US 11,750,626 B2
Systems and techniques for guiding a response to a cybersecurity incident
Christopher Lord, Natick, MA (US); Benjamin Johnson, Newport Beach, CA (US); Doran Smestad, Corinna, ME (US); and Joshua Hartley, Rutland, MA (US)
Assigned to Carbon Black, Inc., Palo Alto, CA (US)
Filed by Carbon Black, Inc., Palo Alto, CA (US)
Filed on Mar. 1, 2021, as Appl. No. 17/188,526.
Application 17/188,526 is a continuation of application No. 16/434,969, filed on Jun. 7, 2019, granted, now 10,938,842.
Application 16/434,969 is a continuation of application No. 15/468,942, filed on Mar. 24, 2017, granted, now 10,320,820, issued on Jun. 11, 2019.
Claims priority of provisional application 62/312,797, filed on Mar. 24, 2016.
Prior Publication US 2021/0185065 A1, Jun. 17, 2021
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); G06N 5/04 (2023.01)
CPC H04L 63/1416 (2013.01) [G06N 5/04 (2013.01); H04L 63/145 (2013.01); H04L 63/1408 (2013.01); H04L 63/1433 (2013.01); H04L 63/0227 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method for guiding a response to a security incident, comprising:
monitoring a plurality of occurrences in a computer system, wherein the plurality of occurrences includes (1) a first occurrence whereby a first file instantiates a first process that creates or registers a second file, and (2) a second occurrence whereby the computer system instantiates a second process from the second file;
determining, based on adjacency data, that at least a subset of the plurality of occurrences is relevant to the second process, wherein the subset includes the first occurrence and the second occurrence, wherein the adjacency data includes data indicating relevance of the first occurrence to the second occurrence;
estimating a respective utility of investigating each occurrence in the subset;
selecting two or more occurrences from the subset based, at least in part, on the estimated utilities, the selected occurrences including the first occurrence and the second occurrence; and
guiding the response to the security incident at least by presenting, to a user, data corresponding to the selected occurrences.