Security model utilizing multi-channel data

Patent metadata

Field	Value
Publication number	US-11706241-B1
Application number	US-202017081275-A
Country	US
Kind code	B1
Filing date	Oct 27, 2020
Priority date	Apr 8, 2020
Publication date	Jul 18, 2023
Grant date	Jul 18, 2023

Abstract

Systems, methods and computer-readable storage media are utilized to analyze multi-channel data based on a security model in a computer network environment. A computing system is communicatively coupled to a plurality of data channels configured to access entity data via at least one data channel communication network. A plurality of data sources configured to store entity data are associated with the respective data channels. A processing circuit is communicatively coupled to a particular data channel via a data channel communication network and is structured to receive, via the data channel, entity data comprising device connectivity data, parse properties from the device connectivity data where the properties correspond to particular security dimensions, identify vulnerabilities associated with the properties, determine vulnerability impact, and generate a multi-dimensional risk score for a target computer network environment associated with the entity.

First claim

What is claimed is:

1. A system comprising:
a plurality of data channels configured to access entity data;
a data channel communication network configured to communicate the entity data from the plurality of data channels;
a plurality of data sources configured to store the entity data, the plurality of data sources comprising a data source associated with a data channel of the plurality of data channels;
a processing circuit communicatively coupled to the data channel via the data channel communication network, the processing circuit configured to:
receive, via the data channel, the entity data comprising device connectivity data;
parse a first property and a second property from the device connectivity data;
identify a first vulnerability associated with the first property and the second vulnerability associated with a second property;
determine a first impact of the first vulnerability and a second impact of the second vulnerability;
assign the first property to a first cybersecurity dimension and the second property to a second cybersecurity dimension;
generate a first cybersecurity risk score based at least on the first impact of the first vulnerability, wherein the first cybersecurity risk score relates to the first cybersecurity dimension;
generate a second cybersecurity risk score based at least on the second impact of the second vulnerability, wherein the second cybersecurity risk score relates to the second cybersecurity dimension; and
generate a multi-dimensional score for a target computer network environment based on aggregating the first cybersecurity risk score and the second cybersecurity risk score.

2. The system of claim 1 , the processing circuit further configured to parse from the device connectivity data at least one of a device property, a network property, and network information.

3. The system of claim 2 , the processing circuit further configured to analyze Internet protocol (IP) traffic associated with the target computer network environment.

4. The system of claim 1 , the processing circuit further configured to:
update the entity data based on receiving additional data via at least some of the plurality of data channels;
analyze the updated entity data to identify new device connectivity data;
generate an updated cybersecurity risk score based on the new device connectivity data; and
generate an updated multi-dimensional score based on the updated cybersecurity risk score.

5. The system of claim 4 , wherein generating the updated cybersecurity risk score occurs at least in part contemporaneously with updating the entity data.

6. The system of claim 4 , wherein generating the updated cybersecurity risk score is based on a change in one or more property of the device connectivity data, the change corresponding to a predetermined period of time.

7. The system of claim 1 , wherein detecting the first vulnerability is based on a security parameter.

8. The system of claim 7 , wherein the first impact of the first vulnerability is based on at least one of a number of occurrences associated with the first vulnerability and a line-of-business of an entity.

9. The system of claim 1 , the processing circuit further configured to:
receive, via a computing device of a partner institution of an entity, a customization parameter;
generate a user-interactive cybersecurity dashboard based on the entity data and the customization parameter, wherein the user-interactive cybersecurity dashboard comprises a graphical user interface;
provide to the computing device of the partner institution the user-interactive cybersecurity dashboard, wherein the user-interactive cybersecurity dashboard is presented on a display of the computing device and comprises a selectable drill-down option;
receive, via the user-interactive cybersecurity dashboard, a selection of the selectable drill-down option; and
in response to receiving the selection, update the user-interactive cybersecurity dashboard based on the entity data and the selection.

10. The system of claim 9 , wherein providing the user-interactive cybersecurity dashboard further comprises indicating a remediation item for the entity to remediate, and wherein the remediation item corresponds to a detected vulnerability.

11. The system of claim 10 , the processing circuit further configured to:
track progress of the remediation item based at least on periodically scanning the plurality of data channels; and
generate a long-term trend summary associated with the entity and based on detected vulnerabilities and progress of the remediation item, wherein the long-term trend summary is added to the user-interactive cybersecurity dashboard.

12. The system of claim 1 , wherein the first cybersecurity dimension is at least one of a technology security dimension, a perimeter security dimension, an intelligence security dimension, and a security controls dimension.

13. The system of claim 1 , wherein aggregating the first cybersecurity risk score and the second cybersecurity risk score further comprises:
calculate a roll-up score; and
adjust the roll-up score based on determining a mitigating security score, wherein the mitigating security score is based on at least one identified mitigation technique to reduce vulnerabilities, and wherein the identified mitigation technique is identified by analyzing the entity data.

14. A method of analyzing multi-channel data based on a security model in a computer network environment, the method comprising:
receiving, by a processing circuit, entity data comprising device connectivity data;
analyzing, by the processing circuit, the device connectivity data, comprising assigning a property of the device connectivity data to a specific cybersecurity dimension of a plurality of cybersecurity dimensions based on correlating the property to a vulnerability;
generating, by the processing circuit, a first cybersecurity risk score based at least on the vulnerability, wherein the first cybersecurity risk score is associated with a first cybersecurity dimension; and
generating, by the processing circuit, a multi-dimensional score based on aggregating the first cybersecurity risk score with a second cybersecurity risk score associated with a second cybersecurity dimension.

15. The method of claim 14 , further comprising:
parsing from the device connectivity data at least one of a device property, network property, and network information.

16. The method of claim 15 , further comprising analyzing IP traffic associated with at least one of a domain and a subdomain of a target computer network environment.

17. The method of claim 14 , further comprising:
updating the entity data based on receiving additional data;
analyzing the updated entity data to identify new device connectivity data;
generating an updated cybersecurity risk score based on the new device connectivity data; and
generating an updated multi-dimensional score based on the updated cybersecurity risk score.

18. The method of claim 14 , further comprising:
receiving, via a computing device of a partner institution of an entity, a customization parameter;
generating a user-interactive cybersecurity dashboard based on the entity data and the customization parameter, wherein the user-interactive cybersecurity dashboard comprises a graphical user interface;
providing to the computing device of the partner institution the user-interactive cybersecurity dashboard, wherein the user-interactive cybersecurity dashboard is presented on a display of the computing device and comprises a sel

Assignees

• Wells Fargo Bank Na

Inventors

• Cross Shane
• Fricano Daniel
• Gilheany Thomas
• Makohon Peter
• Miller Dale
• Edison Charles Steven
• Wegba Kodzo
• Bonk James

Classifications

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L43/045

  for graphical visualisation of monitoring data · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/18

  using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215) · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title