Systems and methods for artificial model building techniques

Patent metadata

Field	Value
Publication number	US-11552992-B2
Application number	US-202117148189-A
Country	US
Kind code	B2
Filing date	Jan 13, 2021
Priority date	Dec 1, 2017
Publication date	Jan 10, 2023
Grant date	Jan 10, 2023

Abstract

Embodiments disclosed describe a security awareness system may adaptively learn the best design of a simulated phishing campaign to get a user to perform the requested actions, such as clicking a hyperlink or opening a file. In some implementations, the system may adapt an ongoing campaign based on user's responses to messages in the campaign, along with the system's learned awareness. The learning process implemented by the security awareness system can be trained by observing the behavior of other users in the same company, other users in the same industry, other users that share similar attributes, all other users of the system, or users that have user attributes that match criteria set by the system, or that match attributes of a subset of other users in the system.

First claim

What is claimed is:

1. A method comprising
establishing, by one or more processors, a plurality of persona models, each of the plurality of persona models trained with a respective plurality of question and response pairs configured for a persona;
identifying, by the one or more processors, a persona model from the plurality of persona models based at least on the persona model meeting one or more criteria for targeting one or more users with one or more simulated phishing communications; and
using, by the one or more processors, the persona model for generating at least one response to a question from a user in response to a simulated phishing communication of the one or more simulated phishing communications of a simulated phishing campaign communicated to at least one or more users.

2. The method of claim 1 , further comprising training, by the one or more processors, each of the plurality of persona models with the respective plurality of question and response pairs configured for the respective persona.

3. The method of claim 1 , wherein the one or more criteria comprises a rate of success that the at least one or more users will interact with the simulated phishing communication.

4. The method of claim 1 , further comprising receiving, by the one or more processors, the question in an electronic communication from the at least one or more users in response to the simulated phishing communication.

5. The method of claim 1 , further comprising generating, by the one or more processors, the simulated phishing communication using at least the persona model.

6. The method of claim 5 , further comprising generating content of the simulated phishing communication in accordance with the persona.

7. The method of claim 6 , wherein the content is generated to encourage the user to interact with a link of the simulated phishing communication.

8. The method of claim 1 , wherein the persona model is configured to receive as input the question and provide as output the at least one response to the question.

9. A system comprising
one or more processors, coupled to memory and configured to:
establish a plurality of persona models, each of the plurality of persona models trained with a respective plurality of question and response pairs configured for a persona;
identify a persona model from the plurality of persona models based at least on the persona model meeting one or more criteria for targeting one or more users with one or more simulated phishing communications; and
use the persona model to instruct the one or more processors for generating at least one response to a question from a user in response to a simulated phishing communication of the one or more simulated phishing communications of a simulated phishing campaign communicated to at least one user of the one or more users.

10. The system of claim 9 , wherein the one or more processors are further configured to train each of the plurality of persona models with the respective plurality of question and response pairs configured for the respective persona.

11. The system of claim 9 , wherein the one or more criteria comprises a rate of success that the one or more users will interact with the simulated phishing communication.

12. The system of claim 9 , wherein the one or more processors are further configured to receive the question in an electronic communication from the at least one user of the one or more users in response to the simulated phishing communication.

13. The system of claim 9 , wherein the one or more processors are further configured to generate the simulated phishing communication using at least the persona model.

14. The system of claim 13 , wherein the one or more processors are further configured to generate content of the simulated phishing communication in accordance with the persona.

15. The system of claim 14 , wherein the content is generated to encourage the user to interact with a link of the simulated phishing communication.

16. The system of claim 13 , wherein the persona model is configured to receive as input the question and provide as output the at least one response to the question.

17. A system comprising:
one or more processors, coupled to memory and configured with a persona model trained via machine learning using a plurality of questions and response pairs for a person;
wherein the persona model, responsive to being trained, is configured to execute on the one or more processors to receive as input a question from a user and provide as output a response to use for generating a simulated phishing communication for one or more users; and
wherein the one or more processors are configured to provide as input to the persona model the question from a simulated phishing communication communicated to at least one user of the one or more users and receive as output from the persona model a response to communicate to the at least one user of the one or more users.

18. The system of claim 17 , wherein the one or more processors are further configured to generate an electronic communication comprising the response.

19. The system of claim 17 , wherein the one or more processors are further configured to communicate the response to the at least one user of the one or more users.

20. The system of claim 17 , wherein the one or more processors are further configured to generate the simulated phishing communication based at least on the persona of the persona model.

Assignees

• Knowbe4 Inc

Inventors

• Sites Eric

Classifications

• G06F2221/2101

  Auditing as a secondary aspect · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• H04L63/1483 Primary

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• G06N3/08

  Learning methods · CPC title