Patent ID: 9503472
Filing Date: 2016-11-22
CPC Classification: G06F,G06N,H04L

Claim Text:
1. A computer implemented method of profiling cyber threats detected in a target environment, comprising: receiving, from a Security Information and Event Manager (SIEM) monitoring the target environment, alerts triggered by a detected potential cyber threat, and, for each alert: (A) retrieving captured packet data related to the alert; (B) extracting data pertaining to a set of attributes from captured packet data triggering the alert; and (C) applying fuzzy logic to data pertaining to one or more of the attributes to determine values for one or more output variables indicative of a level of an aspect of risk attributable to the cyber threat; wherein the fuzzy logic comprises one or more rule bases comprising fuzzy rules and being usable to evaluate a CT risk indicator; wherein each fuzzy rule of a rule base has: wherein step (C) comprises, for each fuzzy rule of a rule base: (i) for each input fuzzy variable of the antecedent, fuzzifying data pertaining to the attribute represented by the input fuzzy variable to determine a membership value across the fuzzy set of the input fuzzy variable; (ii) evaluating the antecedent, performing any declared fuzzy logical operators to provide a single membership value; and (iii) evaluating the consequent by performing a fuzzy implication operator on the antecedent to determine the membership value of the relevant output cyber threat indicator.