim 8 wherein identifying less threat-pertinent content included within the processed platform information includes:
processing the processed platform information to identify non-actionable content within the processed platform information that is not usable by a threat analysis engine.

14. The computer program product of claim 8 further comprising:
allowing a third-party to access and search the long term storage system.

15. A computing system including a processor and memory configured to perform operations comprising:
receiving platform information from a plurality of security-relevant subsystems including searching the plurality of security-relevant subsystems;
processing the platform information to generate processed platform information, including detecting a security event, including
obtaining one or more artifacts concerning the security event;
obtaining artifact information concerning the one or more artifacts from one or more investigation resources; and
generating a conclusion concerning the security event;

assigning a threat level to the security event;
identifying less threat-pertinent content included within the processed platform information associated with the security event;
routing the less threat-pertinent content to a long term storage system; and
receiving threat event information for the plurality of security-relevant subsystems within the computing platform; and
retroactively applying the threat event information to the processed platform information associated with the one or more of the plurality of security-relevant subsystems.

16. The computing system of claim 15 wherein processing the platform information to generate processed platform information includes:
parsing the platform information into a plurality of subcomponents to allow for compensation of varying formats and/or nomenclature.

17. The computing system of claim 15 wherein processing the platform information to generate processed platform information includes:
enriching the platform information by including supplemental information from external information resources.

18. The computing system of claim 15 wherein processing the platform information to generate processed platform information includes:
utilizing artificial intelligence/machine learning to identify one or more patterns/behaviors defined within the platform information.

19. The c

Assignees

• Reliaquest Holdings Llc

Inventors

• Murphy Brian P
• Partlow Joe
• O'Connor Colin
• Pfeiffer Jason

Classifications

• G06F18/20

  Analysing · CPC title

• G06F18/214

  Generating training patterns; Bootstrap methods, e.g. bagging or boosting · CPC title

• H04L63/0263

  Rule management · CPC title

• G06F21/568

  eliminating virus, restoring damaged files · CPC title

• G06F30/20

  Design optimisation, verification or simulation (optimisation, verification or simulation of circuit designs G06F30/30) · CPC title