Nec Corporation

Stellar Cyber, Inc.

Shuchu Han

Haifeng Chen

Jiaping Gui

Zhichun Li

Qi Wang

Wei Cheng

LuAn Tang

Dongjin Song

Yuncong Chen

Alexandru Niculescu-Mizil

The disclosure provides a system, a method and a computer program product for generating an automated incident. The system is configured to retrieve an alert of a plurality of alerts received from a plurality of heterogeneous sources. The alert is associated with a security breach. The system further generates a normalized alert based on normalization of the retrieved alert. The normalization is associated with a semantic similarity parameter. Further, the system generates an enriched alert based on enrichment of the generated normalized alert. The enrichment is based on security related data of the security breach associated with the generated normalized alert. The system further identifies a set of correlation features associated with the generated enriched alert. Furthermore, the system generates the automated incident associated with the alert based on at least the generated enriched alert and the identified set of correlation features associated with the enriched alert.

System and method for automated incident generation

The disclosure provides a system, a method and a computer program product for dynamic scoring of a plurality of incidents. The system is configured to retrieve an incident of the plurality of incidents. The incident comprises at least one alert and is associated with a security breach. The system further generates an enriched alert based on enrichment of the at least one alert. The enrichment is based on security related data of the security breach. The system further identifies one or more entities and one or more observables associated with the generated enriched alert. The system determines a score for the retrieved incident based on at least the generated enriched alert and the generated behavioural entity model. The system is further configured to dynamically update the determined score for the retrieved incident based on an analysis of at least the retrieved incident and the generated behavioural entity model.

System and method for dynamic scoring of incidents

Methods and systems for detecting and correcting anomalies include detecting an anomaly in a cyber-physical system, based on a classification of time series information from sensors that monitor the cyber-physical system as being anomalous. A similarity graph is determined for each of the sensors, based on the time series information. A subset of the sensors that are related to the classification is selected, based on a spectral embedding of the similarity graphs. A corrective action is performed responsive to the detected anomaly, prioritized according to the selected subset.

Sensor contribution ranking

Methods and systems for optimizing performance of a cyber-physical system include training a machine learning model, according to sensor data from the cyber-physical system, to generate one or more parameters for controllable sensors in the cyber-physical system that optimize a performance indicator. New sensor data is collected from the cyber-physical system. One or more parameters for the controllable sensors are generated using the trained machine learning module and the new sensor data. The one or more parameters are applied to the controllable sensors to optimize the performance of the cyber-physical system.

Optimization of cyber-physical systems

Methods and systems for detecting and correcting anomalies include ranking sensors in a cyber-physical system according to a degree of influence each sensor has on a measured performance indicator in the cyber-physical system. An anomaly is detected in the cyber-physical system based on the measured performance indicator. A corrective action is performed responsive to the detected anomaly, prioritized according to sensor rank.

Growing community of inventors

Princeton Junction, NJ, United States of America

Shuchu Han