Office Action 1: Notice of Allowance (2024-08-26)

CLAIMS:
AMENDMENTS TO THE CLAIMS

1\. (Presently amended) A computer security monitoring method, including:monitoring on an ongoing basis for evidence of the presence of infected systems in one or more SVG {EMBED HERE} 0.1471.653 networks that are each associated with a SVG {EMBED HERE} 0.1130.553SVG {EMBED HERE} 0.1470.67SVG {EMBED HERE} 0.155.503SVG {EMBED HERE} 0.1070.633m onitoredorganizaSVG {EMBED HERE} 0.111.17tionalentitypossessingdigitalassetscSVG {EMBED HERE} 0.1470.84ited continuously updating risk profiles for the monitored organizational entities based on SVG {EMBED HERE} 0.110.19\_information SVG {EMBED HERE} 0.1131.557 from the monitoring,aggregating SVG {EMBED HERE} 0.111.127 risk scores for the monitored organizational entities,SVG {EMBED HERE} 0.0770.753and electronically reporting the aggregated risk to an end user.

2\. (Previously presented) The method of claim 1 wherein the electronically reporting includes automatically issuing alerts to one or more related ones of a first of the monitored networks upon detection of an intrusion feature in traffic with the first of the monitored networks.

3\. (Previously presented) The method of claim 1 wherein the monitoring for intrusion features includes monitoring communications with one or more known or suspected malware controller machines.

4\. (Previously presented) The method of claim 1 wherein the aggregating risk scores includes combining information about intrusion features with information about other risks for the first of the networks.

5\. (Previously presented) The method of claim 1 further including responding to user requests to explore ontological relationships that led to the aggregated organizational risk score.

6\. (Previously presented) The method of claim 1:
further including continuously gathering machine-readable facts relating to a number of topics, including evidence of the presence of infected systems,
wherein the continuously updating further includes deriving and storing risk profiles for a plurality of monitored entities based on at least some of the facts,
further including providing an ontology that associates a different subset of the monitored entities to each of a plurality of organizational entities possessing digital assets,
wherein the aggregating the risk scores aggregates the risk scores for the scored entities for each of the organizational entities based on the associations in the ontology to derive an aggregated risk score, and
wherein the electronically reporting the aggregated risk score to an end user reports a score that is based on evidence of the presence of infected systems and other risks.

7\. (Previously presented) The method of claim 6 further including responding to user requests to explore the ontological relationships that led to the aggregated organizational risk score.

8\. (Previously presented) The method of claim 6 further including determining whether the aggregated organizational risk score meets a predetermined criteria, and wherein the electronically reporting includes electronically issuing an alert in response to the meeting of the predetermined criteria.

9\. (Previously presented) The method of claim 6 wherein the electronically reporting includes issuing a report that includes the aggregated organizational entity risk score.

10\. (Previously presented) The method of claim 9 wherein the issuing a report includes issuing a report that further includes a plurality of visual elements that visually summarize the ontological relationships that lead to the aggregated organizational entity risk score.

11\. (Previously presented) The method of claim 9 wherein the issuing a report includes issuing an interactive report that includes a plurality of controls that allow the user to explore the ontological relationships that lead to the aggregated organizational entity risk score.

12\. (Previously presented) The method of claim 9 wherein the issuing a report includes issuing an interactive report that includes a plurality of visual elements that visually summarize the ontological relationships that lead to the aggregated organizational entity risk score, and wherein the visual elements are responsive to user actuation to allow the user to explore the ontological relationships that lead to the aggregated organizational entity risk score.

13\. (Previously presented) The method of claim 12 wherein the presenting visual elements presents the visual elements as a series of textual links that visually summarize the ontological relationships that lead to the aggregated organizational entity risk score, and wherein the links can be actuated to further explore the ontological relationships that lead to the aggregated organizational entity risk score.

14\. (Previously presented) The method of claim 6 further including continuously updating the ontological relationships using an ongoing ontology maintenance process.

