Systems and methods for determining individual and group risk scores

Patent metadata

Field	Value
Publication number	US-10673876-B2
Application number	US-201916413021-A
Country	US
Kind code	B2
Filing date	May 15, 2019
Priority date	May 16, 2018
Publication date	Jun 2, 2020
Grant date	Jun 2, 2020

Abstract

Embodiments disclosed herein describe a server, for example a security awareness server or an artificial intelligence machine learning system that establishes a risk score or vulnerable for a user of a security awareness system, or for a group of users of a security awareness system. The server may create a frequency score for a user, which predicts the frequency at which the user is to be hit with a malicious attack. The frequency score may be based on at least a job score, which may be represented by a value that is based on the type of job the user has, and a breach score that may be represented by a value that is based on the user's level of exposure to email.

First claim

We claim:

1. A method comprising:
(a) determining, by one or more servers, a frequency score to predict a frequency at which a user is to be hit with a malicious attack;
(b) determining, by the one or more servers, a propensity score that identifies a propensity of the user to respond to the hit of the malicious attack;
(c) determining, by the one or more servers, a severity score that identifies a severity of the user's response to the hit of the malicious attack;
(d) establishing, by the one or more servers, a risk score for the user, the risk score established as a function of the frequency score, the severity score and the propensity score, wherein the function comprises one of a weighted or logarithmic function; and
(e) displaying, by the one or more servers based at least on the risk score, a probability that the user will respond to a subsequent hit of a type of malicious attack at a point in time.

2. The method of claim 1 , wherein (a) further comprise determining the frequency score based at least on a job score and a breach score.

3. The method of claim 2 , wherein the job score comprises a value identified based on a type of job.

4. The method of claim 2 , wherein the breach score comprises a value identified based on the user's level of exposure to email.

5. The method of claim 1 , wherein (b) further comprises determining the propensity score based at least on training a predictive model with an input of the user history of whether or not the user responded with a type of response for a given hit of the malicious attack.

6. The method of claim 1 , wherein (c) further comprises determining the severity score based at least on a job score.

7. The method of claim 1 , wherein (c) further comprises determining the severity score based at least on individual access of the user.

8. The method of claim 1 , further comprising establishing a group risk score based on a function of risk scores of each user within the group.

9. A system comprising:
one or more servers comprising one or more processors and configured to:
determine a frequency score to predict a frequency at which a user is to be hit with a malicious attack;
determine a propensity score that identifies a propensity of the user to respond to the hit of the malicious attack;
determine a severity score that identifies a severity of the user's response to the hit of the malicious attack;
establish a risk score for the user, the risk score established as a function of the frequency score, the severity score and the propensity score, wherein the function comprises one of a weighted or logarithmic function; and
display, based at least on the risk score, a probability that the user will respond to a subsequent hit of a type of malicious attack at a point in time.

10. The system of claim 9 , wherein the one or more servers are further configured to determine the frequency score based at least on a job score and a breach score.

11. The system of claim 10 , wherein the job score comprises a value identified based on a type of job.

12. The system of claim 10 , wherein the breach score comprises a value identified based on the user's level of exposure to email.

13. The system of claim 9 , wherein the one or more servers are further configured to determine the propensity score based at least on training a predictive model with an input of the user history of whether or not the user responded with a type of response for a given hit of the malicious attack.

14. The system of claim 9 , wherein the one or more servers are further configured to determine the severity score based at least on a job score.

15. The system of claim 9 , wherein the one or more servers are further configured to determine the severity score based at least on individual access of the user.

16. The system of claim 9 , wherein the one or more servers are further configured to establish a group risk score based on a function of risk scores of each user within the group.

Assignees

• Knowbe4 Inc

Inventors

• Sites Eric
• Kras Greg
• Irimie Alin
• Sjouwerman Stu
• Castilho Marcio
• Martens Siegfried
• Bonabeau Eric
• Kime Kristian

Classifications

• H04L63/14

  for detecting or protecting against malicious traffic · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/1408 Primary

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title