The patent badge is an abbreviated version of the USPTO patent document. The patent badge does contain a link to the full patent document.
The patent badge is an abbreviated version of the USPTO patent document. The patent badge covers the following: Patent number, Date patent was issued, Date patent was filed, Title of the patent, Applicant, Inventor, Assignee, Attorney firm, Primary examiner, Assistant examiner, CPCs, and Abstract. The patent badge does contain a link to the full patent document (in Adobe Acrobat format, aka pdf). To download or print any patent click here.
Patent No.:
Date of Patent:
Jan. 21, 2020
Filed:
Aug. 15, 2016
International Business Machines Corporation, Armonk, NY (US);
William Alexander Bird, Fredericton, CA;
Suzanne Carol Deffeyes, Weaverville, NC (US);
Jiyong Jang, White Plains, NY (US);
Dhilung Kirat, White Plains, NY (US);
Youngja Park, Princeton, NJ (US);
Josyula R. Rao, Briarcliff Manor, NY (US);
Marc Philippe Stoecklin, White Plains, NY (US);
International Business Machines Corporation, Armonk, NY (US);
Abstract
An automated method for processing security events in association with a cybersecurity knowledge graph. The method begins upon receipt of information from a security system representing an offense. An initial offense context graph is built based in part on context data about the offense. The graph also activity nodes connected to a root node; at least one activity node includes an observable. The root node and its one or more activity nodes represent a context for the offense. The knowledge graph, and potentially other data sources, are then explored to further refine the initial graph to generate a refined graph that is then provided to an analyst for further review and analysis. Knowledge graph exploration involves locating the observables and their connections in the knowledge graph, determining that they are associated with known malicious entities, and then building subgraphs that are then merged into the initial graph.