15\. (Previously presented) The method of claim 6 wherein the ontological relationships include relationships between different organizational entities.

16\. (Previously presented) The method of claim 15 wherein the ontological relationships include relationships between organizational entities and their subsidiaries and contractors.

17\. (Previously presented) The method of claim 6 wherein the ontological relationships include relationships between organizational entities and network identifiers.

18\. (Previously presented) The method of claim 6 wherein the ontological relationships include relationships between organizational entities and types of technology.

19\. (Previously presented) The method of claim 6 wherein the ontological relationships can be expressed as a directed acyclic graph.

20-21. (Cancelled)

22\. (Presently amended) A computer security monitoring system, including:a network traffic monitoring interface operative to detect on an ongoing basis evidence of the presence of infected systems in one or more third party organizational networks that are each associated with a SVG {EMBED HERE} 0.1471.29 monitored organizational entity possessing digital assets SVG {EMBED HERE} 0.1471.323s;maSVG {EMBED HERE} 0.153.863risk profile generation logic responsive to the traffic monitoring interface and operative to continuously update machine-readable risk profiles for the monitored organizational entities based on SVG {EMBED HERE} 0.110.19 informationsbSVG {EMBED HERE} 0.1171.347 from the monitoring interface,aggregation logic operative to aggregate SVG {EMBED HERE} 0.111.08 risk scores for the scored entities for each of the organizational entities, andSVG {EMBED HERE} 0.080.747a reporting interface operative to electronically report the aggregated risk to an end user.

23\. (Presently amended) A computer security monitoring system, including:SVG {EMBED HERE} 0.0770.32means for monitoring on an ongoing basis for evidence of the presence of infected systems in one or more SVG {EMBED HERE} 0.1470.677ozi networks that are each associated with aSVG {EMBED HERE} 0.110.917monitored organizational entity possessing digital SVG {EMBED HERE} 0.1431.307SVG {EMBED HERE} 0.155.547SVG {EMBED HERE} 0.100.64means for continuously updating SVG {EMBED HERE} 0.110.547SVG {EMBED HERE} 0.1031.52:ine- risk profiles for the monitored organizational entities based on informationfromthe monitoring,means for aggregating the SVG {EMBED HERE} 0.111.163 risk scores for the monitored organizational entities, and
means for electronically reporting the aggregated risk tm; to an end user.

