PATENT CLAIM ANALYSIS

Application Number: 16186200
Application Type: Utility
Filing Date: 2018-11
Publication Date: 2019-03
Patent Classification: ["726", "023000"]

Abstract:
A threat response platform to act as a bridge between non-inline security programs and inline security programs. The threat response platform receives event reports, relating to client devices, from the non-inline security programs and creates incident reports for a user. The incident reports describe the event report and also additional data gathered by an active correlation system of the threat response platform. The active correlation system automatically gathers various types of data that are potentially useful to a user in determining whether the reported event is an incidence of malware operating on the client device or a false positive. The active correlation system places a temporary agent on the client device to identify indications of compromise.

Claim (Index 11):
A system for threat detection and response, the system comprising:\n a processor; a non-transitory computer-readable medium; and stored instructions translatable by the processor for:\n receiving, from a threat detector running on a client computer in an enterprise computing network, an event report identifying a suspicious network communication between the client computer and a network device; \n automatically remotely activating a data collector on the client computer, the data collector configured for searching potential indications of compromise (IOCs) on the client computer and sending data identifying the potential IOCs to the system for evaluation; \n receiving, from the data collector, the data identifying the potential IOCs on the client computer; \n comparing the potential IOCs on the client computer and IOCs in a database local to the system; \n based at least in part on the comparing, determining whether the potential IOCs on the client computer indicate evidence of malware on the client computer; and \n responsive to the evidence of malware on the client computer, sending an instruction to configure a firewall in the enterprise computing network.

Metadata:
- Claim Count in Document: 50.0
- Percentile: 98.0
- Lexical Diversity: 1.78261
- Patent Class: 726.0
- Transitional Phrase Type: open
- Component Type: 1
- Foreign Priority: False
- Related Applications: ['16186191', '14079565', '13973027', '15215468', '14466898']

Analysis Scores:
- 35 USC 101 Eligibility (BERT): 0.3007348904345424
- 35 USC 102 Novelty (BERT): 0.5780463366219544
- Combined Prediction Score: 0.3284660350532836
- Mean Citation Score: 307.45418000000006
- Max Citation Score: 477.6733
- Similarity Product: 450.92949154357314

Labels:
- Claim Label 101: 1
- Claim Label 102: 1
- Claim Label 103: 0
- Claim Label 112: 1
- Combined Label: 1
- Label 101 Adjusted: 1

Dataset: test