Systems and methods for predicting the likelihood of cyber-threats leveraging intelligence associated with hacker communities

Patent metadata

Field	Value
Publication number	US-2020036743-A1
Application number	US-201916522001-A
Country	US
Kind code	A1
Filing date	Jul 25, 2019
Priority date	Jul 25, 2018
Publication date	Jan 30, 2020
Grant date	—

Abstract

Various embodiments of a system and methods for reasoning about enterprise-related external cyber threats using a rule-leaning approach are disclosed.

First claim

What is claimed is:

1 . A method of predicting cyber threats, comprising:
providing a processor in communication with a tangible storage medium storing instructions that are executed by the processor to perform operations comprising:
accessing a first dataset defining communications from forums and marketplaces associated with a hacker community;
learning a plurality of rules using a plurality of indicators generated from the first dataset and ground truth information associated with known cyberattacks, the plurality of indicators including mappings between a vulnerability and a platform known to be susceptible to the vulnerability; and
predicting a cyber threat, including:
identifying an indicator of the plurality of indicators from a second dataset, the second dataset defining additional communications from the hacker community and the indicator being a precondition to a corresponding rule of the plurality of rules, and
applying information associated with the indicator to the corresponding rule of the plurality of rules to output at least one prediction of an attack associated with the cyber threat.

2 . The method of claim 1 , further comprising generating the plurality of rules by deriving a set of probability boundaries of future actions using an annotated probabilistic temporal logic rules framework and narrowing the set of probability boundaries.

3 . The method of claim 2 , wherein one of the plurality of rules defines a probability value for the attack associated with the cyber threat occurring within a predetermined time interval of a condition being true.

4 . The method of claim 3 , wherein a point frequency function of the annotated probabilistic temporal logic rules framework is applied to output a frequency value for the attack following identification of the indicator from the second dataset in an exact time interval and defines a predetermined precise temporal relationship between the attack and the indicator.

5 . The method of claim 2 , wherein an existential frequency function of the annotated probabilistic temporal logic rules framework is applied to output a frequency value for the attack following identification of the indicator within a predetermined number of time points and defines a specified temporal relationship between the attack and the indicator.

6 . The method of claim 4 , wherein the frequency value for the attack following the indicator in an exact time interval is calculated using a probability interval.

7 . The method of claim 5 , wherein the frequency value for the attack following the indicator within a predetermined number of time points is calculated using a probability interval.

8 . The method of claim 1 , wherein a plurality of rule-learning approaches are applied to learn a set of temporal correlations between the first dataset and the known cyberattacks.

9 . The method of claim 1 , wherein a plurality of indicator extractors are applied to extract indicators from the first dataset and assigns a confidence score to extraction of the indicator.

Assignees

• Almukaynizi Mohammed
• Marin Ericsson
• Shakarian Paulo
• Simari Gerardo
• Nunes Eric
• Univ Arizona State

Inventors

• Almukaynizi Mohammed
• Marin Ericsson
• Shakarian Paulo
• Simari Gerardo
• Nunes Eric

Classifications

• G06N5/025 Primary

  Extracting rules from data · CPC title

• G06N5/048

  Fuzzy inferencing · CPC title

• G06N3/044

  Recurrent networks, e.g. Hopfield networks · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L63/302

  gathering intelligence information for situation awareness or reconnaissance · CPC title