SYSTEM AND METHOD OF ADVANCED EVENT RANKING AND CORRELATION FOR THREAT DETECTION
개요
발명자
Filip Olszak; Serg Bell; Stanislav Protasov
IPC 분류
CPC 분류
Systems and methods for advanced event ranking and correlation for threat detection. A method includes real-time processing of events with stateful threat detection, combining immediate detection capabilities with sophisticated threat analysis. A method further includes multi-stage processing in a detection engine, where generic events from endpoint detection and response (EDR) agents are scored and enriched to provide extended context based on machine learning models for event scoring, enriched events correlation, and applying security rules to detect threats.
원문 (중국어)
Systems and methods for advanced event ranking and correlation for threat detection. A method includes real-time processing of events with stateful threat detection, combining immediate detection capabilities with sophisticated threat analysis. A method further includes multi-stage processing in a detection engine, where generic events from endpoint detection and response (EDR) agents are scored and enriched to provide extended context based on machine learning models for event scoring, enriched events correlation, and applying security rules to detect threats.