OFFICE ACTION:
Notice of Pre-AIA  or AIA  Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1-19, 22 and 23 are pending, claims 20 and 21 have been canceled, and claims 1, 22 and 23 have been amended.
The Terminal Disclaimer filed on 08-21-2024 has been processed and approved.
EXAMINER’S AMENDMENT
The application has been amended as follows:
An examiner’s amendment to the record appears below. Should the changes and/or additions be unacceptable to applicant, an amendment may be filed as provided by 37 CFR 1.312. To ensure consideration of such an amendment, it MUST be submitted no later than the payment of the issue fee.
Authorization for this examiner’s amendment was given in a telephone interview with applicant’s attorney Mr. Kristofer E. Elbing (Reg. No. 34,590), on 08-22-2024.
Claims are amended as follows:
1.  (Currently amended) A computer security monitoring method, including:
monitoring on an ongoing basis for evidence of the presence of infected systems in one or more third-party organizational networks that are each associated with a different third-party monitored organizational entity possessing digital assets, by externally observing network communication information about the third-party organizational networks,
providing an ontology that associates different subsets of the observed communication information to each of a plurality of third-party organizational entities possessing digital assets,
continuously updating machine-readable risk profiles for the third-party monitored organizational entities based on the information from the monitoring,
aggregating machine-readable risk scores for the third-party monitored organizational entities, wherein the aggregating the risk scores aggregates the risk scores for each of the third-party monitored organizational entities based on the associations in the ontology to derive an aggregated risk score,
electronically reporting the aggregated risk scores to an end user, wherein the electronically reporting the aggregated risk score to an end user reports a score that is based on evidence of the presence of infected systems and other risks, and wherein the electronically reporting the aggregated risk score provides a user interface and wherein the user interface is responsive to user actuation that allows the user to explore the ontological relationships that lead to the aggregated organizational entity risk score.
3.  (Currently amended) The method of claim [[1]] 2 wherein the monitoring for intrusion features includes monitoring communications with one or more known or suspected malware controller machines.
6.  (Cancelled)
7.  (Cancelled)
8.  (Currently amended) The method of claim [[6]] 1 further including determining whether the aggregated organizational risk score meets a predetermined criteria, and wherein the electronically reporting includes electronically issuing an alert in response to the meeting of the predetermined criteria.
9.  (Currently amended)The method of claim [[6]] 1 wherein the electronically reporting includes issuing a report that includes the aggregated organizational entity risk score.
14.  (Currently amended) The method of claim [[6]] 1  further including continuously updating the ontological relationships using an ongoing ontology maintenance process.
15.  (Currently amended)The method of claim [[6]] 1  wherein the ontological relationships include relationships between different organizational entities.
17.  (Currently amended)The method of claim [[6]] 1  wherein the ontological relationships include relationships between organizational entities and network identifiers.
18.  (Currently amended)The method of claim [[6]] 1 wherein the ontological relationships include relationships between organizational entities and types of technology.
19.  (Currently amended)The method of claim [[6]] 1  wherein the ontological relationships can be expressed as a directed acyclic graph.
22.  (Currently amended) A computer security monitoring system, including:
a network traffic monitoring interface operative to detect on an ongoing basis evidence of the presence of infected systems in one or more  third-party organizational networks that are each associated with a different third-party monitored organizational entity possessing digital assets, by externally observing network communication information about the third-party organizational networks,
memory operative to store an ontology that associates different subsets of the observed communication information to each of a plurality of third-party organizational entities possessing digital assets,
risk profile generation logic responsive to the traffic monitoring interface and operative to continuously update machine-readable risk profiles for the third-party monitored organizational entities based on the information from the monitoring interface,
aggregation logic operative to aggregate machine-readable risk scores for the scored entities for each of the third-party monitored organizational entities, wherein the aggregation logic is operative to aggregate the risk scores for each of the third-party monitored organizational entities based on the associations in the ontology to derive an aggregated risk score, and
