US 12,468,848 B2
Data augmentation for threat investigation in an enterprise network
Kenneth D. Ray, Seattle, WA (US); Andrew J. Thomas, Oxfordshire (GB); and Karl Ackerman, Topsfield, MA (US)
Assigned to Sophos Limited, Abingdon (GB)
Filed by Sophos Limited, Abingdon (GB)
Filed on Jun. 28, 2024, as Appl. No. 18/759,530.
Application 18/759,530 is a continuation of application No. 17/343,680, filed on Jun. 9, 2021, granted, now 12,026,276.
Claims priority of provisional application 63/042,219, filed on Jun. 22, 2020.
Prior Publication US 2024/0427930 A1, Dec. 26, 2024
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 21/62 (2013.01); G06F 16/21 (2019.01); G06F 16/215 (2019.01); G06F 16/2455 (2019.01); G06Q 10/067 (2023.01); H04L 9/40 (2022.01)
CPC G06F 21/6245 (2013.01) [G06F 16/211 (2019.01); G06F 16/215 (2019.01); G06F 16/24568 (2019.01); G06Q 10/067 (2013.01); H04L 63/1416 (2013.01); H04L 63/1425 (2013.01); H04L 63/1441 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:
receiving event data from a sensor on an endpoint, the event data responsive to an event on the endpoint, and the event data identifying the event;
in response to receiving the event data, precomputing, with the endpoint, a relationship between the event in a temporal context of the sensor and transient information including a local collection of causally related events, each of the causally related events causally related with the event and each of the causally related events associated with a source around a time of the event;
generating a mini-graph that characterizes the relationship precomputed between the event and the local collection of causally related events;
creating a modified event record that includes the mini-graph by joining the event data with the mini-graph that characterizes the relationship, precomputed in response to receiving the event data, between the event and the local collection of causally related events;
storing the modified event record in a data recorder on the endpoint;
transmitting the modified event record to a threat management facility; and
receiving data from the threat management facility for managing security for the endpoint based on the modified event record.