ARTIFICIAL INTELLIGENCE-BASED DYNAMIC, ADAPTIVE, AND PREDICTIVE INFORMATION SECURITY THREAT IDENTIFICATION

A system includes a compute engine that implements artificial intelligence-based dynamic, predictive, statistical classification meta-algorithms for better information security threat identification. The closed loop output of this algorithm uses a dynamic weights model along with AI/ML/DL to identify diverse information security threats more comprehensively and more efficiently. This system evolves with time and self-corrects to adapt to the ever changing needs of cyber security.

BACKGROUND OF THE INVENTION

The present invention relates to information security threat identification and, more particularly, to artificial intelligence-based dynamic, adaptive, and predictive statistical classification meta-algorithms therefor.

Information Security is a prominent customer and business need and in the current business operating environment there is no business that can overlook the need of strong and effective Information Security. On average, the cost of an Information Security attack can run into millions of dollars of revenue, diluted brand image, big penalties, increased costs, efforts to strengthen the organization's security posture, a longer sales cycle, and reduced productivity. Currently, an organization's information security posture is based on known virus/ransomware/malware signatures. This is a suboptimal solution and is not able to solve the more complex security attacks. Cyber criminals are now using artificial intelligence and machine learning to create more sophisticated attack vectors. We cannot wait for an attack to happen and then act. We need to have predictive algorithms that use artificial intelligence/machine learning/deep learning to have better information security identification, protection, detection, response, and recoverability. Current artificial intelligence (AI)/machine intelligence (ML) based security solutions are less effective as they do not use predictive AI/ML based weighted factors and do not dynamically change the weights to include the latest information on attack vectors; hence, they are very simplistic.

Current intrusion detection solutions (IDS) do not solve the problem effectively as they are non-predictive, not adaptive, and non-dynamic, they do not use intrusion attack algorithm variance vectors and weights as a closed loop system to change the algorithm based on changing scenarios and traffic. They do not use multiple algorithms together to arrive at desired weights for each algorithm.

As can be seen, there is a need for better algorithms that use the comprehensive capability of AI/ML/deep learning (DL).

SUMMARY OF THE INVENTION

In one aspect of the present invention, a system comprises a computer processor configured to implement artificial intelligence-based dynamic, predictive, statistical classification meta-algorithms for an information security threat identification process by: recording and managing real time traffic on a server in a network, the recording and managing of individual client actions executing at all layers of a security protocol stack of the network.

In another aspect of the present invention, a computer readable medium comprises instructions that when executed by a processor execute by determining a variance associated with an algorithm by comparing with known issue test data; and calculating a square of the variance.

In another aspect of the present invention, a process of implementing artificial intelligence-based dynamic, predictive, statistical classification meta-algorithms comprises recalculating weights and reducing a variance if a resultant variance is not within a risk threshold.

DETAILED DESCRIPTION OF THE INVENTION

Broadly, one embodiment of the present invention is a method of producing artificial intelligence-based dynamic, predictive, statistical classification meta-algorithms for better information security threat identification and a system therefor.

The present invention provides an algorithm that creates a closed loop system that uses a dynamic weights model along with AI/ML/DL to identify diverse information security threats more comprehensively and more efficiently. This model evolves with time and self-corrects to adapt to the ever-changing needs of cyber security. The functionality targets the following wide range of technology solutions across many businesses:Better predictive model and algorithm for comprehensive information security Threat Identification;Dynamic algorithms with capability to self-correct based on variance and adapt to newer scenarios and better security signatures/algorithms;Better Precision/reduced false positive Security recommendations;Fine grained Security modeling;Better Performance of overall solution; andFine grained Debugging.

Typically, intrusion detection solutions work by having security protocols at a network stack.

A better IDS functionality may be implemented by a system that uses artificial intelligence/machine learning/deep learning to have better Information Security threat Identification. The inventive security threat identification is more effective and efficient as it uses predictive AI/ML-based weighted factors, reduces the variance, dynamically changes the weights to include the latest information attack vectors and correlates them to produce a multiple weighed algorithm that has higher efficiency and better performance in diverse attack scenarios and uses the comprehensive capability of AI/ML/DL.

Some embodiments of the invention are described herein in the general context of computer-executable instructions, such as program modules, being executed by a computer, such as a personal computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform tasks or implement abstract data types.

The accompanying drawings show by way of illustration, and not of limitation, specific embodiments in which the subject matter may be practiced.

Referring toFIGS.1-3,4A,4B, and5-7,FIG.1illustrates a prior art network protocol stack100including a physical layer110, a datalink layer120, a network layer130, a transport layer140, a session layer150, a presentation layer160, and an application layer170. As indicated at105, security protocols solutions currently known in the art execute at the physical layer110, the datalink layer120, the network layer130, the transport layer140, and/or the session layer150and a presentation layer160.

