US 11,924,244 B2
Methods and apparatus to automate cyber defense decision process and response actions by operationalizing adversarial technique frameworks
Nick Lantuh, Bethesda, MD (US); Michael Jenks, Mount Pleasant, SC (US); Ian Roth, Mount Pleasant, SC (US); Michael Maurer, Mount Pleasant, SC (US); and Richard Bowman, Mount Pleasant, SC (US)
Assigned to INTERPRES SECURITY, INC., North Charleston, SC (US)
Filed by Room40 Labs, Inc., North Charleston, SC (US)
Filed on Nov. 11, 2021, as Appl. No. 17/524,509.
Application 17/524,509 is a continuation of application No. 17/197,737, filed on Mar. 10, 2021, granted, now 11,252,188.
Claims priority of provisional application 63/150,800, filed on Feb. 18, 2021.
Claims priority of provisional application 63/064,988, filed on Aug. 13, 2020.
Prior Publication US 2022/0070209 A1, Mar. 3, 2022
Int. Cl. H04L 9/40 (2022.01); G06N 3/08 (2023.01); G06N 5/025 (2023.01)
CPC H04L 63/1466 (2013.01) [G06N 3/08 (2013.01); G06N 5/025 (2013.01); H04L 63/029 (2013.01); H04L 63/1416 (2013.01); H04L 63/20 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method, comprising:
storing threat information in an adversarial technique framework data structure using a framework and a data model of a set of known threats based on tools, tactics or procedures used by adversary groups, software, techniques, malware or campaigns;
electronically receiving a set of telemetry data from one or more networked components forming part of a network infrastructure, wherein the telemetry data is indicative of adversarial techniques, and wherein the networked components comprise one or more hardware or software components for monitoring a security state on a computer network;
automatically storing in a computerized data store one or more of security product configuration information, detection logic, and the telemetry data, wherein the security product configuration information comprises information about the networked components;
generating scores for the set of known threats;
determining one or more prioritized mitigation recommendations based on at least the scores for the threats in the set of known threats; and
presenting to a user via a graphical user interface the one or more prioritized mitigation recommendations, wherein determining the one or more mitigation recommendations further comprises:
storing a set of mitigations mapped for association with the set of known threats, detection logic, and telemetry data;
mapping the stored threat information for the set of known threats against the telemetry data to identify one or more security coverage gaps; and
determining the one or more mitigation recommendations based on the one or more identified security coverage gaps.