a reporting interface operative to electronically report the aggregated risk scores to an end user, wherein the reporting interface is operative to report a score to an end user that is based on evidence of the presence of infected systems and other risks, wherein the reporting interface provides a user interface, and wherein the user interface is responsive to user actuation that allows the user to explore the ontological relationships that lead to the aggregated organizational entity risk score.
23. (Cancelled)
Allowable Subject Matter
Claims 1-5, 8-19 and 22 are allowed.
The following is an examiner’s statement of reasons for allowance:
The prior art Martin et al. (US Publication No. 2018/0004948) of record discloses, a method for predicting and characterizing cyber attacks includes: receiving, from a sensor a first signal specifying a first anomalous behavior of a first asset on the network at a first time; representing the first signal in a first vector representing frequencies of anomalous behaviors in a set of behavior types of the first asset within a first time window; calculating a first malicious score representing proximity of the first vector to malicious vectors; calculating a first benign score representing proximity of the first vector to a benign vector representing an innocuous set of behaviors; and in response to the first malicious score exceeding the first benign score and a malicious threshold score, issuing a first alert to investigate the network for a security threat.
The prior art Kulkarni et al. (US Patent No. 9,166,999) of record discloses, a server computing device receives security risk data elements from a plurality of data sources, the data elements corresponding to a transaction submitted by a remote computing device to the server computing device for execution. The server computing device aggregates the security risk data elements into a weighted risk matrix. The server computing device generates a risk score for the submitted transaction based upon the weighted risk matrix. The server computing device determines an internal environment risk factor and an external environment risk factor based upon environmental risk data received from the plurality of data sources. The server computing device adjusts the risk score for the submitted transaction based upon the internal environment risk factor and the external environment risk factor, and determines a disposition for the transaction based upon the adjusted risk score.
The prior art Singaraju et al. (US Patent No. 10,230,767) of record discloses, a system and method for identifying distributed attacks, such as, but not limited to, distributed denial of service attacks and botnet attacks, in a first network serviced by a first carrier and configured to alert a second network serviced by a second carrier that is different from the first carrier is disclosed. Once an attack has been identified, an attack alert is generated and provided to the second network or other aspects of the first network, or both.
The prior art Suit et al. (US Patent No. 8,429,748) of record discloses, Network traffic analysis is performed by deploying, across a network having a plurality of network nodes, at least one data collection agent, on at least two of the plurality of network nodes. Each data collection agent may monitor at each network node, a plurality of network connections instantiated during a monitoring time period. Data resulting from the monitoring is acquired from the data collection agents and an ontological description of the network is automatically created from the acquired data. The ontological description is dynamically updated and network traffic analysis is performed using the dynamically updating ontological description.
However, prior arts taken singly or in combination, fail to anticipate or render, “providing an ontology that associates different subsets of the observed communication information to each of a plurality of third-party organizational entities possessing digital assets,…aggregating machine-readable risk scores for the third-party monitored organizational entities, wherein the aggregating the risk scores aggregates the risk scores for each of the third-party monitored organizational entities based on the associations in the ontology to derive an aggregated risk score, electronically reporting the aggregated risk scores to an end user, wherein the electronically reporting the aggregated risk score to an end user reports a score that is based on evidence of the presence of infected systems and other risks, and wherein the electronically reporting the aggregated risk score provides a user interface and wherein the user interface is responsive to user actuation that allows the user to explore the ontological relationships that lead to the aggregated organizational entity risk score” (as recited in claim 1 and similarly recited in claim 22).
Claims are allowed in light of the above claim limitations when in combination with the remaining claim limitations.
Any comments considered necessary by applicant must be submitted no later than the payment of the issue fee and, to avoid processing delays, should preferably accompany the issue fee.  Such submissions should be clearly labeled “Comments on Statement of Reasons for Allowance.”
Conclusion



