Patent application EP18210674A (EP), filed 2018-12-06
Publication number: EP3512176A1
Title: ANTICIPATORY CYBER DEFENSE
Abstract: According to various examples, techniques for anticipatory cyber defense are disclosed. The techniques includes receiving cyber incident reports, extracting keywords from the reports, applying a shallow machine learning technique to obtain an identification of a first subset of the networked assets vulnerable to at least a first threat scenario and an identification of the first threat scenario, applying a deep machine learning technique to at least the first subset, the first threat scenario, the keywords, and the plurality of networked assets, to obtain a second subset of the networked assets vulnerable to at least a second threat scenario and the second threat scenario, simulating the networked assets and the second threat scenario to identify at least one path through the networked assets vulnerable to at least a third threat scenario, and outputting an identification of the at least one path and an identification of the third threat scenario.
IPC codes: G06N  20/    00            A I
G06F  21/    55            A I
G06F  21/    57            A I
H04L  29/    06            A I
G06N  20/    20            A I
Claims: number: 1
text: A computer-implemented method of anticipatory cyber defense of a plurality of networked assets (200), the method comprising:
number: 2
text: The method of claim 1, further comprising:
number: 3
text: The method of claim 1 or 2, further comprising taking remedial measures against at least the third threat scenario and, optionally, wherein the remedial measures comprise at least one of: installing at least one security measure, closing at least one port, turning off at least one asset, or disconnecting at least one asset.
number: 4
text: The method of any of claims 1-3, wherein the shallow machine learning technique comprises a nearest neighbor technique.
number: 5
text: The method of any of claims 1-4, wherein the deep machine learning technique comprises a neural network technique, an association rule mining technique, or a word embedding technique.
number: 6
text: The method of any of claims 1-5, wherein the simulating is performed by a discrete event simulation (DES) engine (704).
number: 7
text: The method of any of claims 1-6, further comprising limiting a number of paths identified by the simulating and, optionally, wherein the limiting comprises at least one of: pruning a number of paths identified by the simulating, or limiting a number of levels in the deep machine learning technique.
number: 8
text: The method of any of claims 1 to 7, wherein the extracting keywords from the plurality of cyber incident reports further comprises extracting keywords from the plurality of cyber incident reports, from at least one historical anomaly database, from at least one threat scenario database, and from an asset database.
number: 9
text: A system (1200) for anticipatory cyber defense of a plurality of networked assets (200), the system comprising at least one electronic processor configured to perform:
number: 10
text: The system of claim 9, wherein the at least one electronic processor is further configured to take remedial measures against at least the third threat scenario and, optionally, wherein the remedial measures comprise at least one of: installing at least one security measure, closing at least one port, turning off at least one asset, or disconnecting at least one asset.
number: 11
text: The system of claim 9 or 10, wherein the shallow machine learning technique comprises a nearest neighbor technique.
number: 12
text: The system of any of claims 9-11, wherein the deep machine learning technique comprises a neural network technique, an association rule mining technique, or a word embedding technique.
number: 13
text: The system of any of claims 9-12, wherein the simulating is performed by a discrete event simulation (DES) engine (704).
number: 14
text: The system of any of claims 9-13, wherein the at least one electronic processor is further configured to limit a number of paths identified by the simulating and, optionally, wherein the limiting by at least one electronic processor comprises at least one of: pruning a number of paths identified by the simulating, or limiting a number of levels in the deep machine learning technique.
number: 15
text: The system of any of claims 9-14, wherein the extracting keywords from the plurality of cyber incident reports further comprises extracting keywords from the plurality of cyber incident reports, from at least one historical anomaly database, from at least one threat scenario database, and from an asset database.
Office action: search_report, dated 2019-07-17
Rejection reasons: novelty_epc_54
Prior art cited: ref_id: EP3151153A1
ref_type: patent
severity: background
ref_id: - HATCHER WILLIAM GRANT ET AL: "A Survey of Deep Learning: Platforms, Applications and Emerging Research Trends", IEEE ACCESS, vol. 6, pages 24411 - 24432, XP011684251, DOI: 10.1109/ACCESS.2018.2830661
ref_type: npl
severity: background
ref_id: US2017228658A1
ref_type: patent
severity: background
ref_id: US2017346839A1
ref_type: patent
severity: background
ref_id: US2017026391A1
ref_type: patent
severity: background
ref_id: US2017026391
ref_type: patent
severity: background
ref_id: US2017228658
ref_type: patent
severity: novelty_destroying
ref_id: US2017346839
ref_type: patent
severity: background
Final disposition: pending (2019-07-17)