Systems and methods for predicting security threats

Patent metadata

Field	Value
Publication number	US-9998480-B1
Application number	US-201615055653-A
Country	US
Kind code	B1
Filing date	Feb 29, 2016
Priority date	Feb 29, 2016
Publication date	Jun 12, 2018
Grant date	Jun 12, 2018

Abstract

A computer-implemented method for predicting security threats may include (1) predicting that a candidate security target is an actual target of a specific security attack according to a non-collaborative-filtering calculation, (2) predicting that the candidate security target is an actual target of a set of multiple specific security attacks, including the specific security attack, according to a collaborative filtering calculation, (3) filtering, based on the specific security attack also being predicted by the non-collaborative-filtering calculation, the specific security attack from the set of multiple specific security attacks predicted by the collaborative filtering calculation, and (4) notifying the candidate security target to perform a security action to protect itself from another specific security attack remaining in the filtered set of multiple specific security attacks based on an analysis of the filtered set of multiple specific security attacks. Various other methods, systems, and computer-readable media are also disclosed.

First claim

What is claimed is:

1. A computer-implemented method for predicting security threats, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
predicting that a candidate security target is an actual target of a specific security attack according to a non-collaborative-filtering calculation;
predicting that the candidate security target is an actual target of a set of multiple specific security attacks, including the specific security attack, according to a collaborative filtering calculation that makes predictions that are more customized to the candidate security target than predictions that the non-collaborative-filtering calculation makes;
filtering, based on the specific security attack also being predicted by the non-collaborative-filtering calculation, the specific security attack from the set of multiple specific security attacks predicted by the collaborative filtering calculation at least in part by:
identifying overlapping specific security attacks that overlap between both a set of specific security attacks predicted according to the non-collaborative-filtering calculation and the set of multiple specific security attacks predicted according to the collaborative filtering calculation; and
filtering each of the overlapping specific security attacks from the set of multiple specific security attacks predicted by the collaborative filtering calculation; and

notifying, by transmitting a notification, the candidate security target to perform a security action to protect itself from another specific security attack remaining in the filtered set of multiple specific security attacks based on an analysis of the filtered set of multiple specific security attacks.

2. The method of claim 1 , wherein predicting that the candidate security target is the actual target of the specific security attack according to the non-collaborative-filtering calculation is based on both:
a count for the candidate security target, among candidate security targets under analysis, in terms of previous attacks on the candidate security target; and
a count for the specific security attack, among security attacks under analysis, in terms of previous instances of the specific security attack.

3. The method of claim 2 , wherein predicting that the candidate security target is the actual target of the specific security attack according to the non-collaborative-filtering calculation comprises calculating a product of the count for the candidate security target and the count for the specific security attack.

4. The method of claim 1 , wherein the analysis of the filtered set of multiple specific security attacks comprises:
identifying attributes of the candidate security target; and
calculating, according to a machine learning algorithm, a level of predictive power for each of the attributes in predicting specific security attacks remaining in the filtered set of multiple specific security attacks.

5. The method of claim 4 , wherein the attributes comprise at least one of:
an identifier of a customer sector; and
an identifier of software installed by a customer.

6. The method of claim 4 , wherein the machine learning algorithm comprises a naive Bayes algorithm.

7. The method of claim 1 , wherein the analysis of the filtered set of multiple specific security attacks comprises categorizing specific security attacks in the set of multiple specific security attacks into categories that each indicates a type of security attack.

8. The method of claim 1 , wherein the analysis of the filtered set of multiple specific security attacks comprises:
identifying attributes of at least one of the multiple specific security attacks; and
calculating, according to a machine learning algorithm, a level of predictive power for each of the attributes in predicting specific security attacks remaining in the filtered set of multiple specific security attacks.

9. The method of claim 1 , wherein at least one of the non-collaborative-filtering calculation and the collaborative filtering calculation comprises constructing a matrix that specifies:
candidate security targets along one of rows and columns of the matrix; and
specific security attacks along the other of the rows and the columns of the matrix.

10. A system for predicting security threats, the system comprising:
a prediction module, stored in memory, that:
predicts that a candidate security target is an actual target of a specific security attack according to a non-collaborative-filtering calculation;
predicts that the candidate security target is an actual target of a set of multiple specific security attacks, including the specific security attack, according to a collaborative filtering calculation that makes predictions that are more customized to the candidate security target than predictions that the non-collaborative-filtering calculation makes;

a filtering module, stored in memory, that filters, based on the specific security attack also being predicted by the non-collaborative-filtering calculation, the specific security attack from the set of multiple specific security attacks predicted by the collaborative filtering calculation at least in part by:
identifying overlapping specific security attacks that overlap between both a set of specific security attacks predicted according to the non-collaborative-filtering calculation and the set of multiple specific security attacks predicted according to the collaborative filtering calculation; and
filtering each of the overlapping specific security attacks from the set of multiple specific security attacks predicted by the collaborative filtering calculation;

a notification module, stored in memory, that notifies, by transmitting a notification, the candidate security target to perform a security action to protect itself from another specific security attack remaining in the filtered set of multiple specific security attacks based on an analysis of the filtered set of multiple specific security attacks; and
at least one physical processor configured to execute the prediction module, the filtering module, and the notification module.

11. The system of claim 10 , wherein the non-collaborative-filtering calculation is based on both:
a count for the candidate security target, among candidate security targets under analysis, in terms of previous attacks on the candidate security target; and
a count for the specific security attack, among security attacks under analysis, in terms of previous instances of the specific security attack.

12. The system of claim 11 , wherein the prediction module predicts that the candidate security target is the actual target of the specific security attack according to the non-collaborative-filtering calculation by calculating a product of the count for the candidate security target and the count for the specific security attack.

13. The system of claim 10 , wherein the notification module is programmed to perform the analysis of the filtered set of multiple specific security attacks by:
identifying attributes of the candidate security target; and
calculating, according to a machine learning algorithm, a level of predictive power for each of the attributes in predicting specific security attacks remaining in the filtered set of multiple specific security attacks.

14. The system of claim 13 , wherein the attributes comprise at least one of:
an identifier of a customer sector; and
an identifier of software installed by a customer.

15. The system of claim 13 , wherein the machine learning algorithm comprises a naive Bayes alg

Assignees

• Symantec Corp

Inventors

• Gates Christopher
• Wang Yining
• Vasiloglou Nikolaos
• Roundy Kevin Alejandro
• Hart Michael

Classifications

• G06N7/01

  Probabilistic graphical models, e.g. probabilistic networks · CPC title

• G06N99/005

  Physics · mapped topic

• H04L63/1408 Primary

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• G06N7/005

  Physics · mapped topic

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title