Automated cyber-security attack method prediction using detected vulnerabilities

Patent metadata

Field	Value
Publication number	US-12335296-B2
Application number	US-202318335686-A
Country	US
Kind code	B2
Filing date	Jun 15, 2023
Priority date	Jun 15, 2022
Publication date	Jun 17, 2025
Grant date	Jun 17, 2025

Abstract

Implementations include a computer-implemented method for reducing cyber-security risk, comprising: accessing a knowledge mesh including a plurality of modules, wherein each module is associated with a respective aspect and maintains a knowledge graph specific to the respective aspect, wherein each knowledge graph is generated using data from one or more cyber-security repositories and includes nodes and connections between the nodes; performing an information completion process to generate connections between nodes of knowledge graphs maintained by different modules of the knowledge mesh, including performing at least one of: inheritance-based inference; natural language processing classifier-based inference; or natural language processing-based object matching inference; and identifying, using the generated connections between the nodes of the knowledge graphs, one or more actions to reduce cyber-security risk.

First claim

The invention claimed is:

1. A computer-implemented method for reducing cyber-security risk, comprising:
accessing a knowledge mesh including a plurality of modules, wherein each module is associated with a respective aspect and maintains a knowledge graph specific to the respective aspect, wherein each knowledge graph is generated using data from one or more cyber-security repositories and includes nodes and connections between the nodes;
performing an information completion process to generate connections between nodes of knowledge graphs maintained by different modules of the knowledge mesh, including performing at least one of: inheritance-based inference; natural language processing classifier-based inference; or natural language processing-based object matching inference; and
identifying, using the generated connections between the nodes of the knowledge graphs, one or more actions to reduce cyber-security risk.

2. The method of claim 1 , wherein performing the information completion process by performing inheritance-based inference comprises:
generating a connection between a first node and a second node, wherein the second node is connected to a parent node of the first node.

3. The method of claim 1 , wherein performing the information completion process by performing natural language processing classifier-based inference comprises:
providing, as input to a plurality of machine learning models, a textual description of a vulnerability; and
receiving, as output from the plurality of machine learning models, a predicted weakness corresponding to the vulnerability.

4. The method of claim 1 , wherein performing the information completion process by performing natural language processing-based object matching inference comprises:
extracting, from a first node, a first set of keywords;
extracting, from a second node, a second set of keywords;
determining, using the first set of keywords and the second set of keywords, a causal similarity between the first node and a second node; and
in response to determining that the causal similarity is equal to or greater than a threshold similarity, generating a connection between the first node and the second node.

5. The method of claim 1 , comprising:
receiving a query corresponding to a first node of a first knowledge graph included in the knowledge mesh;
generating a response to the query by identifying connections between the first node of the first knowledge graph and at least one node of at least one other knowledge graph included in the knowledge mesh; and
identifying, based on the response to the query, the one or more actions to reduce cyber-security risk.

6. The method of claim 5 , wherein receiving a query corresponding to the first node of the first knowledge graph included in the knowledge mesh comprises:
receiving, as input, at least one of a weakness identifier, a vulnerability identifier, or a textual description of a vulnerability.

7. The method of claim 6 , wherein generating a response to the query by identifying connections between the first node of the first knowledge graph and at least one node of at least one other knowledge graph included in the knowledge mesh comprises:
using the at least one of the weakness identifier, vulnerability identifier, or textual description of the vulnerability, determining an attack technique.

8. The method of claim 5 , wherein the first node of the first knowledge graph represents one of a weakness or a vulnerability.

9. The method of claim 5 , wherein the at least one node of the at least one other knowledge graph included in the knowledge mesh represents one of: a weakness, a vulnerability, an attack technique, an attack tactic, an attack pattern, a threat, a defensive technique, a defensive tactic, a digital artifact, a digital object, a digital event.

10. The method of claim 1 , wherein an aspect of a module includes vulnerabilities, weaknesses, attack patterns, adversary tactics, countermeasure, cloud resources, or threat intelligence.

11. The method of claim 1 , comprising performing the one or more actions to reduce cyber-security risk.

12. A system comprising:
one or more computers; and
one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:
accessing a knowledge mesh including a plurality of modules, wherein each module is associated with a respective aspect and maintains a knowledge graph specific to the respective aspect, wherein each knowledge graph is generated using data from one or more cyber-security repositories and includes nodes and connections between the nodes;
performing an information completion process to generate connections between nodes of knowledge graphs maintained by different modules of the knowledge mesh, including performing at least one of: inheritance-based inference; natural language processing classifier-based inference; or natural language processing-based object matching inference; and
identifying, using the generated connections between the nodes of the knowledge graphs, one or more actions to reduce cyber-security risk.

13. The system of claim 12 , wherein performing the information completion process by performing inheritance-based inference comprises:
generating a connection between a first node and a second node, wherein the second node is connected to a parent node of the first node.

14. The system of claim 12 , wherein performing the information completion process by performing natural language processing classifier-based inference comprises:
providing, as input to a plurality of machine learning models, a textual description of a vulnerability; and
receiving, as output from the plurality of machine learning models, a predicted weakness corresponding to the vulnerability.

15. The system of claim 12 , wherein performing the information completion process by performing natural language processing-based object matching inference comprises:
extracting, from a first node, a first set of keywords;
extracting, from a second node, a second set of keywords;
determining, using the first set of keywords and the second set of keywords, a causal similarity between the first node and a second node; and
in response to determining that the causal similarity is equal to or greater than a threshold similarity, generating a connection between the first node and the second node.

16. The system of claim 12 , the operations comprising:
receiving a query corresponding to a first node of a first knowledge graph included in the knowledge mesh;
generating a response to the query by identifying connections between the first node of the first knowledge graph and at least one node of at least one other knowledge graph included in the knowledge mesh; and
identifying, based on the response to the query, the one or more actions to reduce cyber-security risk.

17. The system of claim 16 , wherein receiving a query corresponding to the first node of the first knowledge graph included in the knowledge mesh comprises:
receiving, as input, at least one of a weakness identifier, a vulnerability identifier, or a textual description of a vulnerability.

18. The system of claim 17 , wherein generating a response to the query by identifying connections between the first node of the first knowledge graph and at least one node of at least one other knowledge graph included in the knowledge mesh comprises:
using the at least one of the weakness identifier, vulnerability identifier, or textual

Assignees

• Accenture Global Solutions Ltd

Inventors

• BINYAMINI Hodaya
• Divalentin Louis William
• Engelberg Gal
• Klein Dan
• Hadad Moshe
• Genc Petra
• Levi Roei

Classifications

• G06N5/04

  Inference or reasoning models · CPC title

• H04L41/16

  using machine learning or artificial intelligence · CPC title

• H04L41/024

  using relational databases for representation of network management data, e.g. managing via structured query language [SQL] · CPC title

• H04L41/22

  comprising specially adapted graphical user interfaces [GUI] · CPC title

• H04L41/145

  involving simulating, designing, planning or modelling of a network · CPC title