Cyberanalysis workflow acceleration

Abstract

A cyber threat intelligence (CTI) gateway device may receive rules for filtering TCP / IP packet communications events that are configured to cause the CTI gateway device to identify communications corresponding to indicators, signatures, and behavioral patterns of network threats. The CTI gateway device may receive packets that compose endpoint-to-endpoint communication events and, for each event,may determine that the event corresponds to criteria specified by a filtering rule. The criteria may correspond to one or more of the network threat indicators, signatures, and behavioral patterns. The CTI gateway may create a log of the threat event and forward the threat event log to a task queue managed by a cyberanalysis workflow application. Human cyberanalysts use the cyberanalysis workflowapplication to service the task queue by removing the task at the front of the queue, investigating the threat event, and deciding whether the event is a reportable finding that should be reported tothe proper authorities. In order to improve the efficiency of the workflow process, tasks in the queue are ordered by the likelihood, or probability, that cyberanalysts will determine the associated threat events to be reportable findings; thus, high-likelihood events are investigated first. Likelihoods are computed using human-designed algorithms and machine-learned algorithms that are applied tocharacteristics of the events. Low-likelihood events may be dropped from the work queue to further improve efficiency.

Description

Background technique [0001] With the continuous development of the information age, network security is becoming more and more important. Cyber ​​threats can take many forms (e.g., unauthorized requests or data transmissions, viruses, malware, massive web traffic designed to overwhelm network resources, etc.). Many organizations subscribe to cyber threat services, which regularly provide information associated with cyber threats, including, for example, cyber threat indicators (e.g., network addresses, Uniform Resource Identifiers (URIs), etc.), or threat signatures (e.g., malicious software file identifiers), or threat behaviors (eg, signature patterns of advanced persistent threats). The information provided by such services can be used by organizations to identify threats to their networks and related assets. For example, a network device may monitor network communications and utilize network addresses corresponding to threat indicators to identify any communications betw...

AI Technical Summary

Problems solved by technology

However, in many modern enterprise networks, the volume and velocity of cyber threat event logs often overwhelm human network analysts in investigating all events

Images