Systems and methods for AIDA based role models

Patent metadata

Field	Value
Publication number	US-11140199-B2
Application number	US-202017081123-A
Country	US
Kind code	B2
Filing date	Oct 27, 2020
Priority date	Dec 1, 2017
Publication date	Oct 5, 2021
Grant date	Oct 5, 2021

Abstract

The present disclosure describes systems and methods for using a model for a predetermined role for simulated phishing campaigns. A campaign controller communicates simulated phishing communications to one or more devices of a user using a model that the campaign controller selects from a plurality of models in a database that have been established for predetermined roles of a company. The model is selected based on one or more attributes of the user that are identified by the campaign controller. The campaign controller identifies one or more attributes of each user of a plurality of users for the simulated phishing campaign, and the campaign controller selects a respective model for each user based on the attributes of each user, wherein the models are not all the same for all of the users.

First claim

What is claimed is:

1. A method comprising:
identifying, by one or more processors, a role of a user based at least on one or more attributes of the user;
selecting, by the one or more processors based at least on the role of the user, a model among a plurality of models; each of the plurality of models comprising an artificial intelligence model corresponding to a respective role of a plurality of roles;
providing, by a controller configured on the one or more processors, information related to one or more simulated phishing communications of the user as input to the model;
receiving, by the controller, from the model an output identifying an action to take for simulated phishing of the user; and
taking, by the controller, the action identified from the output of the model.

2. The method of claim 1 , further comprising receiving, by the one or more processors, identification of the user and one or more attributes of the user.

3. The method of claim 1 , further comprising training, by the one or more processors, each of the plurality of models, with information related to simulated phishing communications associated with the respective role.

4. The method of claim 1 , further comprising taking, by the controller, the action comprising creating a simulated phishing communication based at least on information identified by the output of the model.

5. The method of claim 4 , further comprising communicating, by the controller, the simulated phishing communication to a device of the user.

6. The method of claim 1 , wherein each of the models corresponds to one of the plurality of roles for an industry, a demographic or an organization level in a company.

7. A system comprising:
one or more processors, coupled to memory and configured to:
identify a role of a user based at least on one or more attributes of the user;
select, based at least on the role of the user, a model among a plurality of models;
wherein each of the plurality of models comprises an artificial intelligence model that corresponds to a respective role of a plurality of roles; and
a controller configured on the one or more processors and configured to:
provide information related to one or more simulated phishing communications of the user as input to the model;
receive from the model an output identifying an action to take for simulated phishing of the user; and
take next action identified from the output of the model.

8. The system of claim 7 , wherein the one or more processors are further configured to receive identification of the user and one or more attributes of the user.

9. The system of claim 7 , wherein the one or more processors are further configured to train each of the plurality of models with information related to simulated phishing communications associated with the respective role.

10. The system of claim 7 , wherein the controller is further configured to take the action comprising creating a simulated phishing communication based at least on information identified by the output of the model.

11. The system of claim 10 , wherein the controller is further configured to communicate the simulated phishing communication to a device of the user.

12. The system of claim 7 , wherein each of the models corresponds to one of the plurality of roles for at least one of an industry, a demographic or an organization level in a company.

13. A system comprising:
one or more processors, coupled to memory:
a storage comprising a plurality of artificial intelligence models trained with simulated phishing communications associated with a respective role of a plurality of roles;
a controller, executable on the one or more processors and configured to:
select, based at least on a role of a user identified based at least one or more attributes of the user, an artificial intelligence model among plurality of artificial intelligence models for the user;
provide information related to one or more simulated phishing communications of the user as input to the artificial intelligence model;
receive from the artificial intelligence model an output identifying a simulated phishing communication to communicate to the user; and
communicate the simulated phishing communication to a device of the user.

14. The system of claim 13 , wherein each of the plurality of artificial intelligence models corresponds to one of the plurality of roles for at least one of an industry, a demographic or an organization level in a company.

15. The system of claim 13 , wherein the role comprises one of the following: an executive, a researcher, a human resources staff, an information technology staff or a chief security officer.

16. The system of claim 13 , wherein the simulated phishing communication comprises one of the following: an email, a text or short message service (SMS) message, a phone call or an Internet based communication.

17. The system of claim 13 , wherein output of the artificial intelligence model identifies content to use in the simulated phishing communication.

18. The system of claim 13 , wherein output of the artificial intelligence model identifies a type of communication to use for the simulated phishing communication.

Assignees

• Knowbe4 Inc

Inventors

• Irimie Alin
• Sjouwerman Stu
• Kras Greg
• Sites Eric

Classifications

• H04L67/535 Primary

  Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34) · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/1483 Primary

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title