CITED REFERENCE SUMMARIES: Ref US20180004948A1: Claims:
A method for predicting and characterizing cyber attacks comprising: receiving a first signal specifying a first behavior of a first asset on a network at a first time; compiling the first signal and a first set of signals into a first data structure, each signal in the first set of signals specifying a behavior of the first asset on the network within a first time window of a preset duration up to the first time; calculating a first degree of deviation of the first data structure from a corpus of data structures, each data structure in the corpus of data structures representing a previous set of behaviors of an asset, in a set of assets, on the network within a time window of the preset duration; in response to the first degree of deviation exceeding a deviation threshold score, issuing a first alert to investigate the first asset; in response to the deviation threshold score exceeding the first degree of deviation: calculating a first malicious score proportional to proximity of the first data structure to a first malicious data structure defining a first set of behaviors representative of a first network security threat; calculating a first benign score proportional to proximity of the first data structure to a benign data structure representing an innocuous set of behaviors; in response to the first malicious score exceeding the first benign score, issuing a second alert to investigate the network for the first network security threat; and in response to the first benign score exceeding the first malicious score, disregarding the first data structure.
receiving a first signal specifying a first behavior of a first asset on a network at a first time;
compiling the first signal and a first set of signals into a first data structure, each signal in the first set of signals specifying a behavior of the first asset on the network within a first time window of a preset duration up to the first time;
calculating a first degree of deviation of the first data structure from a corpus of data structures, each data structure in the corpus of data structures representing a previous set of behaviors of an asset, in a set of assets, on the network within a time window of the preset duration;
in response to the first degree of deviation exceeding a deviation threshold score, issuing a first alert to investigate the first asset;
in response to the deviation threshold score exceeding the first degree of deviation: calculating a first malicious score proportional to proximity of the first data structure to a first malicious data structure defining a first set of behaviors representative of a first network security threat; calculating a first benign score proportional to proximity of the first data structure to a benign data structure representing an innocuous set of behaviors;
calculating a first malicious score proportional to proximity of the first data structure to a first malicious data structure defining a first set of behaviors representative of a first network security threat;
calculating a first benign score proportional to proximity of the first data structure to a benign data structure representing an innocuous set of behaviors;
in response to the first malicious score exceeding the first benign score, issuing a second alert to investigate the network for the first network security threat; and
in response to the first benign score exceeding the first malicious score, disregarding the first data structure.
The method of claim 1 : wherein receiving the first signal comprises accessing the first signal generated by a sensor: arranged on the network, implementing deep packet inspection to detect anomalous behaviors of assets on the network, and outputting signals responsive to anomalous behaviors of assets on the network; and wherein compiling the first signal and the first set of signals into the first data structure comprises generating the first data structure in response to receipt of the first signal.
wherein receiving the first signal comprises accessing the first signal generated by a sensor: arranged on the network, implementing deep packet inspection to detect anomalous behaviors of assets on the network, and outputting signals responsive to anomalous behaviors of assets on the network; and
arranged on the network,
implementing deep packet inspection to detect anomalous behaviors of assets on the network, and
outputting signals responsive to anomalous behaviors of assets on the network; and
wherein compiling the first signal and the first set of signals into the first data structure comprises generating the first data structure in response to receipt of the first signal.
The method of claim 2 : wherein receiving the first signal comprises receiving the first signal specifying a combination of the first behavior and a second behavior of the first asset defined by a first machine hosting a first user on the network; and wherein compiling the first signal and the first set of signals into the first data structure comprises accessing: a second signal specifying the first behavior and the second behavior of the first asset within the first time window and prior to the first time; and a third signal specifying a third behavior of the first asset within the first time window.
wherein receiving the first signal comprises receiving the first signal specifying a combination of the first behavior and a second behavior of the first asset defined by a first machine hosting a first user on the network; and
wherein compiling the first signal and the first set of signals into the first data structure comprises accessing: a second signal specifying the first behavior and the second behavior of the first asset within the first time window and prior to the first time; and a third signal specifying a third behavior of the first asset within the first time window.
a second signal specifying the first behavior and the second behavior of the first asset within the first time window and prior to the first time; and
a third signal specifying a third behavior of the first asset within the first time window.
The method of claim 2 , wherein receiving the first signal comprises receiving the first signal specifying one of: an error event involving the first asset; unauthorized access by the first asset on the network; uncommon connection between the first asset and a domain external the network; and receipt of an executable attachment from an email address new to the network at the first asset.
