Systems and methods for AIDA based grouping

Patent metadata

Field	Value
Publication number	US-11627159-B2
Application number	US-202117553979-A
Country	US
Kind code	B2
Filing date	Dec 17, 2021
Priority date	Dec 1, 2017
Publication date	Apr 11, 2023
Grant date	Apr 11, 2023

Abstract

The present disclosure describes systems and methods for dynamically creating groups of users based on attributes for simulated phishing campaign. A campaign controller determines one or more attributes of a plurality of users during execution of a simulated phishing campaign and creates one or more groups of users during based on the identified attributes. The campaign controller selects a template to be used to execute a portion of the simulated phishing campaign for a first group of users and then communicates one or more simulated phishing communications to the first group of users according to the template. The template may identify a list of a plurality of types of simulated phishing communications (email, text or SMS message, phone call or Internet based communication) and at least a portion of the content for the simulated phishing communication.

First claim

What is claimed is:

1. A method comprising:
identifying, by one or more processors, one or more users from a plurality of users for each of a first group of users and a second group of users based at least on one or more attributes of the one or more users;
using, by the one or more processors, a model to identify a first timing and first content for one or more first simulated phishing communications to communicate to the first group of users of the plurality of users, wherein the model is trained to identify timing and content for simulated phishing communications for the plurality of users based at least on one or more attributes of the plurality of users;
using, by the one or more processors, the model to identify a second timing and second content, different from the first timing and the first content, for one or more second simulated phishing communications to be communicated to the second group of users of the plurality of users;
communicating, by the one or more processors, the one or more first simulated phishing communications to the first group users according to the first timing and first content and the one or more first simulated phishing communications to the second group users according to the second timing and second content.

2. The method of claim 1 , further comprising identifying, by the one or more processors, the plurality of users based at least on results of simulated phishing communications.

3. The method of claim 1 , further comprising identifying, by the one or more processors, the one or more attributes of the plurality of users based on applying machine learning at least on behavior of the plurality of users with respect to one or more simulated phishing communications.

4. The method of claim 1 , wherein the model is further configured to identify the timing and content having at least a likelihood to cause a group of users to take a predetermined action.

5. The method of claim 1 , further comprising identifying, by the one or more processors, the first group of users and the second group of users from the plurality of users.

6. The method of claim 1 , wherein the model is further configured to identify a template that specifies the timing and content of simulated phishing communications within a campaign.

7. The method of claim 1 , further comprising providing, by the one or more processors, one or more attributes of the first group of users to the model, responsive to which the model identifies the first timing and the first content.

8. The method of claim 1 , wherein the model is configured to receive one or more attributes of the second group of users as input and provide as output the second timing and the second content.

9. The method of claim 1 , wherein the model is configured to identify a type of simulated phishing communication to use for each of the first group of users and the second group of users.

10. The method of claim 1 , wherein the model is trained to identify timing and content for simulated phishing communications having at least a likelihood to cause a group of users to take a predetermined action.

11. A system comprising:
one or more processors, coupled to memory and configured to:
identify one or more users from a plurality of users for each of a first group of users and a second group of users based at least on one or more attributes of the one or more users;
identify a model trained to specify timing and content for simulated phishing communications for the plurality of users based at least on one or more attributes of the plurality of users;
use the model to identify a first timing and first content for one or more first simulated phishing communications to communicate to the first group of users of the plurality of users, use the model to identify a second timing and second content, different from the first timing and the first content, for one or more second simulated phishing communications to be communicated to the second group of users of the plurality of users;
communicate the one or more first simulated phishing communications to the first group users according to the first timing and first content and the one or more first simulated phishing communications to the second group users according to the second timing and second content.

12. The system of claim 11 , wherein the one or more processors are further configured to identify the plurality of users based at least on results of simulated phishing communications.

13. The system of claim 11 , wherein the one or more processors are further configured to identify the one or more attributes of the plurality of users based on applying machine learning at least on behavior of the plurality of users with respect to one or more simulated phishing communications.

14. The system of claim 11 , wherein the model is further configured to identify the timing the timing and content having at least a likelihood to cause a group of users to take a predetermined action.

15. The system of claim 11 , wherein the one or more processors are further configured to identify the first group of users and the second group of users from the plurality of users.

16. The system of claim 11 , wherein the model is further configured to identify a template that specifies the timing and content of simulated phishing communications within a campaign.

17. The system of claim 11 , wherein the one or more processors are further configured to provide one or more attributes of the first group of users to the model, responsive to which the model identifies the first timing and the first content.

18. The system of claim 11 , wherein the model is configured to receive one or more attributes of the second group of users as input and provide as output the second timing and the second content.

19. The system of claim 11 , wherein the model is configured to identify a type of simulated phishing communication to use for each of the first group of users and the second group of users.

20. The system of claim 11 , wherein the model is trained to identify timing and content for simulated phishing communications having at least a likelihood to cause a group of users to take a predetermined action.

Assignees

• Knowbe4 Inc

Inventors

• Irimie Alin
• Sjouwerman Stu
• Kras Greg
• Sites Eric

Classifications

• G06N3/044

  Recurrent networks, e.g. Hopfield networks · CPC title

• G06N3/09

  Supervised learning · CPC title

• G06N3/084

  Backpropagation, e.g. using gradient descent · CPC title

• H04L63/1483 Primary

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title