Automated prediction of cyber-security attack techniques using knowledge mesh

Patent metadata

Field	Value
Publication number	US-12348552-B2
Application number	US-202318335305-A
Country	US
Kind code	B2
Filing date	Jun 15, 2023
Priority date	Jun 15, 2022
Publication date	Jul 1, 2025
Grant date	Jul 1, 2025

Abstract

Implementations include a computer-implemented method for reducing cyber-security risk, comprising: selecting one or more modules for inclusion in a knowledge mesh, wherein each module is associated with a respective aspect and maintains a knowledge graph specific to the respective aspect, wherein each knowledge graph is generated using data from one or more cyber-security repositories and includes nodes and connections between the nodes; receiving a query corresponding to a first node of a first knowledge graph included in the knowledge mesh; generating a response to the query by identifying connections between the first node of the first knowledge graph and at least one node of at least one other knowledge graph included in the knowledge mesh; and identifying, based on the response to the query, one or more actions to reduce cyber-security risk.

First claim

The invention claimed is:

1. A computer-implemented method for reducing cyber-security risk, comprising:
selecting one or more modules for inclusion in a knowledge mesh, wherein each module is associated with a respective aspect and maintains a knowledge graph specific to the respective aspect, wherein each knowledge graph is generated using data from one or more cyber-security repositories and includes nodes and connections between the nodes;
receiving a query corresponding to a first node of a first knowledge graph included in the knowledge mesh;
generating a response to the query by identifying connections between the first node of the first knowledge graph and at least one node of at least one other knowledge graph included in the knowledge mesh; and
identifying, based on the response to the query, one or more actions to reduce cyber-security risk.

2. The method of claim 1 , wherein:
the first knowledge graph is maintained by a first module, and
generating a response to the query by identifying connections between the first node of the first knowledge graph and at least one node of at least one other knowledge graph included in the knowledge mesh comprises:
identifying a connection between the first node of the first knowledge graph maintained by the first module and a second node of a second knowledge graph maintained by a second module.

3. The method of claim 1 , wherein:
the first knowledge graph is maintained by a first module, and
generating a response to the query by identifying connections between the first node of the first knowledge graph and at least one node of at least one other knowledge graph included in the knowledge mesh comprises:
identifying matching entities between the first knowledge graph maintained by the first module and a second knowledge graph maintained by a second module.

4. The method of claim 1 , comprising performing the one or more actions to reduce cyber-security risk.

5. The method of claim 1 , comprising:
extracting, from the knowledge mesh, data indicating vulnerabilities and associated weaknesses; and
training, using the extracted data, a plurality of machine learning models to predict weaknesses from input vulnerabilities.

6. The method of claim 5 , comprising:
providing, as input to the plurality of machine learning models, a vulnerability; and
receiving, as output from each of the plurality of machine learning models, a predicted weakness corresponding to the vulnerability.

7. The method of claim 6 , comprising:
determining, based on the output from each of the plurality of machine learning models, that a particular predicted weakness is output from a greater number of machine learning models than any other predicted weakness; and
in response, selecting the particular predicted weakness as corresponding to the vulnerability.

8. The method of claim 5 , wherein the data indicating vulnerabilities includes, for each vulnerability, a textual description and a severity score.

9. The method of claim 1 , wherein receiving a query corresponding to the first node of the first knowledge graph included in the knowledge mesh comprises:
receiving, as input, at least one of a weakness identifier, a vulnerability identifier, or a textual description of a vulnerability.

10. The method of claim 9 , wherein generating a response to the query by identifying connections between the first node of the first knowledge graph and at least one node of at least one other knowledge graph included in the knowledge mesh comprises:
using the at least one of the weakness identifier, vulnerability identifier, or textual description of the vulnerability, determining an attack technique.

11. The method of claim 1 , wherein an aspect of a module includes vulnerabilities, weaknesses, attack patterns, adversary tactics, countermeasure, cloud resources, or threat intelligence.

12. The method of claim 1 , wherein the first node of the knowledge graph represents one of a weakness or a vulnerability.

13. The method of claim 1 , wherein the at least one node of the at least one other knowledge graph included in the knowledge mesh represents one of: a weakness, a vulnerability, an attack technique, an attack tactic, an attack pattern, a threat, a defensive technique, a defensive tactic, a digital artifact, a digital object, or a digital event.

14. A system comprising:
one or more computers; and
one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:
selecting one or more modules for inclusion in a knowledge mesh, wherein each module is associated with a respective aspect and maintains a knowledge graph specific to the respective aspect, wherein each knowledge graph is generated using data from one or more cyber-security repositories and includes nodes and connections between the nodes;
receiving a query corresponding to a first node of a first knowledge graph included in the knowledge mesh;
generating a response to the query by identifying connections between the first node of the first knowledge graph and at least one node of at least one other knowledge graph included in the knowledge mesh; and
identifying, based on the response to the query, one or more actions to reduce cyber-security risk.

15. The system of claim 14 , wherein:
the first knowledge graph is maintained by a first module, and
generating a response to the query by identifying connections between the first node of the first knowledge graph and at least one node of at least one other knowledge graph included in the knowledge mesh comprises:
identifying a connection between the first node of the first knowledge graph maintained by the first module and a second node of a second knowledge graph maintained by a second module.

16. The system of claim 14 , wherein:
the first knowledge graph is maintained by a first module, and
generating a response to the query by identifying connections between the first node of the first knowledge graph and at least one node of at least one other knowledge graph included in the knowledge mesh comprises:
identifying matching entities between the first knowledge graph maintained by the first module and a second knowledge graph maintained by a second module.

17. The system of claim 14 , the operations comprising performing the one or more actions to reduce cyber-security risk.

18. The system of claim 14 , the operations comprising:
extracting, from the knowledge mesh, data indicating vulnerabilities and associated weaknesses; and
training, using the extracted data, a plurality of machine learning models to predict weaknesses from input vulnerabilities.

19. The system of claim 18 , the operations comprising:
providing, as input to the plurality of machine learning models, a vulnerability; and
receiving, as output from each of the plurality of machine learning models, a predicted weakness corresponding to the vulnerability.

20. A non-transitory computer-readable medium storing software comprising instructions executable by one or more computers which, upon such execution, cause the one or more computers to perform operations comprising:
selecting one or more modules for inclusion in a knowledge mesh, wherein each module is associated with a respective aspect and maintains a knowledge graph specific to the respective aspect, wherein each knowledge graph is generated using data from one or more cyber-security repositories and includes nodes and conne

Assignees

• Accenture Global Solutions Ltd

Inventors

• Engelberg Gal
• Klein Dan
• Hadad Moshe
• BINYAMINI Hodaya

Classifications

• G06N5/04

  Inference or reasoning models · CPC title

• H04L41/16

  using machine learning or artificial intelligence · CPC title

• H04L41/024

  using relational databases for representation of network management data, e.g. managing via structured query language [SQL] · CPC title

• H04L41/22

  comprising specially adapted graphical user interfaces [GUI] · CPC title

• H04L41/145

  involving simulating, designing, planning or modelling of a network · CPC title