Cyber security restoration engine

Patent metadata

Field	Value
Publication number	US-12401670-B2
Application number	US-202217991173-A
Country	US
Kind code	B2
Filing date	Nov 21, 2022
Priority date	Nov 22, 2021
Publication date	Aug 26, 2025
Grant date	Aug 26, 2025

Abstract

A cyber security restoration engine takes one or more autonomous remediation actions to remediate one or more nodes in a graph of a system being protected back to a trusted operational state in order to assist in a recovery from the cyber threat. The cyber security restoration engine has a tracking component the operational state of each node in the graph of the protected system. The communication module also cooperates with the cyber security restoration engine to communicate with at least one of an external backup system and a recovery service to invoke backup remediation actions and/or recovery remediation actions to remediate one or more nodes potentially compromised by the cyber threat back to a trusted operational state, for example the state before the detected compromise by the cyber threat occurred in the protected system.

First claim

The invention claimed is:

1. An apparatus, comprising:
a cyber security restoration engine configured to take one or more autonomous remediation actions to remediate one or more nodes in a graph of a system being protected back to a trusted operational state in order to assist in a recovery from the cyber threat,
a communication module configured to cooperate with the cyber security restoration engine to communicate with other Artificial Intelligence-based engines of a cyber security system that identify the cyber threat itself and that take one or more mitigation actions to mitigate the cyber threat during a cyberattack by the cyber threat, and
where the cyber security restoration engine has a tracking component that includes at least one of i) a database to keep a record and track an operational state of each node in the graph of the protected system, ii) an Artificial Intelligence model trained to track the operational state of each node in the graph of the protected system, iii) a query to another artificial intelligence based engine that tracks the operational state of each node in the graph of nodes of the system being protected, and iv) a combination of any of these, so that the cyber security restoration engine can then take the one or more autonomous remediation actions to remediate a first node back to the trusted operational state for that node.

2. The apparatus of claim 1 , where the cyber security restoration engine is configured to cooperate with a detection engine to track and understand the cyber threat identified by the detection engine as well as track one or more mitigation actions taken to mitigate the cyber threat during the cyberattack by at least one of i) an autonomous response engine and ii) a human cyber security team member in order to assist in intelligently restoring the protected system while still mitigating the cyber threat attack back to the trusted operational state before indications of when the compromised started by the cyber threat attack; and thus, as a situation develops with an ongoing cyberattack, the cyber security restoration engine is configured to take the one or more remediation actions to remediate at least one of the nodes in the graph of the protected system back to the trusted operational state while the cyberattack is still ongoing, where the detection engine is one of the other Artificial Intelligence-based engines.

3. The apparatus of claim 1 , where an autonomous response engine is configured to take one or more autonomous mitigation actions to mitigate the cyber threat during the cyberattack by the cyber threat, where the autonomous response engine is configured to reference an Artificial Intelligence model trained to track a normal pattern of life for nodes of the protected system to perform an autonomous act of restricting a first node having an indication of compromise to merely take actions that are within the first node's normal pattern of life to mitigate the cyber threat, where the autonomous response engine is one of the other Artificial Intelligence-based engines.

4. The apparatus of claim 1 , where the communication module is further configured to communicate also with at least one of an external backup system and a recovery service to invoke backup remediation actions and recovery remediation actions to remediate a first node potentially compromised by the cyber threat back to the trusted operational state before the detected compromise by the cyber threat occurred in the protected system.

5. The apparatus of claim 1 , where the cyber security restoration engine is further configured to restore the one or more nodes in the system being protected by cooperating with at least two or more of 1) an Artificial Intelligence model trained to model a normal pattern of life for each node in the protected system, 2) an Artificial Intelligence model trained on what are a possible set of cyber threats and their characteristics and symptoms to identify the cyber threat and fall outside of the first node's normal pattern of life, 3) an autonomous response engine monitoring and sending signals to a potentially compromised node to restrict communications of the potentially compromised node to merely normal recipients and types of communications according to the Artificial Intelligence model trained to model the normal pattern of life for each node in the system being protected, and 4) an autonomous response engine trained on how to isolate a compromised node as well as to take mitigation actions with other nodes that have a direct nexus to the compromised node, where the autonomous response engine is one of the other Artificial Intelligence-based engines.

6. An apparatus, comprising:
a cyber security restoration engine configured with software code and electronic hardware to take one or more autonomous remediation actions to remediate one or more nodes in a graph of a system being protected back to a trusted operational state in order to assist in a recovery from the cyber threat, where the cyber security restoration engine has a tracking component the operational state of each node in the graph of the protected system, where a communication module is configured to cooperate with the cyber security restoration engine to communicate with at least one of an external backup system and a recovery service to invoke backup remediation actions and/or recovery remediation actions to remediate one or more nodes potentially compromised by the cyber threat back to the trusted operational state, where any software implemented by the cyber security restoration engine is stored in an executable state in one or more non-transitory computer readable mediums to be executed by one or more processors.

7. The apparatus of claim 6 , where the cyber security restoration engine is configured to have bi-directional communications with the other Artificial Intelligence-based engines as well as with agents and sensors within the protected system under analysis.

8. The apparatus of claim 6 , where the cyber security restoration engine is further configured to use one or more unsupervised machine learning algorithms, as a self-learning entity, to have an ability to learn how to restore the one or more nodes in the graph of the protected system back to the trusted operational state while still mitigating against the cyber threat so the cyber security restoration engine gets better over time of a deployment of the cyber security restoration engine by learning from previous restoration attempts.

9. The apparatus of claim 6 , where the cyber security restoration engine is configured to reference at least one of i) a database of restoration response scenarios stored in the database and ii) a prediction engine configured to run Artificial Intelligence-based simulations and use the operational state of each node in the graph of the protected system during simulations of cyberattacks on the protected system to restore each node compromised by the cyber threat.

10. The apparatus of claim 6 , where the cyber security restoration engine is configured to prioritize among the one or more nodes to restore, which nodes to remediate and an order of the nodes to remediate, based on two or more factors including i) a dependency order needed for a recovery efforts, ii) an importance of a particular recovered node compared to other nodes in the system being protected, iii) a level of compromise of a particular node contemplated to be restored, iv) an urgency to recover that particular node compared to whether containment of the cyber threat was successful, v) a list of a most important things in the system being protected to recover earliest, and vi) factoring in a result of a cyberattack simulation being run during the cyberattack by

Assignees

• Darktrace Holdings Ltd

Inventors

• Fellows Simon David Lincoln
• Stockdale Jack
• Dunn Matthew

Classifications

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L41/16

  using machine learning or artificial intelligence · CPC title