PATENT CLAIM ANALYSIS

Application Number: 16131894
Application Type: Utility
Filing Date: 2018-09
Publication Date: 2019-01
Patent Classification: ["726", "023000"]

Abstract:
A security system and method secures and responds to security threats in a computer having a CPU, a Kernel/OS, and software applications. A data collector intercepts a selection of first tier calls between the CPU and Kernel/OS and/or second tier calls between the Kernel/Operating System and the applications, and stores information pertaining thereof. An Analytic Engine maps the stored first and second tier call information to a rulebase containing patterns of security threats, to generate a threat analysis, and then responds to the threat analysis. The Analytic Engine enlarges or contracts the selection of first and second tier calls to increase or decrease specificity of the threat analysis. A Management Module generates user interfaces accessible remotely by a user device, to update the rulebase and configure the collector, the Kernel module, and the Analytic Engine.

Claim (Index 1):
A security system for securing and responding to security threats in a computer having a Central Processing Unit (CPU), a Kernel/Operating System, and a plurality of software applications, the system including:\n a data collector module in the form of a hypervisor and/or kernel module implemented with the CPU, configured to intermediate a predetermined selection of first tier calls between the CPU and the Kernel/Operating System and/or second tier calls between the Kernel/Operating System and the applications, and to store information pertaining to the intermediated first tier calls (first tier call IDs) and/or to the intermediated second tier calls (second tier call IDs) in a data store, the data collector module being configurable in real-time to selectively enlarge or contract the predetermined selection of first tier calls; an Analytic Engine, implemented in user space of the computer, configured to aggregate and map the stored first tier call IDs and/or second tier call IDs to a machine learning (ML) Model to generate a threat analysis, the ML Model including patterns of first tier call IDs associated with identifiable security threats; the Analytic Engine being configured to selectively enlarge or contract the predetermined selection of first tier calls and/or second tier calls to respectively increase or decrease specificity of said threat analysis; the Analytic Engine being further configured to implement one or more of a plurality of responsive actions in response to said threat analysis; and a Management Module communicably coupled to the ML Model and/or to the kernel module, the collector module, and the Analytic Engine, the Management Module configured to generate a plurality of user interfaces accessible by a user computer communicably couplable to the system, the user interfaces configured to enable a user to update the ML Model and configure the collector module and the Analytic Engine.

Metadata:
- Claim Count in Document: 4.0
- Percentile: 97.0
- Lexical Diversity: 2.11429
- Patent Class: 726.0
- Transitional Phrase Type: none
- Component Type: 0
- Foreign Priority: False
- Related Applications: ['15853795', '14670721', '15404693', '12983897', '15404434']

Analysis Scores:
- 35 USC 101 Eligibility (BERT): 0.2765035112287878
- 35 USC 102 Novelty (BERT): 0.6064000202948482
- Combined Prediction Score: 0.3094931621353938
- Mean Citation Score: 321.6056640000001
- Max Citation Score: 553.2133
- Similarity Product: 460.26437424983976

Labels:
- Claim Label 101: 1
- Claim Label 102: 1
- Claim Label 103: 1
- Claim Label 112: 1
- Combined Label: 1
- Label 101 Adjusted: 1

Dataset: test