Methods and systems for integrating crowd sourced threat modeling contributions into threat modeling systems

Patent metadata

Field	Value
Publication number	US-11956269-B2
Application number	US-202117542140-A
Country	US
Kind code	B2
Filing date	Dec 3, 2021
Priority date	Dec 3, 2021
Publication date	Apr 9, 2024
Grant date	Apr 9, 2024

Abstract

The methods and systems relate to improvements to threat modeling systems through the use of crowdsourcing. Specifically, the methods and systems relate to generating recommendations based on crowdsourced threat modeling contributions. For example, the methods and systems automate the threat modeling process by leveraging data in order to drive consistent and measurable quality of threat models and enable threat models to provide aggregated views of risk concentration at any altitude.

First claim

What is claimed is:

1. A system for integrating crowd sourced threat model contributions into threat modeling systems, comprising:
cloud-based memory configured to:
store a first data structure for an integrated threat modeling system, wherein the first data structure defines a first ontology for a threat model knowledge graph at a first node; and

store a second data structure for a non-integrated threat model contribution, wherein the second data structure defines a second ontology for a non-integrated threat model contribution;
cloud-based control circuitry configured to:
receive a user request to generate an integrated data structure for the integrated threat modeling system, wherein the integrated data structure defines an integrated ontology for a threat model knowledge graph of the integrated threat modeling system and a non-integrated threat model contribution;
retrieve the first data structure for the integrated threat modeling system, wherein the first data structure defines a first ontology for the threat model knowledge graph at a first node;
retrieve a second data structure for the non-integrated threat model contribution, wherein the second data structure defines a second ontology for the non-integrated threat model contribution;
retrieve first content from the first ontology;
determine a keyword in the first content;
compare the keyword to a list of keywords corresponding to the second ontology;
determine to integrate the integrated threat modeling system and the non-integrated threat model contribution at the first node based on comparing the keyword to the list of keywords corresponding to the second ontology;
generate a data structure node for the integrated data structure at the first node based on the first data structure and the second data structure, wherein the data structure node is shared by the first data structure and the second data structure in the integrated data structure;

in response to generating the data structure node, determine integration data, for the data structure node, that maps the first ontology to the second ontology; and

cloud-baseed input/output circuitry configured to:
generate for display, on a user interface, a recommendation based on the integrated data structure for the integrated threat modeling system.

2. A method for integrating crowd sourced threat model contributions into threat modeling systems, comprising:
receiving, via a user interface, a user request to generate an integrated data structure for an integrated threat modeling system, wherein the integrated data structure defines an integrated ontology for a threat model knowledge graph of the integrated threat modeling system and a non-integrated threat model contribution;
retrieving, using control circuitry, a first data structure for the integrated threat modeling system, wherein the first data structure defines a first ontology for the threat model knowledge graph at a first node;
retrieving, using the control circuitry, a second data structure for the non-integrated threat model contribution, wherein the second data structure defines a second ontology for the non-integrated threat model contribution;
generating, using the control circuitry, a data structure node for the integrated data structure at the first node based on the first data structure and the second data structure, wherein the data structure node is shared by the first data structure and the second data structure in the integrated data structure;
in response to generating the data structure node, determining integration data, for the data structure node, that maps the first ontology to the second ontology; and
generating for display, on the user interface, a recommendation based on the integrated data structure for the integrated threat modeling system.

3. The method of claim 2 , wherein the first ontology describes a first type of software architecture at the first node of the threat model knowledge graph, and wherein the second ontology describes a second type of software architecture of the non-integrated threat model contribution, and wherein the integration data maps the first type of software architecture to the second type of software architecture.

4. The method of claim 2 , wherein the first ontology describes a first type of data flow at the first node of the threat model knowledge graph, and wherein the second ontology describes a second type of data flow of the non-integrated threat model contribution, and wherein the integration data maps the first type of data flow to the second type of data flow.

5. The method of claim 2 , wherein the first ontology describes a first type of threat addressed at the first node of the threat model knowledge graph, and wherein the second ontology describes a second type of threat addressed by the non-integrated threat model contribution, and wherein the integration data maps the first type of threat to the second type of threat.

6. The method of claim 2 , wherein the first ontology describes a first type of mitigation technique corresponding to the first node of the threat model knowledge graph, and wherein the second ontology describes a second type of mitigation technique corresponding to the non-integrated threat model contribution, and wherein the integration data maps the first type of mitigation technique to the second type of mitigation technique.

7. The method of claim 2 , further comprising:
in response to receiving the user request to generate the integrated data structure, determining that the integrated data structure comprises the first data structure and the second data structure; and
in response to determining that the integrated data structure comprises the first data structure and the second data structure, accessing:

a first remote issue link to a first server housing the first data structure; and
a second remote issue link to a second server housing the first data structure.

8. The method of claim 2 , wherein generating the integration data further comprises:
determining the first ontology;
determining the second ontology; and
determining a rule set for automatically mapping the first ontology to the second ontology.

9. The method of claim 2 , further comprising:
retrieving first content from the first ontology;
retrieving second content from the second ontology;
determining a semantic closeness between the first content and the second content;
comparing the semantic closeness to a threshold semantic closeness;
determining that first content and the second content correspond based on the semantic closeness equaling or exceeding the threshold semantic closeness; and
determining to integrate the integrated threat modeling system and the non-integrated threat model contribution at the first node based on the semantic closeness equaling or exceeding the threshold semantic closeness.

10. The method of claim 2 , further comprising:
retrieving first content from the first ontology;
determining a keyword in the first content;
comparing the keyword to a list of keywords corresponding to the second ontology; and
determining to integrate the integrated threat modeling system and the non-integrated threat model contribution at the first node based on comparing the keyword to the list of keywords corresponding to the second ontology.

11. The method of claim 2 , further comprising:
receiving a user edit to the integration data; and
storing the edited integration data.

12. A non-transitory, computer-readable medium for integrating crowd sourced threat model contributions into threat modeling systems, comprising instructions that, when executed by one or more processors, cause operations

Assignees

• Capital One Services Llc

Inventors

• Underwood Jonathan
• Barlow Neil
• Scott Fraser Richard

Classifications

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L41/22

  comprising specially adapted graphical user interfaces [GUI] · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title