Threat mitigation system and method

Patent metadata

Field	Value
Publication number	US-12381908-B2
Application number	US-202418635680-A
Country	US
Kind code	B2
Filing date	Apr 15, 2024
Priority date	Nov 26, 2019
Publication date	Aug 5, 2025
Grant date	Aug 5, 2025

Abstract

A computer-implemented method, computer program product and computing system for: establishing connectivity with a plurality of security-relevant subsystems within a computing platform; and mapping one or more data fields of a unified platform to one or more data fields of each of the plurality of security-relevant subsystems.

First claim

What is claimed is:

1. A computer-implemented method, executed on a computing device, comprising:
establishing connectivity with a plurality of security-relevant subsystems within a computing platform;
defining a unified query on a unified platform concerning the plurality of security-relevant subsystems; and
denormalizing the unified query to define a subsystem-specific query for each of the plurality of security-relevant subsystems, thus defining a plurality of subsystem-specific queries.

2. The computer-implemented method of claim 1 , further comprising:
mapping one or more data fields of the unified platform to one or more data fields of each of the plurality of security-relevant subsystems, including:
mapping one or more data fields within a query structure of the unified platform to one or more data fields within a query structure of each of the plurality of security-relevant subsystems.

3. The computer-implemented method of claim 1 , further comprising:
mapping one or more data fields of the unified platform to one or more data fields of each of the plurality of security-relevant subsystems, including:
mapping one or more data fields within a result set structure of each of the plurality of security-relevant subsystems to one or more data fields within a result set structure of the unified platform.

4. The computer-implemented method of claim 1 , further comprising:
mapping one or more data fields of the unified platform to one or more data fields of each of the plurality of security-relevant subsystems, including:
mapping one or more data fields of the unified platform to one or more data fields of each of the plurality of security-relevant subsystems at a defined periodicity.

5. The computer-implemented method of claim 1 , further comprising:
mapping one or more data fields of the unified platform to one or more data fields of each of the plurality of security-relevant subsystems, including:
proactively mapping one or more data fields of the unified platform to one or more data fields of each of the plurality of security-relevant subsystems.

6. The computer-implemented method of claim 1 , further comprising:
mapping one or more data fields of the unified platform to one or more data fields of each of the plurality of security-relevant subsystems, including:
reactively mapping one or more data fields of the unified platform to one or more data fields of each of the plurality of security-relevant subsystems.

7. The computer-implemented method of claim 1 , further comprising:
providing the plurality of subsystem-specific queries to the plurality of security-relevant subsystems.

8. The computer-implemented method of claim 7 , further comprising:
receiving a plurality of subsystem-specific results sets from the plurality of security-relevant subsystems that were generated in response to the plurality of subsystem-specific queries.

9. The computer-implemented method of claim 8 , further comprising:
normalizing the plurality of subsystem-specific results sets received from the plurality of security-relevant subsystems to define a unified result set.

10. The computer-implemented method of claim 9 , further comprising:
providing the unified result set to a third-party.

11. A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
establishing connectivity with a plurality of security-relevant subsystems within a computing platform;
defining a unified query on a unified platform concerning the plurality of security-relevant subsystems; and
denormalizing the unified query to define a subsystem-specific query for each of the plurality of security-relevant subsystems, thus defining a plurality of subsystem-specific queries.

12. The computer program product of claim 11 , further comprising:
mapping one or more data fields of the unified platform to one or more data fields of each of the plurality of security-relevant subsystems, including:
mapping one or more data fields within a query structure of the unified platform to one or more data fields within a query structure of each of the plurality of security-relevant subsystems.

13. The computer program product of claim 11 , further comprising:
mapping one or more data fields of the unified platform to one or more data fields of each of the plurality of security-relevant subsystems, including:
mapping one or more data fields within a result set structure of each of the plurality of security-relevant subsystems to one or more data fields within a result set structure of the unified platform.

14. The computer program product of claim 11 , further comprising:
mapping one or more data fields of the unified platform to one or more data fields of each of the plurality of security-relevant subsystems, including:
mapping one or more data fields of the unified platform to one or more data fields of each of the plurality of security-relevant subsystems at a defined periodicity.

15. The computer program product of claim 11 , further comprising:
mapping one or more data fields of the unified platform to one or more data fields of each of the plurality of security-relevant subsystems, including:
proactively mapping one or more data fields of the unified platform to one or more data fields of each of the plurality of security-relevant subsystems.

16. The computer program product of claim 11 , further comprising:
mapping one or more data fields of the unified platform to one or more data fields of each of the plurality of security-relevant subsystems, including:
reactively mapping one or more data fields of the unified platform to one or more data fields of each of the plurality of security-relevant subsystems.

17. The computer program product of claim 11 , further comprising:
providing the plurality of subsystem-specific queries to the plurality of security-relevant subsystems.

18. The computer program product of claim 17 , further comprising:
receiving a plurality of subsystem-specific results sets from the plurality of security-relevant subsystems that were generated in response to the plurality of subsystem-specific queries.

19. The computer program product of claim 18 , further comprising:
normalizing the plurality of subsystem-specific results sets received from the plurality of security-relevant subsystems to define a unified result set.

20. The computer program product of claim 19 , further comprising:
providing the unified result set to a third-party.

21. A computing system including a processor and memory configured to perform operations comprising:
establishing connectivity with a plurality of security-relevant subsystems within a computing platform;
defining a unified query on a unified platform concerning the plurality of security-relevant subsystems; and
denormalizing the unified query to define a subsystem-specific query for each of the plurality of security-relevant subsystems, thus defining a plurality of subsystem-specific queries.

22. The computing system of claim 21 , further comprising:
mapping one or more data fields of the unified platform to one or more data fields of each of the plurality of security-relevant subsystems, including:
mapping one or more data fields within a query structure of the unified platform to one or more data fields within a query structure of each of the pluralit

Assignees

• Reliaquest Holdings Llc

Inventors

• Murphy Brian P
• Partlow Joe
• O'Connor Colin
• Pfeiffer Jason
• Murphy Brian Philip

Classifications

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1466

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• G06F16/2455

  Query execution · CPC title

• G06F16/2452

  Query translation · CPC title