Patent ID: 9129108
Filing Date: 2015-09-08
Classification: G06F,H04L

Abstract:
1. A method to operate a governed data processing system in concert with a governing data processing system, comprising: operating a secure governing data processing system to monitor operation of at least one governed data processing system to detect a deviation from modeled user and governed data processing system behavior; and upon detecting a deviation from the modeled behavior taking proactive action to mitigate an occurrence of a potential adverse result of an occurrence of a cyber-security threat; where operating the secure governing data processing system to monitor operation of the at least one governed data processing system comprises capturing data from the at least one governed data processing system, assimilating the captured data, performing modeling, monitoring and analyzing of the assimilated data; using the modeling, monitoring and results of the analyzing to identify a potential cyber-threat and to suggest at least one action or countermeasure to be taken to counter the potential cyber-threat, and in response to identifying a potential cyber-threat and suggesting at least one action or countermeasure, initiating in the governing data processing system a proactive command and control process to transform into an executable action the at least one suggested action or countermeasure for proactively implementing the at least one suggested action or countermeasure, the executable action being adapted to the governed data processing system and executed within the governed data processing system; wherein there are a plurality of data processing systems that are monitored by the secure governing data processing and where performing modeling, monitoring and analyzing of the assimilated data considers assimilated data captured from the plurality of governed data processing systems to detect occurrences of anomalous behavior in the plurality of governed data processing systems; and in response to detecting an occurrence of anomalous behavior in one of the plurality of governed data processing systems, taking proactive action to mitigate an occurrence of the anomalous behavior in another one of the governed data processing systems that has not exhibited the anomalous behavior.