/Patent Tracker
GoogleGranted patentSecurity & privacyInterest 6/10

Google patents method to link cyberattacks to specific hacker groups

The filing describes a computer system that groups different cyberattacks together to identify which hacker group is responsible. It uses a machine-learned model to compare details from various attacks and creates a list of incidents likely caused by the same actor.

Why it mattersThis helps security teams connect separate hacking incidents to the same source, making it easier to track and defend against organized cybercriminals.

In the filing’s own words

A computerized method for associating cyberthreat actor groups responsible for different cyberthreats is described. The method involves generating a similarity matrix based on content from received clusters of cybersecurity information. Each received cluster of cybersecurity information is assumed to be associated with a cyberthreat. The similarity matrix is composed via an optimized equation combining separate similarity metrics, where each similarity metric of the plurality of similarity metrics represents a level of correlation between at least two clusters of cybersecurity information, with respect to a particular aspect of operations described in the clusters. The method further involves that, in response to queries directed to the similarity matrix, generating a listing of a subset of the clusters of cybersecurity information having a greater likelihood of being associated with cyberthreats caused by the same cyberthreat actor group.

What exactly they claim (claim 1)

1. A computerized method for associating cyberthreat actor groups responsible for different cyberthreats, comprising: receiving, by a computing system comprising one or more computing devices, a plurality of clusters of cybersecurity information respectively associated with a plurality of cyberthreats, wherein the cybersecurity information comprises a profile associated with at least a first cluster of the plurality of clusters; generating, by the computing system, a plurality of feature vectors respectively for the plurality of clusters of cybersecurity information; processing, by the computing system, the plurality of feature vectors with a machine-learned model to generate one or more similarity metrics, wherein each of the one or more similarity metrics describes a similarity between the first cluster and at least one additional cluster of the plurality of clusters of cybersecurity information; associating, by the computing system, at least the first cluster of the clusters of cybersecurity information with a particular cyberthreat actor group based at least in part on the one or more similarity metrics; and updating, by the computing system, based on associating the first cluster with the particular cyberthreat actor group, the profile associated with the first cluster to include one or more characteristics associated with the first cluster.

Facts

Company
Google (Google LLC)
Official title
System and method for automatically associating cybersecurity intelligence to cyberthreat actors
Patent number
US12726492B2
Application number
18757257
Filed
Jun 27, 2024
Granted
Sep 1, 2026
Inventors
2
Claims
20

Classified under

H04L 63/1416 Electricity & electronicsG06F 18/213 Physics & computingG06N 20/00 Physics & computingH04L 63/102 Electricity & electronicsH04L 63/1441 Electricity & electronics
Read the full filing (official PDF) ↗ Open in the Patent Tracker

More from Google in Security & privacy

Summaries are simplified from the filing’s own abstract and first claim. A patent filing is not a product announcement.
Patent data and drawings: U.S. Patent and Trademark Office (USPTO). Nebula is not affiliated with or endorsed by the USPTO.