The method of claim 1 : wherein receiving the first signal comprises receiving the first signal specifying the first behavior, in a predefined set of behavior types, anomalous to the first asset; wherein compiling the first signal and the first set of signals into the first data structure comprises generating the first data structure representing frequencies of behaviors, in the predefined set of behavior types, of the first asset during the first time window; and wherein calculating the first degree of deviation of the first data structure from the corpus of data structures comprises calculating the first degree of deviation of frequencies of behaviors of each behavior type represented in the first data structure from frequencies of behaviors of each behavior type represented in data structures in the corpus of data structures.
wherein receiving the first signal comprises receiving the first signal specifying the first behavior, in a predefined set of behavior types, anomalous to the first asset;
wherein compiling the first signal and the first set of signals into the first data structure comprises generating the first data structure representing frequencies of behaviors, in the predefined set of behavior types, of the first asset during the first time window; and
wherein calculating the first degree of deviation of the first data structure from the corpus of data structures comprises calculating the first degree of deviation of frequencies of behaviors of each behavior type represented in the first data structure from frequencies of behaviors of each behavior type represented in data structures in the corpus of data structures.
The method of claim 5 : wherein compiling the first signal and the first set of signals into the first data structure comprises generating a first multi-dimensional vector representing frequencies of behaviors of each behavior type, in the predefined set of behavior types, of the first asset within the preset duration of two weeks terminating at the first time; wherein calculating the first degree of deviation of the first data structure from the corpus of data structures comprises: accessing the corpus of data structures, each data structure in the corpus of data structures comprising a multi-dimensional vector representing a frequency of behaviors of an asset, in the set of assets, within a duration of two weeks prior to the first time; training a replicator neural network on the corpus of data structures; passing the first multi-dimensional vector through the replicator neural network to generate a first output vector; and calculating an outlier score based on a difference between the first multi-dimensional vector and the first output vector; and wherein issuing the first alert to investigate the first asset comprises issuing the first alert to investigate the first asset in response to the outlier score exceeding the deviation threshold score.
wherein compiling the first signal and the first set of signals into the first data structure comprises generating a first multi-dimensional vector representing frequencies of behaviors of each behavior type, in the predefined set of behavior types, of the first asset within the preset duration of two weeks terminating at the first time;
wherein calculating the first degree of deviation of the first data structure from the corpus of data structures comprises: accessing the corpus of data structures, each data structure in the corpus of data structures comprising a multi-dimensional vector representing a frequency of behaviors of an asset, in the set of assets, within a duration of two weeks prior to the first time; training a replicator neural network on the corpus of data structures; passing the first multi-dimensional vector through the replicator neural network to generate a first output vector; and calculating an outlier score based on a difference between the first multi-dimensional vector and the first output vector; and
accessing the corpus of data structures, each data structure in the corpus of data structures comprising a multi-dimensional vector representing a frequency of behaviors of an asset, in the set of assets, within a duration of two weeks prior to the first time;
training a replicator neural network on the corpus of data structures;
passing the first multi-dimensional vector through the replicator neural network to generate a first output vector; and
calculating an outlier score based on a difference between the first multi-dimensional vector and the first output vector; and
wherein issuing the first alert to investigate the first asset comprises issuing the first alert to investigate the first asset in response to the outlier score exceeding the deviation threshold score.
The method of claim 6 : wherein accessing the corpus of data structures comprises accessing the corpus of data structures comprising a first set of unlabeled vectors and a second set of vectors labeled with identifiers of known network security threats, the first set of unlabeled vectors and the second set of vectors representing frequencies of behaviors of assets on the network over a second time window comprising the first time window and greater than the preset duration; and wherein calculating the first malicious score and calculating the first benign score comprise accessing the corpus of labeled vectors comprising the second set of vectors.
wherein accessing the corpus of data structures comprises accessing the corpus of data structures comprising a first set of unlabeled vectors and a second set of vectors labeled with identifiers of known network security threats, the first set of unlabeled vectors and the second set of vectors representing frequencies of behaviors of assets on the network over a second time window comprising the first time window and greater than the preset duration; and
wherein calculating the first malicious score and calculating the first benign score comprise accessing the corpus of labeled vectors comprising the second set of vectors.
The method of claim 1 : further comprising: accessing a set of malicious data structures, each malicious data structure in the set of malicious data structures defining a set of signals representative of a network security threat; and in response to the first data structure matching a second malicious data structure in the set of malicious data structures, issuing a second alert to investigate the network for a second network security threat represented by the second malicious data structure; and wherein calculating the first malicious score comprises, in response to lack of a match between the first data structure and a malicious data structure in the set of malicious data structures: calculating the first malicious score proportional to proximity of the first data structure to the first malicious data structure, in the set of malicious data structures, nearest the first data structure.