FIG.3illustrates in further detail a system300that implements cybersecurity threat detection. The system300includes a Log Sensitive Data Access layer301, Audit Logs layer302, domain name system (DNS) Query Audit Logs layer303, uniform resource locator (URL) Request Audit Logs layer304, Command-Line Audit Logs layer305, Centralize Audit Logs306, Audit Log Reviews layer307, Service Provider Logs layer308, Automatic Anti-Malware Scanning of Removable Media layer309, User Behavior-Based Anti-Malware layer310, Centralize Security Event Alerting layer311, Host-Based Intrusion Detection layer312, Network Intrusion Detection layer313, Network Traffic Flow Logs layer314, Security Event Alerting Thresholds layer315, Service Providers layer316, Active Discovery Tool layer317, Passive Asset Discovery Tool layer318, and Automated Software Inventory Tools layer319. Each of the system300layers implement cybersecurity threat detection.

An approach implemented as described by the current disclosure, also referred to herein as artificial intelligence-based dynamic, predictive, statistical classification meta-algorithms for better information security threat identification, is illustrated inFIG.4A,FIG.4B,FIG.5, andFIG.6.

FIGS.4A and4Billustrate a system400for creating a dynamic, predictive anomaly & signature security intrusion threat detection system architecture410for artificial intelligence-based dynamic, predictive, statistical classification meta-algorithms for better information security threat identification. The system400provides data ingestion, data curation, data translation, data transformation, and data enrichment, including Real time traffic input411that is ingested in the system, Clone data module412, Data Preprocessing and adding metadata, enrich data module413, Data Transformation module414(e.g., string IP to number IP), known data module415, Real time curated data module416and various algorithm modules417-420. Model Algorithm model421assigns weights to the various algorithms to come up with a proposed algorithm, which is analyzed by the Variance Analysis module422and is checked by the variance threshold check module423, and the Final dynamic algorithm module424produces a final algorithm which is dynamic, has reduced statistical variance, and is more effective as compared to prior art methods.

As shown inFIG.4A, the bad actors/attackers425create the attack vectors-based traffic which they send via internet426to a company438that they want to attack. The attack traffic goes through router427, elastic load balancer428, and lands at firewall429. A system appliance430executes an algorithm500(seeFIG.5) according to an embodiment of the present invention and provides real time traffic411. The curated traffic post-algorithm500goes to Switch431which distributes the traffic to a demilitarized zone (DMZ) area where webserver432and mail server433are hosted. The traffic then goes to system appliances439where algorithm500is executed again and provides real time traffic411. The curated traffic post-algorithm500goes to firewall435and then goes to database (DB) server436and local area network (LAN) traffic437.

FIG.5illustrates an algorithm500and features thereof that implements artificial intelligence-based dynamic, predictive, statistical classification meta-algorithms for better information security threat identification.FIG.5includes a number of process blocks510-540. Though arranged serially in theFIG.5example, in some embodiments, the process modules represented by the blocks may be reordered, one or more blocks may be omitted, and/or two or more blocks may be executed in parallel using multiple processors or using a single processor organized as two or more virtual machines or sub-processors. Moreover, still other embodiments may implement the blocks as one or more specific interconnected hardware or integrated circuit modules with related control and data signals communicated between and through the modules. Thus, any process flow is applicable to software, firmware, hardware, and hybrid implementations.

Referring toFIG.5, Real time curated data416input510includes detailed information about traffic, URL query command-line interface (CLI) audit, switched virtual circuit (SVC) provider logs, malware scanning results, user behavior analytics host-based IDS, Network-based IDS, security events thresholds, client connections, client responses to different types of server requests via different types of servers, compliance reporting, software management, and patch management. A weight process520applies a weight to each algorithm, e.g., wt1 is applied to kmean.

The variance process530calculates the variance by comparing output of the algorithm subject to the weight process520with known test data415according to the formula δ1=(Vβ−V1)2. A calculation engine process540calculates new weights to be applied as part of a closed loop system to get better predictive security threat identification. A status snapshot is recorded and managed on a per client basis at the application layer of the network protocol stack of the network. The recorded data may include databases that a client has read from and/or written to, and times and durations that a client has been connected to and in communication with a particular server, i.e., real time traffic. The snapshot of the calculation engine process540includes recommended changes in weights associated with each algorithm.

Referring again toFIG.4B, the new weights are applied to the model algorithm model421, variance analysis422is performed, and weight process520, variance process530calculation, and new weight calculation process540steps ofFIG.5are repeated until the combined variance analysis422is within a predetermined acceptable variance threshold423set by an organization, i.e., the recalculated variance is compared to a set threshold. This process results in a final weighted algorithm that has individual weights assigned or applied to various algorithms that are customized for each organization.

When new data is input510, the existing recommended weights are recalculated, and the final recommended combination is again evaluated. This process ensures that the recommended algorithm set is not static and keeps evolving as newer threats and better identification signature/algorithms become available.

FIG.6is an overview of various Anomaly-based IDS algorithms610that are used to create test data with known threats for testing models and algorithms according to embodiments of the present invention, such as those illustrated inFIG.4BandFIG.5. Statistics-based algorithms620may include Markov620,1, multivariant620,2, time series620,3, and univariate620,4. Cognition algorithms630may include finite state630,1, expert decision support system (DSS)630,2, and description scripts630,3. Machine input algorithms640may include Bayesian640,1, FuzzyLogic640,2, and outlier detection640,3.

