Event correlation across heterogeneous operations
US9742788B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Aug 31, 2015 |
| Grant date | Aug 22, 2017 |
| Priority date | — |
| Expiry date | Aug 31, 2035 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04L63/1433
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for correlating domain activity data. First domain activity data from a first network domain and second domain activity data from a second network domain is received. The first domain activity data and the second domain activity data is filtered to remove irrelevant activity data, based on a first set of profile data for devices in the first network domain and a second set of profile data for devices in the second network domain. Unfiltered first and second domain activity data is aggregated. Aggregated unfiltered first and second domain activity data is correlated to determine an attack path for an attack that occurs across the first network domain and the second network domain, based on attack signatures and profiles associated with previously identified attacks. A visualization of the attack path is generated.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.