Patent ID: 11936666
Assignee: MUSARUBRA US LLC
Field: Digital communication (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 0:
1. A security logic engine, including a memory and a processor, to determine whether a network, including a plurality of endpoint devices, is undergoing a cyber-attack, the security logic engine comprising:
correlation logic stored in the memory for execution by the processor, the correlation logic is configured to generate correlation results based on (i) a combination of monitored features including a first set of features associated with a first object included as part of inbound network traffic detected at a periphery of the network and generated based on analytics of the first object by a malware detection system and a second set of features generated based on analytics of the first object by one or more endpoint devices and (ii) a third set of features exhibited by a known malware or a known malware family;
a classification engine stored in the memory for execution by the processor, the classification engine is configured to generate classification results by determining, at least basal on the correlation results provided by the correlation logic, whether the first object is classified as a malicious object being part of the cyber-attack;
a risk analyzer stored in the memory for execution by the processor, the risk analyzer is configured to (i) receive the classification results when the first object is classified by the classification engine as a malicious object and (ii) correlate the combination of monitored features with information associated with properties associated with each of the plurality of endpoint devices, different than the malware detection system, to generate at least a risk profile for each of the plurality of endpoint devices,
wherein each risk profile identifies whether a corresponding endpoint device is vulnerable to the cyber-attack.