System and method for assessing cybersecurity awareness

Patent metadata

Field	Value
Publication number	US-10454958-B2
Application number	US-201615291331-A
Country	US
Kind code	B2
Filing date	Oct 12, 2016
Priority date	Oct 12, 2015
Publication date	Oct 22, 2019
Grant date	Oct 22, 2019

Abstract

Described embodiments include a system that includes a monitoring agent, configured to automatically monitor usage of a computing device by a user, and a processor. The processor is configured to compute, based on the monitoring, a score indicative of a cyber-security awareness of the user, and to generate an output indicative of the score.

First claim

The invention claimed is:

1. A system, comprising:
a monitoring agent, configured to automatically monitor usage of a computing device by a user; and
a processor, configured:
to receive an input that includes a type of cyber-security attack,
to compute a characteristic vector of coefficients, each of which quantifies competence of the user in a different one of a plurality of cyber-security areas based on the monitored usage of the computing device by the user;
to compute, based on the monitoring, a score indicative of a cyber-security awareness of the user with respect to the type of attack, wherein the score is computed based on the characteristic vector of coefficients and respective weightings of each of the coefficients with respect to type of attack, wherein each of the respective weightings quantifies importance of a corresponding coefficient and a corresponding cyber-security area for the type of attack; and
to generate an output indicative of the score.

2. The system according to claim 1 , wherein the monitoring agent comprises a network probe configured to monitor the usage of the computing device by monitoring network traffic exchanged with the computing device.

3. The system according to claim 1 , wherein the monitoring agent comprises a software agent installed on the computing device.

4. The system according to claim 1 , wherein the processor is configured to compute the score by:
recommending a simulated cyber-security attack, and
computing the score, based on a response of the user to the simulated attack.

5. The system according to claim 1 , wherein the processor is configured to compute the score by computing, using the weightings, a weighted sum of the coefficients.

6. The system according to claim 1 , wherein the processor is configured to use a machine-learned model to compute the characteristic vector of coefficients.

7. A method, comprising:
receiving an input that includes a type of cyber-security attack;
using a monitoring agent, automatically monitoring usage of a computing device by a user;
computing a characteristic vector of coefficients, each of which quantifies competence of the user in a different one of a plurality of cyber-security areas based on the monitored usage of the computing device by the user;
based on the monitoring, computing a score indicative of a cyber-security awareness of the user with respect to a type of attach, wherein the score is computed based on the characteristic vector of coefficients and respective weightings of each of the coefficients with respect to the type of attack, wherein each of the respective weightings quantifies importance of a corresponding coefficient and a corresponding cyber-security area for the type of attack; and
generating an output indicative of the score.

8. The method according to claim 7 , wherein monitoring the usage of the computing device comprises monitoring the usage of the computing device by monitoring network traffic exchanged with the computing device.

9. The method according to claim 7 , wherein the monitoring agent includes a software agent installed on the computing device.

10. The method according to claim 7 , wherein computing the score comprises:
recommending a simulated cyber-security attack, and
computing the score, based on a response of the user to the simulated attack.

11. The method according to claim 7 , wherein computing the score comprises computing the score by computing, using the weightings, a weighted sum of the coefficients.

12. The method according to claim 7 , wherein computing the characteristic vector of coefficients comprises using a machine-learned model to compute the characteristic vector of coefficients.

13. The method according to claim 7 , wherein computing the characteristic vector of coefficients comprises computing the characteristic vector of coefficients by mapping a plurality of features, obtained from the monitoring, to the coefficients.

14. The method according to claim 13 , further comprising, prior to computing the characteristic vector:
using the monitoring agent, by monitoring at least one user, obtaining a first plurality of features,
by monitoring the at least one user using a monitoring technique that is not used by the monitoring agent, obtaining a second plurality of features, and
calibrating the mapping such that a characteristic vector of coefficients mapped from the first plurality of features is within a threshold of similarity of a characteristic vector of coefficients mapped from the second plurality of features.

15. The method according to claim 13 , further comprising, prior to computing the characteristic vector, calibrating the mapping, by:
using characteristic vectors of coefficients obtained from the mapping, computing respective scores, for a plurality of users, that indicate awareness of the users with respect to a particular type of cyber-security attack, and
checking a correlation between the scores and respective responses of the users to a simulated attack of the particular type.

Assignees

• Verint Systems Ltd
• B G Negev Tech And Applications Ltd

Inventors

• Shabtai Asaf
• Puzis Rami
• Rokach Lior
• Orevi Liran
• Malinsky Genady
• Katzir Ziv
• Bitton Ron

Classifications

• H04L63/1441 Primary

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/552 Primary

  involving long-term monitoring or reporting · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title