As shown inFIG.7, one embodiment of the hardware and operating environment, in conjunction with which embodiments of the invention may be practiced, includes a general-purpose computing device in the form of a computer20(e.g., a personal computer, workstation, or server), including one or more processing units21, a system memory22, and a system bus23that operatively couples various system components including the system memory22to the processing unit21. There may be only one or there may be more than one processing unit21, such that the processor of computer20comprises a single central-processing unit (CPU), or a plurality of processing units, commonly referred to as a multiprocessor or parallel-processor environment. A multiprocessor system may include cloud computing environments. In various embodiments, computer20is a conventional computer, a distributed computer, or any other type of computer. The system shown inFIG.7is applicable to any server and/or remote client shown in the other Figures.

The system bus23may be any of several types of bus structures including a memory bus or memory controller, a peripheral bus, and a local bus using any of a variety of bus architectures. The system memory may also be referred to as simply the memory, and, in some embodiments, includes read-only memory (ROM)24and random-access memory (RAM)25. A basic input/output system (BIOS) program26, containing the basic routines that help to transfer information between elements within the computer20, such as during start-up, may be stored in ROM24. The computer20further includes a hard disk drive27for reading from and writing to a hard disk, not shown, a magnetic disk drive28for reading from or writing to a removable magnetic disk29, and an optical disk drive31for reading from or writing to a removable optical disk (not shown) such as a CD ROM or other optical media.

The hard disk drive27, magnetic disk drive28, and optical disk drive31(via an interface bus30) couple with a hard disk drive interface32, a magnetic disk drive interface33, and an optical disk drive interface34, respectively. The drives and their associated computer-readable media provide nonvolatile storage of computer-readable instructions, data structures, program modules and other data for the computer20. It should be appreciated by those skilled in the art that any type of computer-readable media which can store data that is accessible by a computer, such as magnetic cassettes, flash memory cards, digital video disks, Bernoulli cartridges, random access memories (RAMs), read only memories (ROMs), redundant arrays of independent disks (e.g., RAID storage devices) and the like, can be used in the exemplary operating environment.

A plurality of program modules may be stored on the hard disk27, magnetic disk29, optical disk (not shown), ROM24, or RAM25, including an operating system35, one or more application programs36, other program modules37, and program data38. A plug in containing a security transmission engine for the present invention may be resident on any one or number of these computer-readable media.

A user may enter commands and information into computer20through input devices such as a keyboard40and a pointing device42, e.g., a mouse. Other input devices (not shown) may include a microphone, joystick, game pad, satellite dish, scanner, or the like. These other input devices are often connected to the processing unit21through a serial port interface46that is coupled to the system bus23, but may be connected by other interfaces, such as a parallel port, game port, or a universal serial bus (USB). A monitor47or other type of display device may also be connected to the system bus23via an interface, such as a video adapter48. The monitor47may display a graphical user interface for the user. In addition to the monitor47, computers typically include other peripheral output devices (not shown), such as speakers and printers.

The computer20may operate in a networked environment using logical connections to one or more remote computers or servers, such as remote computer49. These logical connections are achieved by a communication device coupled to or a part of the computer20; the invention is not limited to a particular type of communications device. The remote computer49may be another computer, a server, a router, a network PC, a client, a peer device, or other common network node, and typically includes many or all the elements described above relative to the computer20, although only a memory storage device50has been illustrated. The logical connections depicted inFIG.7include a LAN51and/or a wide area network (WAN)52. Such networking environments are commonplace in office networks, enterprise-wide computer networks, intranets, and the internet, which are all types of networks.

When used in a LAN-networking environment, the computer20is connected to the LAN51through a network interface or adapter53, which is one type of communications device. In some embodiments, when used in a WAN-networking environment, the computer20typically includes a modem54(another type of communications device) or any other type of communications device, e.g., a wireless transceiver, for establishing communications over the wide-area network52, such as the internet. The modem54, which may be internal or external, is connected to the system bus23via the serial port interface46. In a networked environment, program modules depicted relative to the computer20may be stored in the remote memory storage medium or device50of remote computer or server49. It is appreciated that the network connections shown are exemplary and other means of, and communications devices for, establishing a communications link between the computers may be used including hybrid fiber-coax connections, T1-T3 lines, digital subscriber lines (DSL), optical carrier (OC)-3 and/or OC-12, Transmission Control Protocol/Internet Protocol (TCP/IP), microwave, wireless application protocol, and any other electronic media through any suitable switches, routers, outlets, and power lines, as the same are known and understood by one of ordinary skill in the art.

Moreover, those skilled in the art will appreciate that the invention may be practiced with other computer system configurations, including hand-held devices, multiprocessor systems, microprocessor-based or programmable consumer electronics, network PCS, minicomputers, mainframe computers, and the like. The invention may also be practiced in distributed computer environments where tasks are performed by input (I)/output (O) remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be in both local and remote memory storage devices, i.e., computer storage mediums.