further comprising: accessing a set of malicious data structures, each malicious data structure in the set of malicious data structures defining a set of signals representative of a network security threat; and in response to the first data structure matching a second malicious data structure in the set of malicious data structures, issuing a second alert to investigate the network for a second network security threat represented by the second malicious data structure; and
accessing a set of malicious data structures, each malicious data structure in the set of malicious data structures defining a set of signals representative of a network security threat; and
in response to the first data structure matching a second malicious data structure in the set of malicious data structures, issuing a second alert to investigate the network for a second network security threat represented by the second malicious data structure; and
wherein calculating the first malicious score comprises, in response to lack of a match between the first data structure and a malicious data structure in the set of malicious data structures: calculating the first malicious score proportional to proximity of the first data structure to the first malicious data structure, in the set of malicious data structures, nearest the first data structure.
calculating the first malicious score proportional to proximity of the first data structure to the first malicious data structure, in the set of malicious data structures, nearest the first data structure.
The method of claim 1 : wherein compiling the first signal and the first set of signals into the first data structure comprises generating a first multi-dimensional vector representing frequencies of behaviors, in a predefined set of behavior types, of the first asset during the first time window; wherein calculating the first malicious score comprises calculating the first malicious score proportional to proximity of the first multi-dimensional vector to a first cluster of vectors, in a corpus of labeled vectors, representing the first network security threat; and wherein calculating the first benign score comprises calculating the first benign score proportional to proximity of the first multi-dimensional vector to a second duster of vectors, in the corpus of labeled vectors, representing innocuous network activity.
wherein compiling the first signal and the first set of signals into the first data structure comprises generating a first multi-dimensional vector representing frequencies of behaviors, in a predefined set of behavior types, of the first asset during the first time window;
wherein calculating the first malicious score comprises calculating the first malicious score proportional to proximity of the first multi-dimensional vector to a first cluster of vectors, in a corpus of labeled vectors, representing the first network security threat; and
wherein calculating the first benign score comprises calculating the first benign score proportional to proximity of the first multi-dimensional vector to a second duster of vectors, in the corpus of labeled vectors, representing innocuous network activity.
The method of claim 9 : wherein issuing the second alert to investigate the network for the first network security threat comprises: generating the second alert specifying the first asset and comprising a prompt for an investigation into presence of the first network security threat, associated with the first malicious data structure, on the network; and inserting the second alert into an alert feed of a security operation center; and further comprising: accessing a result of the investigation into presence of the first network security threat on the network from the security operation center; labeling the first data structure according to the result; and inserting the first data structure into the corpus of labeled vectors.
wherein issuing the second alert to investigate the network for the first network security threat comprises: generating the second alert specifying the first asset and comprising a prompt for an investigation into presence of the first network security threat, associated with the first malicious data structure, on the network; and inserting the second alert into an alert feed of a security operation center; and
generating the second alert specifying the first asset and comprising a prompt for an investigation into presence of the first network security threat, associated with the first malicious data structure, on the network; and
inserting the second alert into an alert feed of a security operation center; and
further comprising: accessing a result of the investigation into presence of the first network security threat on the network from the security operation center; labeling the first data structure according to the result; and inserting the first data structure into the corpus of labeled vectors.
accessing a result of the investigation into presence of the first network security threat on the network from the security operation center;
labeling the first data structure according to the result; and
inserting the first data structure into the corpus of labeled vectors.
The method of claim 9 , further comprising: in response to the first malicious score approximating the first benign score, issuing a prompt to investigate the first asset; accessing a result of an investigation into the first asset from the security operation center; labeling the first data structure according to the result; and inserting the first data structure into the corpus of labeled vectors.
in response to the first malicious score approximating the first benign score, issuing a prompt to investigate the first asset;
accessing a result of an investigation into the first asset from the security operation center;
The method of claim 9 , further comprising: in response to issuing the first alert to investigate the first asset: accessing a result of an investigation into the asset responsive to the first alert, the result specifying a second security threat; labeling the first data structure according to the second security threat; and inserting the first data structure into the corpus of labeled vectors. receiving a second signal specifying a second behavior of a second asset on the network at a second time succeeding the first time; compiling the second signal and a second set of signals into a second data structure, each signal in the second set of signals specifying a behavior of the second asset on the network
[Truncated to input limit]