Systems and methods for third party risk assessment

Patent metadata

Field	Value
Publication number	US-11336673-B2
Application number	US-201916407719-A
Country	US
Kind code	B2
Filing date	May 9, 2019
Priority date	May 9, 2018
Publication date	May 17, 2022
Grant date	May 17, 2022

Abstract

Embodiments for systems and methods for third party assessment related to the evaluation of risks associated with third parties in which hacker conversations on websites are filtered and analyzed using keywords as input to uncover relevant forum and marketplace discussions are disclosed herein.

First claim

What is claimed is:

1. A method for generating data defining a third party risk assessment, comprising;
configuring a computing device with instructions for executing operations comprising:
accessing input data related to a third party, wherein the input data includes a set of keywords relevant to the third party;
filtering conversation data from a website to select portions of the conversation data which include at least one of the set of keywords relevant to the third party;
detecting anomalies in the conversation data that indicate a spike in discussions relevant to the third party; and
generating a third party risk assessment for the third party based on the anomalies in the conversation data.

2. The method of claim 1 , wherein the input data related to the third party includes a name of the third party, a location of the third party, a type of service offered by the third party, and a type of product offered by the third party.

3. The method of claim 1 , wherein the third party is a supplier, a vendor, a customer, a joint venture, or an external organization.

4. The method of claim 1 , wherein the anomalies in the conversation data are computed using a moving average, differences in a plurality of topics discussed in an industry vertical, and a collection of new keywords not previously present in the input data over a time interval.

5. The method of claim 1 , wherein the conversation data is cleaned to remove stop words or non-alphanumeric characters.

6. The method of claim 1 , wherein the website is hosted on either the dark web or deep web.

7. The method of claim 1 , wherein the conversation data is collected from a conversation held by a hacker.

8. The method of claim 1 , further comprising generating the third party risk assessment for the third party based on the anomalies in the conversation data by analyzing mined word clouds and mined phrase clouds, and by topic modeling.

9. The method of claim 1 , wherein the anomalies in the conversation data are discussions of vulnerabilities discovered in a product sold by the third party, malicious code designed to exploit a vulnerability discovered in a product sold by the third party, a data leak from the third party that comprises customer information of the client, and any discussion regarding the third party.

10. The method of claim 1 , further comprising receiving conversation data from a data supplier.

11. A system for generating data defining a third party risk assessment, comprising:
a processor in communication with a tangible storage medium storing instructions that are executed by the processor to perform operations comprising:
accessing input data related to a third party, wherein the input data includes a set of keywords relevant to the third party;

filtering through a data filter conversation data from a website to select portions of the conversation data which include at least one of the set of keywords relevant to the third party;
detecting anomalies in the conversation data that indicate a spike in discussions relevant to the third party; and
generating with a risk generator a third party risk assessment for the third party based on the anomalies in the conversation data.

12. The system of claim 11 , wherein the website hosting the conversation data is deep web based.

13. The system of claim 11 further comprising a data crawler configured to crawl deep web based websites to collect the conversation data.

14. The system of claim 11 , wherein the risk generator generating the third party risk assessment employs a machine learning model.

15. The system of claim 11 , wherein the conversation data is received from a data supplier.

Assignees

• Nunes Eric
• Dharaiya Krishna
• Shakarian Jana
• Shakarian Paulo
• Univ Arizona State

Inventors

• Nunes Eric
• Dharaiya Krishna
• Shakarian Jana
• Shakarian Paulo

Classifications

• G06Q10/0635 Primary

  Risk analysis of enterprise or organisation activities · CPC title

• H04L51/212

  using filtering or selective blocking · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• G06N20/00

  Machine learning · CPC title

• G06F40/30

  Semantic analysis · CPC title