Cyber threat detection based on threat context, threat changes, and/or impact status

Patent metadata

Field	Value
Publication number	US-12413555-B2
Application number	US-202418932967-A
Country	US
Kind code	B2
Filing date	Oct 31, 2024
Priority date	Jun 12, 2023
Publication date	Sep 9, 2025
Grant date	Sep 9, 2025

Abstract

Aspects described herein may relate to cyber threat detection based on threat context and/or threat changes. Cyber threat intelligence (CTI) data may be received from a CTI provider. Endpoint data that indicates evidence that endpoints are cyber threats may be determined based on the CTI data. The endpoint data may be analyzed and/or compared to stored data associated with the endpoint. The analysis and/or comparison may be performed to determine whether evidence that the endpoint is a cyber threat has changed. Based on any changes, dispositions for the endpoint may be determined and sent. The dispositions may change how devices filter network traffic associated with the endpoint. Alternatives to default dispositions may be determined based on a impact of blocking potentially legitimate network traffic to and/or from the endpoints. Machine-learning models may assist in processing and analyzing CTI data, performing threat monitoring, and/or determining feeds that include the dispositions.

First claim

What is claimed is:

1. A method comprising:
receiving, from a provider of a plurality of providers and for a computer network configured to protect against cyber threats, cyber threat intelligence (CTI) data that includes a first indication of compromise (IOC that indicates an endpoint external to the computer network is a potential cyber threat;
determining, based on the CTI data, first endpoint data that indicates the first IOC for the endpoint;
based on an analysis of the first endpoint data and stored event data associated with the endpoint, determining that a threat status for the endpoint has changed, between receipt of the CTI data and receipt of the stored event data, from a prior threat status for the endpoint, wherein the stored event data indicates the endpoint is a potential cyber threat and indicates one or more second IOCs, received from the plurality of providers, used to determine the prior threat status for the endpoint;
based on determining that the threat status for the endpoint has changed from the prior threat status, determining threat differential data for the endpoint that indicates the threat status for the endpoint has changed and that indicates one or more attributes that changed for the endpoint between the stored event data and the first endpoint data;
determining, based on the threat differential data, a disposition for the endpoint; and
sending, by a first computing device and to a second computing device, the disposition to cause the second computing device to filter network traffic for the computer network based on the disposition.

2. The method of claim 1 , wherein determining the disposition for the endpoint is based on how many of the plurality of providers have indicated an IOC for the endpoint.

3. The method of claim 1 , wherein determining the disposition for the endpoint is based on which of the plurality of providers have indicated an IOC for the endpoint.

4. The method of claim 1 , wherein determining the disposition for the endpoint is based on indications that one or more of the plurality of providers have repeatedly indicated the same IOC for the endpoint.

5. The method of claim 1 , wherein determining the disposition for the endpoint is based on how many of the plurality of providers have indicated the same IOC for the endpoint.

6. The method of claim 1 , wherein determining the disposition for the endpoint is based on one or more of a first confidence value associated with first IOC, a second confidence value associated with the one or more attributes, a third confidence value associated with the first provider.

7. The method of claim 1 , wherein the first endpoint data is in a second format, and wherein the method further comprises:
training a plurality of machine-learning models for the plurality of providers, wherein after training the plurality of machine-learning models, each of the plurality of machine-learning models is configured to receive input in a format that a provider sends CTI data and to provide output in the second format; and
wherein determining the first endpoint data is performed based on using a first machine-learning model of the plurality of machine-learning models and providing the CTI data as input to the first machine-learning model.

8. The method of claim 1 , further comprising:
training a machine-learning model, wherein after training the machine-learning model, the machine-learning model is configured to output indications as to whether endpoints have changed based on input data associated with the endpoints; and
wherein determining that the change for the endpoint has occurred is performed based on using the machine-learning model and providing the first endpoint data and the stored event data as input to the machine-learning model.

9. One or more non-transitory computer-readable media storing computer-executable instructions that, when executed, cause one or more computing devices to:
receive, from a provider of a plurality of providers and for a computer network configured to protect against cyber threats, cyber threat intelligence (CTI) data that includes a first indication of compromise (IOC) for an endpoint external to the computer network is a potential cyber threat;
determine, based on the CTI data, first endpoint data that indicates the first IOC for the endpoint;
based on an analysis of the first endpoint data and stored event data associated with the endpoint, determine that a threat status for the endpoint has changed, between receipt of the CTI data and receipt of the stored event data, from a prior threat status for the endpoint, wherein the stored event data indicates the endpoint is a potential cyber threat and indicates one or more second IOCs, received from the plurality of providers, used to determine the prior threat status for the endpoint;
based on determining that the threat status for the endpoint has changed from the prior threat status, determine threat differential data for the endpoint that indicates the threat status for the endpoint has changed and that indicates one or more attributes that changed for the endpoint between the stored event data and the first endpoint data;
determine, based on the threat differential data, a disposition for the endpoint; and
send, to a device, the disposition to cause the device to filter network traffic for the computer network based on the disposition.

10. The non-transitory computer-readable media of claim 9 , wherein the computer-executable instructions, when executed, cause the one or more computing devices to determine the disposition for the endpoint based on how many of the plurality of providers have indicated an IOC for the endpoint.

11. The non-transitory computer-readable media of claim 9 , wherein the computer-executable instructions, when executed, cause the one or more computing devices to determine the disposition for the endpoint based on which of the plurality of providers have indicated an IOC for the endpoint.

12. The non-transitory computer-readable media of claim 9 , wherein the computer-executable instructions, when executed, cause the one or more computing devices to determine the disposition for the endpoint based on indications that one or more of the plurality of providers have repeatedly indicated the same IOC for the endpoint.

13. The non-transitory computer-readable media of claim 9 , wherein the computer-executable instructions, when executed, cause the one or more computing devices to determine the disposition for the endpoint based on how many of the plurality of providers have indicated the same IOC for the endpoint.

14. The non-transitory computer-readable media of claim 9 , wherein the first endpoint data is in a second format, and wherein the computer-executable instructions, when executed, cause the one or more computing devices to:
train a plurality of machine-learning models for the plurality of providers, wherein after training the plurality of machine-learning models, each of the plurality of machine-learning models is configured to receive input in a format that a provider sends CTI data and to provide output in the second format; and
wherein the computer-executable instructions, when executed, cause the one or more computing devices to determine the first endpoint data based on using a first machine-learning model of the plurality of machine-learning models and providing the CTI data as input to the first machine-learning model.

15. The non-transitory computer-readable media of claim 9 , wherein the computer-executable instructions, when executed, cause the one or more computing devices to:
train a machine-learning model, wher

Assignees

• Centripetal Networks Llc

Inventors

• Ahn David K
• Parnell Jess P
• Wendell Tyler J
• Kodituwakku Hansaka A
• Holmberg Jared
• Rogers Daniel
• Baker Cody Michael
• Mallett Iii Pierre

Classifications

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• G06N20/00

  Machine learning · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/0263 Primary

  Rule management · CPC title