Gathering indicators of compromise for security threat detection
US10469509B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Dec 29, 2016 |
| Grant date | Nov 5, 2019 |
| Priority date | — |
| Expiry date | Sep 27, 2037 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04L63/20
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
The subject matter of this specification generally relates to computer security. In some implementations, a method includes receiving indicators of compromise from multiple security data providers. Each indicator of compromise can include data specifying one or more characteristics of one or more computer security threats. Each indicator of compromise can be configured to, when processed by a computer, cause the computer to detect the presence of the specified one or more characteristics of the one or more computer security threats. Telemetry data for computing systems of users can be received. The telemetry data can include data describing at least one event detected at the computing system. A determination is made that the telemetry data for a given user includes the one or more characteristics specified by a given indicator of compromise.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.