STANDARD METADATA MODEL FOR ANALYZING EVENTS WITH FRAUD, ATTACK, OR ANY OTHER MALICIOUS BACKGROUND

    公开(公告)号:US20170134408A1

    公开(公告)日:2017-05-11

    申请号:US14937794

    申请日:2015-11-10

    Applicant: SAP SE

    Inventor: Kathrin Nos

    CPC classification number: H04L63/1416 G06F21/554 H04L63/1425

    Abstract: A standard metadata model for analyzing events with fraud, attack or other malicious background is disclosed. Log data for two or more computing systems is stored, and mapped to standardized attributes based on metadata entities defined for each computing system. A standard metadata model is defined for the computing systems, in which one or more standardized attributes of a first set of computing systems is associated with one or more standardized attributes of a second set of computing systems to define connected metadata that connects attributes of the associated metadata entities.

    Anomaly detection in enterprise threat detection

    公开(公告)号:US10552605B2

    公开(公告)日:2020-02-04

    申请号:US15382056

    申请日:2016-12-16

    Applicant: SAP SE

    Abstract: A selection of data types is defined from available log data for an evaluation of events associated with an entity. One or more evaluations associated with the entity are defined and reference data is generated from the selection of data types based on the one or more defined evaluations. The one or more evaluations are grouped into a pattern. A three dimensional (3D) score diversity diagram visualization is initialized for display in a graphical user interface, where a point representing the entity in the visualization is localized in 3D space at a coordinate based on two-dimensional (2D) coordinates in a 2D coordinate system of a centroid of the calculated area of a polygon placed to into the 2D coordinate system and defined by the values of each evaluation associated with the entity.

    ALERTS BASED ON ENTITIES IN SECURITY INFORMATION AND EVENT MANAGEMENT PRODUCTS

    公开(公告)号:US20180157835A1

    公开(公告)日:2018-06-07

    申请号:US15370084

    申请日:2016-12-06

    Applicant: SAP SE

    Inventor: Kathrin Nos

    Abstract: An enterprise threat detection (ETD) pattern is executed against received log event data from one or more computing systems. Using the ETD pattern, an event threshold is determined to have been exceeded. Entities associated with an alert created based on the exceeded threshold are determined and, at runtime, a severity value is calculated for each determined entity associated with the alert. A selection is received of a determined entity on which to perform mitigation action activities. Mitigation action activities associated with the determined entity are written into an activity record data record. A mitigation action activity is closed on the determined entity and a determination performed that all mitigation action activities associated with all entities related to the created alert have been closed. The created alert is closed.

Patent Agency Ranking