Patent SG-11201710238Q-A (SG)
Title: Autonomic incident triage prioritization by performance modifier and temporal decay parameters
Inventor: LIM KENG LENG ALBERT
IPC: G06F21/50
Filed: 2017-06-29
Abstract: INTERNATIONAL APPLICATION PUBLISHED UNDER THE PATENT COOPERATION TREATY (PCT) (19) World Intellectual Property :::` , 111111111111111111111111111111111111111111111111111111111111111111111110111111 Organization International Bureau (10) International Publication Number 03 (43) International Publication Date ......\"' WO 2019/004928 Al 03 January 2019 (03.01.2019) W I P0 I P C T (51) International Patent Classification: (74) Agent: ALLEN & GLEDHILL LLP; One Marina Boule- GOOF 21/50 (2013.01) yard #28-00, Singapore 018989 (SG). (21) International Application Number: (81) Designated States (unless otherwise indicated, for every PCT/SG2017/050326 kind of national protection available): AE, AG, AL, AM, (22) International Filing Date: AO, AT, AU, AZ, BA, BB, BG, BH, BN, BR, BW, BY, BZ, 29 June 2017 (29.06.2017) CA, CH, CL, CN, CO, CR, CU, CZ, DE, DJ, DK, DM, DO, DZ, EC, EE, EG, ES, FI, GB, GD, GE, GH, GM, GT, HN, (25) Filing Language: English HR, HU, ID, IL, IN, IR, IS, JO, JP, KE, KG, KH, KN, KP, (26) Publication Language: English KR, KW, KZ, LA, LC, LK, LR, LS, LU, LY, MA, MD, ME, MG, MK, MN, MW, MX, MY, MZ, NA, NG, NI, NO, NZ, (71) Applicant: CERTIS CISCO SECURITY PTE LTD OM, PA, PE, PG, PH, PL, PT, QA, RO, RS, RU, RW, SA, [SG/SG]; 20 Jalan Afifi, Certis Cisco Centre, Singapore SC, SD, SE, SG, SK, SL, SM, ST, SV, SY, TH, TJ, TM, TN, 409179 (SG). TR, TT, TZ, UA, UG, US, UZ, VC, VN, ZA, ZM, ZW. (72) Inventor: LIM, Keng Leng Albert; c/o Certis Cisco Secu- (84) Designated States (unless otherwise indicated, for every rity PTE LTD, 20 Jalan Afifi, Certis Cisco Centre, Singa- kind of regional protection available): ARIPO (BW, GH, pore 409179 (SG). GM, KE, LR, LS, MW, MZ, NA, RW, SD, SL, ST, SZ, TZ, UG, ZM, ZW), Eurasian (AM, AZ, BY, KG, KZ, RU, TJ, (54) Title: AUTONOMIC INCIDENT TRIAGE PRIORITIZATION BY PERFORMANCE MODIFIER AND TEMPORAL DECAY PARAMETERS 100 A Client Systems 120 105 User defined Priority parameters listing Incident Review Incident Triage Module 115 Incidents Incident Detection System 110 Il FIGURE 1 GP (57) : A method for autonomic incident triage prioritization of incidents affecting a plurality of computer systems, the method e•1 performed by a computing module comprising receiving user defined parameters associated with each of the computer systems and 01 7 1. receiving asset parameters associated with each asset contained within each of the computer systems, receiving incidents affecting 0 assets of the computer systems, computing an incident asset score for each incident whereby the incident asset score for each incident © is computed using the asset parameters associated with each asset contained within each computer system, assigning incident severity --.... 01 values to each of the received incidents; computing incident severity scores for each of the received incidents based on the incident 1-1 © severity value of the incident and the incident asset score of the incident, generating a prioritized incident list based on the incident ei severity scores of the received incidents and providing the prioritized incident list to intelligence analysts. o [Continued on next page] WO 2019/004928 Al O II TM), European (AL, AT, BE, BG, CH, CY, CZ, DE, DK, EE, ES, FI, FR, GB, GR, HR, HU, IE, IS, IT, LT, LU, LV, MC, MK, MT, NL, NO, PL, PT, RO, RS, SE, SI, TR), OAPI (BF, BJ, CF, CG, CI, CM, GA, GN, SK, SM, GQ, GW, KM, ML, MR, NE, SN, TD, TG). Published: — with international search report (Art. 21(3))