Similarity analysis for automated disposition of security alerts
US11663329B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Mar 9, 2021 |
| Grant date | May 30, 2023 |
| Priority date | — |
| Expiry date | May 20, 2041 |
Classification
- Technology area (CPC G)Physics
- CPC primaryG06F2221/2101
- WIPO fieldComputer technology
- WIPO sectorElectrical engineering
Abstract
A method, a computer program product, and a system for performing a of threat similarity analysis for automated action on security alerts. The method includes receiving, by a threat similarity analysis system, a security alert relating to a security from a threat disposition system within an environment, performing, by the threat similarity analysis system, a similarity analysis on the security alert using a machine learning model. The similarity analysis compares the security alert with previous security alerts within a time window. The threat similarity analysis system can apply a cosine similarity analysis to perform the similarity analysis. The method also includes determining, based on the similarity analysis, the security alert matches at least one previous security alert from the previous security alerts within a predetermined degree, and associating the security alert into a same security incident as the previous security alert determined by similarity analysis.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.