Patent SG-11201809495Q-A (SG)
Title: Parallelism and n-tiering of knowledge inference and statistical correlation system
Inventor: LIM ALBERT KENG LENG
IPC: H04L29/00
Filed: 2016-05-04
Abstract: INTERNATIONAL APPLICATION PUBLISHED UNDER THE PATENT COOPERATION TREATY (PCT) (19) World Intellectual Property --,' 1#11101111011101010111110101111101110111110111101101110110 MI MI OE lil Organization International Bureau (10) International Publication Number 1 (43) International Publication Date .....•• WO 2017/192099 Al 09 November 2017 (09.11.2017) W I P0 I P C T (51) (21) (22) (25) Filing Language: (26) (71) (72) International Patent Classification: (74) Agent: FOO, Chee Hiong, Ricky et al.; Marks & Clerk GOOF 21/50 (2013.01) HO4L 29/00 (2006.01) Singapore LLP, Tanjong Pagar, P 0 Box 636, Singapore International Application Number: 910816 (SG). PCT/SG2016/050206 (81) Designated States (unless otherwise indicated, for every International Filing Date: kind of national protection available): AE, AG, AL, AM, 04 May 2016 (04.05.2016) AO, AT, AU, AZ, BA, BB, BG, BH, BN, BR, BW, BY, BZ, CA, CH, CL, CN, CO, CR, CU, CZ, DE, DK, DM, DO, DZ, English EC, EE, EG, ES, FI, GB, GD, GE, GH, GM, GT, HN, HR, Publication Language: English HU, ID, IL, IN, IR, IS, JP, KE, KG, KN, KP, KR, KZ, LA, LC, LK, LR, LS, LU, LY, MA, MD, ME, MG, MK, MN, Applicant: CERTIS CISCO SECURITY PTE LTD MW, MX, MY, MZ, NA, NG, NI, NO, NZ, OM, PA, PE, [SG/SG]; 20 Jalan Afifi, Certis CISCO Centre, Singapore PG, PH, PL, PT, QA, RO, RS, RU, RW, SA, SC, SD, SE, 409179 (SG). SG, SK, SL, SM, ST, SV, SY, TH, TJ, TM, TN, TR, TT, TZ, UA, UG, US, UZ, VC, VN, ZA, ZM, ZW. Inventor: LIM, Albert Keng Leng; c/o Certis CISCO Se- curity Pte Ltd, 20 Jalan Afifi, Certis CISCO Centre, Singa- (84) Designated States (unless otherwise indicated, for every pore 409179 (SG). kind of regional protection available): ARIPO (BW, GH, GM, KE, LR, LS, MW, MZ, NA, RW, SD, SL, ST, SZ, TZ, UG, ZM, ZW), Eurasian (AM, AZ, BY, KG, KZ, RU, TJ, Title: PARALLELISM AND N-TIERING OF KNOWLEDGE INFERENCE AND STATISTICAL CORRELATION SYSTEM 100 (54) MONITORING DEVICES 1,—,,, 104 / --. \ I - - N = --- I ''' •—• _________________________ — -- 108b 1 102 I C/E #5 I/O SYSTEM 1 1 1 1 1 1 I I C/E #2 1 I 114b I I/E #1 1 Handoff 1 ----, I/E #3 I 106a I C/E #1 112a / 110a / / 106b i 112b I/E #4 1 CIE #4 \\ Handoff I \ I \ \ 114a I \ 110b / C/E #3 \\\ I/E #2 I/E #5 108a / / FIG. 1 •----___ , : An n-tiering security threat inference and correlation apparatus (100) for monitoring and anticipating cyber attacks is The apparatus comprises a plurality of groups of inference-correlation systems (106(a, b)-1 14(a, b)), each group arranged at least one inference system and at least one associated correlation system configured to monitor at least one network; and an (I/O) system (102) configured to receive security events, and broadcast the received security events to the plurality of of inference-correlation systems; wherein the respective groups of inference-correlation systems are configured to process only broadcasted security events relevant to the respective networks to identify the cyber attacks. A method of operating the apparatus also disclosed. © disclosed. 01 input/output — Il & (57) N with 1-1 -...... groups 1 r - the 1-1 © is ei C [Continued on next page] WO 2017/192099 Al MIDEDIMOMMIDIRMEMOMMEIDIONEHOMEMOIMIE TM), European (AL, AT, BE, BG, CH, CY, CZ, DE, DK, EE, ES, FI, FR, GB, GR, HR, HU, IE, IS, IT, LT, LU, LV, MC, MK, MT, NL, NO, PL, PT, RO, RS, SE, SI, SK, SM, TR), OAPI (BF, BJ, CF, CG, CI, CM, GA, GN, GQ, GW, KM, ML, MR, NE, SN, TD, TG). Declarations under Rule 4.17: — of inventorship (Rule 4.17(iv)) Published: — with international search report (Art. 21(3))