Patent ID: 11895090
Assignee: AVAST SOFTWARE S.R.O.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 19:
20. The method of claim 1, wherein:
the particular incident comprises at least one of a first tactic, a first technique, a first procedure, or first metadata;
the plurality of time-based behaviors comprise at least one of a second tactic, a second technique, a second procedure, or second metadata;
determining a match of the at least one of the first tactic, the first technique, the first procedure, or the first metadata to the at least one of the second tactic, the second technique, the second procedure, or the second metadata based on the comparison of the plurality of time-based behaviors to the particular incident and to the time frame of the particular incident; and
the determination of the match of the particular behavior from the particular source to the particular incident is based on the determination of the match of the at least one of the first tactic, the first technique, the first procedure, or the first metadata to the at least one of the second tactic, the second technique, the second procedure, or the second metadata.