Patent ID: 8583583
Filing Date: 2013-11-12
Classification: G06F,G06N,H04L

Abstract:
1. A multiple hypothesis engine for evaluating dynamic cyber adversarial operations, comprising: an algorithm stored on a non-transitory computer readable medium for a history based expansion of a suspicion relating to a suspected cyber attack comprising: selects an element from each of a plurality of predetermined adversarial categories that identify lines of reasoning regarding a suspected cyber attack, which selected elements correspond to nodes in a Bayesian multiple hypothesis tree graph; selects a certainty value that the suspected cyber attack will occur; for each node corresponding to a selected element, evaluates a line of reasoning associated therewith by searching a contextual hierarchical knowledge store to determine its weighted probability value and expanding the node to identify each of its child nodes; calculates a weighted probability value of each of the child nodes, which is the weighted probability value of the parent node multiplied by a ratio value of the child node, which is the ratio of historic recorded incidents for that node in relation to other nodes; calculates certainty values for each of the child nodes, which is the weighted probability value of the respective child node multiplied by a danger value associated with the respective child node, which is the average of the danger values for the historic incidents on that node; selects the child node having the largest weighted probability as a new current node; locates a node in the contextual hierarchical knowledge store corresponding to the new current node; expands the new current node to identify each of its child nodes; calculates weighted probability and certainty values for each of the child nodes of the new current node using rolled-up data associated with each current node; selects the child node of the new current node having the largest weighted probability as a new current node; repeats the last four steps until no child nodes are found; continues processing each line of reasoning in a round-robin fashion until no new current nodes for any of the lines of reasoning are found; and identifies the child node having the largest certainty value as the most likely cyber attack.