US 12,413,618 B2
Methods and apparatus to automate cyber defense decision process and response actions by operationalizing adversarial technique frameworks
Nick Lantuh, Bethesda, MD (US); Michael Jenks, Mount Pleasant, SC (US); Ian Roth, Mount Pleasant, SC (US); Michael Maurer, Mount Pleasant, SC (US); and Richard Bowman, Mount Pleasant, SC (US)
Assigned to Cyberproof Inc., Aliso Viejo, CA (US)
Filed by Cyberproof Inc., Aliso Viejo, CA (US)
Filed on Feb. 12, 2024, as Appl. No. 18/439,015.
Application 18/439,015 is a continuation of application No. 17/524,509, filed on Nov. 11, 2021, granted, now 11,924,244.
Application 17/524,509 is a continuation of application No. 17/197,737, filed on Mar. 10, 2021, granted, now 11,252,188, issued on Feb. 15, 2022.
Claims priority of provisional application 63/150,800, filed on Feb. 18, 2021.
Claims priority of provisional application 63/064,988, filed on Aug. 13, 2020.
Prior Publication US 2024/0291860 A1, Aug. 29, 2024
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); G06N 3/08 (2023.01); G06N 5/025 (2023.01)
CPC H04L 63/1466 (2013.01) [G06N 3/08 (2013.01); G06N 5/025 (2013.01); H04L 63/029 (2013.01); H04L 63/1416 (2013.01); H04L 63/20 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method, comprising:
identifying detection coverage of a set of adversarial techniques based on telemetry data and a detection instance of an environment, the detection coverage of the set of adversarial techniques indicating an extent to which each adversarial technique from the set of adversarial techniques can be detected;
determining using a machine learning model, a subset of detection coverage having a metric value below a metric value threshold and among the detection coverage for the set of adversarial techniques, the metric value being a measure of an extent to which an adversarial technique from the set of adversarial techniques can be detected;
identifying at least one detection instance associated with the subset of detection coverage for the set of adversarial techniques;
presenting, via a graphical user interface, an interactive visualization of a representation of at least one of the subset of detection coverage or the at least one detection instance associated with the subset of detection coverage, wherein the interactive visualization includes selectable elements corresponding to different aspects of the detection coverage;
generating, based on user interaction with the selectable elements, a customized detection strategy for addressing the subset of detection coverage having the metric value below the metric value threshold; and
updating the subset of detection coverage based on the customized detection strategy of at least the telemetry data, the detection instance, or the at least one detection instance associated with the subset of detection coverage to improve the metric value of the subset of detection coverage to above the metric value threshold.