SYSTEM AND METHOD OF ADVANCED EVENT RANKING AND CORRELATION FOR THREAT DETECTION
卷宗概要
发明人
Filip Olszak; Serg Bell; Stanislav Protasov
IPC 分类
CPC 分类
Systems and methods for advanced event ranking and correlation for threat detection. A method includes real-time processing of events with stateful threat detection, combining immediate detection capabilities with sophisticated threat analysis. A method further includes multi-stage processing in a detection engine, where generic events from endpoint detection and response (EDR) agents are scored and enriched to provide extended context based on machine learning models for event scoring, enriched events correlation, and applying security rules to detect threats.
原文（中文）
Systems and methods for advanced event ranking and correlation for threat detection. A method includes real-time processing of events with stateful threat detection, combining immediate detection capabilities with sophisticated threat analysis. A method further includes multi-stage processing in a detection engine, where generic events from endpoint detection and response (EDR) agents are scored and enriched to provide extended context based on machine learning models for event scoring, enriched events correlation, and applying security rules to detect threats.