Security model utilizing multi-channel data

Patent metadata

Field	Value
Publication number	US-12149557-B2
Application number	US-202318202860-A
Country	US
Kind code	B2
Filing date	May 26, 2023
Priority date	Apr 8, 2020
Publication date	Nov 19, 2024
Grant date	Nov 19, 2024

Abstract

Systems, methods, and computer-readable storage media are utilized to analyze multi-channel data based on a security model in a computer network environment. One system includes a plurality of data channels configured to access entity data and a processing circuit communicatively coupled to a data channel of the plurality of data channels, the processing circuit configured to identify at least one vulnerability, determine an impact of the at least one vulnerability, assign the first property to a first cybersecurity dimension, generate a cybersecurity risk score based at least on the impact of the at least one vulnerability, and generate a multi-dimensional score for a target computer network environment based on the cybersecurity risk score.

First claim

What is claimed is:

1. A system comprising:
a plurality of data channels configured to access entity data;
a processing circuit communicatively coupled to a data channel of the plurality of data channels, the processing circuit configured to:
identify at least one vulnerability associated with a first property or a second property from device connectivity data;
determine an impact of the at least one vulnerability;
assign the first property to a first cybersecurity dimension and the second property to a second cybersecurity dimension;
generate a cybersecurity risk score based at least on the impact of the at least one vulnerability, wherein the cybersecurity risk score is associated with at least one of the first cybersecurity dimension or the second cybersecurity dimension; and
generate a multi-dimensional score for a target computer network environment based on the cybersecurity risk score.

2. The system of claim 1 , the processing circuit further configured to parse from the device connectivity data at least one of a device property, a network property, and network information.

3. The system of claim 2 , the processing circuit further configured to analyze Internet protocol (IP) traffic associated with the target computer network environment.

4. The system of claim 1 , the processing circuit further configured to:
update the entity data based on receiving additional data via at least some of the plurality of data channels;
analyze the updated entity data to identify new device connectivity data;
generate an updated cybersecurity risk score based on the new device connectivity data; and
generate an updated multi-dimensional score based on the updated cybersecurity risk score.

5. The system of claim 4 , wherein generating the updated cybersecurity risk score occurs at least in part contemporaneously with updating the entity data.

6. The system of claim 4 , wherein generating the updated cybersecurity risk score is based on a change in one or more property of the device connectivity data, the change corresponding to a predetermined period of time.

7. The system of claim 1 , wherein detecting the at least one vulnerability is based on a security parameter.

8. The system of claim 7 , wherein the first impact of the at least one vulnerability is based on at least one of a number of occurrences associated with the at least one vulnerability and a line-of-business of an entity.

9. A method of analyzing multi-channel data based on a security model in a computer network environment, the method comprising:
identifying, by the one or more processing circuits, at least one vulnerability associated with a first property or a second property from device connectivity data;
determining, by the one or more processing circuits, an impact of the at least one vulnerability;
assigning, by the one or more processing circuits, the first property to a first cybersecurity dimension and the second property to a second cybersecurity dimension;
generating, by the one or more processing circuits, a cybersecurity risk score based at least on the impact of the at least one vulnerability, wherein the cybersecurity risk score relates to at least one of the first cybersecurity dimension or the second cybersecurity dimension; and
generating, by the one or more processing circuits, a multi-dimensional score for a target computer network environment based on the cybersecurity risk score.

10. The method of claim 9 , further comprising:
parsing from the device connectivity data at least one of a device property, network property, and network information.

11. The method of claim 10 , further comprising analyzing IP traffic associated with at least one of a domain and a subdomain of a target computer network environment.

12. The method of claim 9 , further comprising:
updating the entity data based on receiving additional data;
analyzing the updated entity data to identify new device connectivity data;
generating an updated cybersecurity risk score based on the new device connectivity data; and
generating an updated multi-dimensional score based on the updated cybersecurity risk score.

13. The method of claim 9 , further comprising:
receiving, via a computing device of a partner institution of an entity, a customization parameter;
generating a user-interactive cybersecurity dashboard based on the entity data and the customization parameter, wherein the user-interactive cybersecurity dashboard comprises a graphical user interface;
providing to the computing device of the partner institution the user-interactive cybersecurity dashboard, wherein the user-interactive cybersecurity dashboard is presented on a display of the computing device and comprises a selectable drill-down option;
receiving, via the user-interactive cybersecurity dashboard, a selection of the selectable drill-down option; and
in response to receiving the selection, updating the user-interactive cybersecurity dashboard based on the entity data and the selection.

14. The method of claim 13 , further comprising:
determining a remediation item;
tracking progress of the remediation item based at least on periodically scanning a plurality of data channels; and
generating a long-term trend summary associated with the entity and based on detected vulnerabilities and progress of the remediation item, wherein the long-term trend summary is added to the user-interactive cybersecurity dashboard.

15. A computer-readable storage medium (CRM) having instructions stored thereon that, when executed by a processing circuit, cause the processing circuit to perform operations comprising:
identifying at least one vulnerability associated with a first property or a second property from device connectivity data;
determining an impact of the at least one vulnerability;
assigning the first property to a first cybersecurity dimension and the second property to a second cybersecurity dimension;
generating a cybersecurity risk score based at least on the impact of the at least one vulnerability, wherein the cybersecurity risk score is associated with at least one of the first cybersecurity dimension or the second cybersecurity dimension; and
generating a multi-dimensional score for a target computer network environment based on the cybersecurity risk score.

16. The CRM of claim 15 , the processing circuit further performs operations to parse from the device connectivity data at least one of a device property, a network property, and network information.

17. The CRM of claim 16 , the processing circuit further performs operations to analyze Internet protocol (IP) traffic associated with the target computer network environment.

18. The CRM of claim 15 , the processing circuit further performs operations to:
update the entity data based on receiving additional data via at least some of the plurality of data channels;
analyze the updated entity data to identify new device connectivity data;
generate an updated cybersecurity risk score based on the new device connectivity data; and
generate an updated multi-dimensional score based on the updated cybersecurity risk score.

19. The CRM of claim 18 , wherein generating the updated cybersecurity risk score occurs at least in part contemporaneously with updating the entity data.

20. The CRM of claim 18 , wherein generating the updated cybersecurity risk score is based on a change in one or more property of the device connectivity data, the change corresponding to a predetermined period of time.

Assignees

• Wells Fargo Bank Na

Inventors

• Fricano Daniel
• Gilheany Thomas
• Makohon Peter
• Miller Dale
• Edison Charles Steven
• Wegba Kodzo
• Bonk James
• Cross Shane

Classifications

• H04L63/18

  using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215) · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L43/045

  for graphical visualisation of monitoring data · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title