Threat mitigation system and method

Patent metadata

Field	Value
Publication number	US-12568110-B2
Application number	US-202418584994-A
Country	US
Kind code	B2
Filing date	Feb 22, 2024
Priority date	Feb 23, 2023
Publication date	Mar 3, 2026
Grant date	Mar 3, 2026

Abstract

A computer-implemented method, computer program product and computing system for deploying an agent to proactively monitor activity within a computing platform and generate an initial notification if a security event is detected; receiving the initial notification of the security event from the agent, wherein the initial notification includes a computer-readable language portion that defines one or more specifics of the security event; and iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification.

First claim

What is claimed is:

1 . A computer-implemented method executed on a computing device comprising:
deploying an agent to proactively monitor activity within a computing platform and generate an initial notification if a security event is detected, including training the agent based upon, at least in part, supplemental information obtained from technical bulletins released by one or more of software houses, antivirus providers, and hardware manufacturers; receiving the initial notification of the security event from the agent, wherein the initial notification includes a computer-readable language portion that defines one or more specifics of the security event; iteratively processing the initial notification using a generative AI model and a formatting script and one or more tools to produce a summarized human-readable report for the initial notification, wherein the one or more tools include an identification tool to identify an owner of a domain associated with the initial notification; prompting a user to provide feedback concerning the summarized human-readable report; and utilizing the feedback to revise the formatting script.

2 . The computer-implemented method of claim 1 wherein the computing platform includes a plurality of security-relevant subsystems.

3 . The computer-implemented method of claim 1 wherein deploying an agent to proactively monitor activity within a computing platform and generate an initial notification if a security event is detected includes;
deploying the agent to proactively monitor activity within one or more of the security-relevant subsystems of the computing platform and generate the initial notification if the security event is detected.

4 . The computer-implemented method of claim 1 wherein the one or more tools further includes one or more of:
a decompression tool to decompress a compressed initial notification; and
a decoding tool to decode an encoded initial notification.

5 . The computer-implemented method of claim 1 wherein iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification includes:
iteratively processing the initial notification using a large language model.

6 . The computer-implemented method of claim 1 wherein iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification includes:
utilizing prompt engineering to produce the summarized human-readable report for the initial notification.

7 . The computer-implemented method of claim 1 wherein iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification includes:
utilizing several loops and/or nested loops to produce the summarized human-readable report for the initial notification.

8 . The computer-implemented method of claim 1 wherein the summarized human-readable report defines recommended next steps and/or disclaimers.

9 . The computer-implemented method of claim 1 further comprising:
training the agent to proactively monitor activity within a computing platform and generate an initial notification if a security event is detected based, at least in part, upon best practices defined via artificial intelligence.

10 . A computer program product residing on a non-transitory computer readable storage medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
deploying an agent to proactively monitor activity within a computing platform and generate an initial notification if a security event is detected, including training the agent based upon, at least in part, supplemental information obtained from technical bulletins released by one or more of software houses, antivirus providers, and hardware manufacturers; receiving the initial notification of the security event from the agent, wherein the initial notification includes a computer-readable language portion that defines one or more specifics of the security event; iteratively processing the initial notification using a generative AI model and a formatting script and one or more tools to produce a summarized human-readable report for the initial notification, wherein the one or more tools include an identification tool to identify an owner of a domain associated with the initial notification; prompting a user to provide feedback concerning the summarized human-readable report; and utilizing the feedback to revise the formatting script.

11 . The computer program product of claim 10 wherein the computing platform includes a plurality of security-relevant subsystems.

12 . The computer program product of claim 10 wherein deploying an agent to proactively monitor activity within a computing platform and generate an initial notification if a security event is detected includes;
deploying the agent to proactively monitor activity within one or more of the security-relevant subsystems of the computing platform and generate the initial notification if the security event is detected.

13 . The computer program product of claim 10 wherein the one or more tools further includes one or more of:
a decompression tool to decompress a compressed initial notification; and
a decoding tool to decode an encoded initial notification.

14 . The computer program product of claim 10 wherein iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification includes:
iteratively processing the initial notification using a large language model.

15 . The computer program product of claim 10 wherein iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification includes:
utilizing prompt engineering to produce the summarized human-readable report for the initial notification.

16 . The computer program product of claim 10 wherein iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification includes:
utilizing several loops and/or nested loops to produce the summarized human-readable report for the initial notification.

17 . The computer program product of claim 10 wherein the summarized human-readable report defines recommended next steps and/or disclaimers.

18 . The computer program product of claim 10 further comprising:
training the agent to proactively monitor activity within a computing platform and generate an initial notification if a security event is detected based, at least in part, upon best practices defined via artificial intelligence.

19 . A computing system including a processor and memory configured to perform operations comprising:
deploying an agent to proactively monitor activity within a computing platform and generate an initial notification if a security event is detected, including training the agent based upon, at least in part, supplemental information obtained from technical bulletins released by one or more of software houses, antivirus providers, and hardware manufacturers; receiving the initial notification of the security event from the agent, wherein th

Assignees

• Reliaquest Holdings Llc

Inventors

• Murphy Brian P
• Partlow Joe
• O'Connor Colin
• Pfeiffer Jason
• Murphy Brian Philip
• Echavarria Jonathan R

Classifications

• H04L41/16

  using machine learning or artificial intelligence · CPC title

• G06F40/56

  Natural language generation · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06N3/0475 Primary

  Generative networks · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title