Security threat information analysis

Patent metadata

Field	Value
Publication number	US-9762617-B2
Application number	US-201615155328-A
Country	US
Kind code	B2
Filing date	May 16, 2016
Priority date	Aug 29, 2014
Publication date	Sep 12, 2017
Grant date	Sep 12, 2017

Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for analyzing data that includes security threat information. One of the methods includes identifying intelligence types that each categorizes a subset of data, associating, for each of the intelligence types, each of the subsets of data, which are categorized by the respective intelligence type, with the respective intelligence type, determining rules for a third party that each indicate that the third party should receive data associated with particular types of potential security threats and priority information for the data, determining, for each of the potential security threats indicated in the rules, a group of the subsets that include information associated with the respective potential security threat, assigning, for each subset in each of the groups, a priority to the respective subset using the priority information, and providing the determined subsets to the third party using the respective priorities.

First claim

What is claimed is:

1. A computer-implemented method comprising:
determining, by one or more computers in an analysis system, one or more intelligence types;
categorizing, by at least one of the computers for each dataset from multiple datasets that each include information about potential security threats, each subset of data for the respective dataset, the categorizing comprising:
identifying, by at least one of the computers for each of the subsets of data in the respective dataset, an intelligence type that each that categorizes the subset of data; and
associating, by at least one of the computers for each of the subsets of data in the respective dataset, the subset of data with the corresponding intelligence type;

determining, by at least one of the computers for each of the categorized subsets using the respective intelligence types for the categorized subsets, whether the respective subset does not comprise information about the same threat as a different subset;
determining, by at least one of the computers, that a first subset from the categorized subsets does not comprise information about the same threat as a second different subset using a first intelligence type for the first subset and a second intelligence type for the second different subset and in response to determining whether the respective subset does not comprise information about the same threat as a different subset;
determining, by at least one of the computers, that a third subset from the categorized subsets comprises information about the same threat as a fourth different subset using a third intelligence type for the third subset and the fourth different subset and in response to determining whether the respective subset does not comprise information about the same threat as a different subset;
determining, by at least one of the computers for each third party system from multiple third party systems, a group of the subsets that include particular data a third party system should receive from the analysis system, wherein each third party system in the multiple third party systems includes an intrusion detection system or an intrusion prevention system and the determining includes:
determining, for a first third party system, a first group includes the first subset; and
determining, for a second third party system, a second group that includes the third subset and does not include the fourth subset;

assigning, by at least one of the computers for each subset in each of the groups, a priority to the respective subset; and
generating, by at least one of the computers for each third party system in the multiple third party system using the group of subsets that include the particular data the third party system should receive, data that includes instructions to cause the third party system to automatically adjust rules for the included intrusion detection system or the included intrusion prevention system, wherein the generating includes:
generating, for the first third party system, data that includes instructions for the first third party system using the subsets in the first group, including the first subset; and
generating, for the second third party system, data that includes instructions for the second third party system using the subsets in the second group, including the third subset; and

sending, by at least one of the computers to each third party system in the multiple third party systems, the data that includes the instructions to cause the third party system to automatically adjust rules for the included intrusion detection system or the included intrusion preventing system, wherein the sending includes:
sending, to the first third party system, the data that includes instructions for the first third party system using the respective priorities; and
sending, to the second third party system, the data that includes instructions for the second third party system using the respective priorities.

2. The method of claim 1 comprising sending, by at least one of the computers and to at least one of the third party systems from the multiple third party systems, the subsets in the respective group of the subsets for presentation according to the respective priorities.

3. The method of claim 1 comprising:
receiving, by at least one of the computers, the datasets from one or more sources; and
parsing, by at least one of the computers, each of the datasets into the subsets of data, wherein identifying the respective intelligence types that each categorize a subset of data in the respective dataset comprises identifying the respective intelligence types that each categorize one of the parsed subsets.

4. The method of claim 1 comprising determining that the fourth subset comprises information with an older timestamp than the third subset, wherein determining, for the second third party system, the second group that includes the third subset and does not include the fourth subset is responsive to determining that the fourth subset comprises information with the older timestamp than the third subset.

5. The method of claim 1 comprising determining that the fourth subset comprises information from a less reputable source than the third subset, wherein determining, for the second third party system, the second group that includes the third subset and does not include the fourth subset is responsive to determining that the fourth subset comprises information from a less reputable source than the third subset.

6. The method of claim 5 comprising determining that content in the fourth subset varies from content in the third subset by more than a threshold amount, wherein determining that the fourth subset comprises information from the less reputable source than the third subset is responsive to determining that content in the fourth subset varies from content in the third subset by more than the threshold amount.

7. The method of claim 1 comprising:
determining that a fifth subset from the categorized subsets comprises information about the same threat as a sixth different subset using a fourth intelligence type for the fifth subset and a fifth intelligence type for the sixth different subset and in response to determining whether the respective subset does not comprise information about the same threat as a different subset; and
merging the fifth subset with the sixth subset to create a merged subset in response to determining that the fifth subset from the categorized subsets comprises information about the same threat as the sixth different subset, wherein:
determining the group of the subsets that include particular data the third party system should receive from the analysis system, comprises determining, for another third party system, a third group that includes the merged subset, wherein the method comprises:
sending, to the other third party system, the subsets in the third group, including the merged subset, using the respective priorities.

8. The method of claim 7 comprising determining that the fifth subset varies from the sixth subset by less than a threshold amount, wherein merging the fifth subset with the sixth subset is responsive to determining that the fifth subset varies from the sixth subset by less than the threshold amount.

9. The method of claim 1 comprising:
determining that a fifth subset from the subsets comprises information about the same threat as a sixth subset using a fourth intelligence type for the fifth subset and a fifth intelligence type for the sixth subset and in response to determining whether the respective subset does not comprise information about the same threat as a different subset;
determining that the fifth subset varies from the sixth subset by more than a threshold amount; and
linking th

Assignees

• Accenture Global Services Ltd

Inventors

• Modi Shimon
• Schall Stephen A

Classifications

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/14

  for detecting or protecting against malicious traffic · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L41/16

  using machine learning or artificial intelligence · CPC title