Patent SG-11201710236R-A (SG)
Title: Quantitative unified analytic neural networks
Inventor: LIM KENG LENG ALBERT
IPC: G06F21/55
Filed: 2016-10-24
Abstract: INTERNATIONAL APPLICATION PUBLISHED UNDER (19) World Intellectual Property : 7 --- - ` , Organization International Bureau 03 (43) International Publication Date wee\" 03 May 2018 (03.05.2018) W I P0 I P C T ID THE Hit (10) PATENT 1111111111111E WO International COOPERATION 2018/080392 Publication 111111111111111111111111111111111111111111111111111111111 TREATY Number Al (PCT) (51) International Patent Classification: (74) Agent: ALLEN & GLEDHILL LLP; One Marina Boule- GOOF 21/50 (2013.01) GOOF 21/55 (2013.01) yard #28-00, Singapore 018989 (SG). (21) International Application Number: (81) Designated States (unless otherwise indicated, for every PCT/SG2016/050515 kind of national protection available): AE, AG, AL, AM, (22) International Filing Date: AO, AT, AU, AZ, BA, BB, BG, BH, BN, BR, BW, BY, BZ, 24 October 2016 (24.10.2016) CA, CH, CL, CN, CO, CR, CU, CZ, DE, DJ, DK, DM, DO, DZ, EC, EE, EG, ES, FI, GB, GD, GE, GH, GM, GT, HN, (25) Filing Language: English HR, HU, ID, IL, IN, IR, IS, JP, KE, KG, KN, KP, KR, KW, (26) Publication Language: English KZ, LA, LC, LK, LR, LS, LU, LY, MA, MD, ME, MG, MK, MN, MW, MX, MY, MZ, NA, NG, NI, NO, NZ, OM, PA, (71) Applicant: CERTIS CISCO SECURITY PTE LTD PE, PG, PH, PL, PT, QA, RO, RS, RU, RW, SA, SC, SD, [SG/SG]; 20 Jalan Afifi, Certis Cisco Centre, Singapore SE, SG, SK, SL, SM, ST, SV, SY, TH, TJ, TM, TN, TR, TT, 409179 (SG). TZ, UA, UG, US, UZ, VC, VN, ZA, ZM, ZW. (72) Inventor: LIM, Keng Leng Albert; c/o Certis Cisco Secu- (84) Designated States (unless otherwise indicated, for every rity Pte Ltd, 20 Jalan Afifi, Certis Cisco Centre, Singapore kind of regional protection available): ARIPO (BW, GH, 409179 (SG). GM, KE, LR, LS, MW, MZ, NA, RW, SD, SL, ST, SZ, TZ, UG, ZM, ZW), Eurasian (AM, AZ, BY, KG, KZ, RU, TJ, _ (54) Title: QUANTITATIVE UNIFIED ANALYTIC NEURAL NETWORKS = _ ---- -, — _ Database 105 = = // / \ Internet t ._.____., 150 = = = = — — 110 = SIEM / SOC 112 UBA 114 Threat Streams 116 VPN 118 Vendors 120 — = = = _ _ / \ — 130 _. = Firewalls 132 Switches 134 Operating Systems Devices 138 IDS / IDP 140 — — 136 — = — FIGURE 1 Il .4t (57) : A method for quantitative unified analysis of unstructured threat intelligence data, the method to be performed by a ei computer system comprising: receiving unstructured threat intelligence data from molecular level sources, wherein the unstructured threat intelligence data comprises security events generated from the molecular level sources; uniting the received unstructured threat en c:::, intelligence data by translating the received threat intelligence data into a uniformed meta-foiinat and storing the translated data in a GC database, wherein each translated data includes at least a time component; determining isolated data points from the translated data 0 -,..„ stored in the database by grouping the translated data into groups, wherein each group represents a unique time period, and applying GC unsupervised machine learning techniques to each group of the translated data; determining data outliers from the isolated data points; 1-1 o and generating a learned function using the data outliers. ei C [Continued on next page] WO 2018/080392 Al MIDEDIMOMOIDEIREEMOOMMMOIMIUMBHOIS TM), European (AL, AT, BE, BG, CH, CY, CZ, DE, DK, EE, ES, FI, FR, GB, GR, HR, HU, IE, IS, IT, LT, LU, LV, MC, MK, MT, NL, NO, PL, PT, RO, RS, SE, SI, TR), OAPI (BF, BJ, CF, CG, CI, CM, GA, GN, SK, GQ, SM, GW, KM, ML, MR, NE, SN, TD, TG). Published: — with international search report (Art. 21(3))