Patching security vulnerabilities using machine learning

Patent metadata

Field	Value
Publication number	US-12412179-B2
Application number	US-202017091355-A
Country	US
Kind code	B2
Filing date	Nov 6, 2020
Priority date	Nov 6, 2020
Publication date	Sep 9, 2025
Grant date	Sep 9, 2025

Abstract

Disclosed herein are system, method, and computer program product embodiments for process corruption prevention. An embodiment operates by determining security vulnerabilities for an entity and correlation values for the security vulnerabilities by applying completed processed records of the entity to a machine learning model. Each of the correlation values quantifies a relationship strength between a security vulnerability and fraudulent activity. The embodiment further operates by generating a security vulnerability score for the entity using the correlation values and identifying one or more patches for at least one of the security vulnerabilities. The one or more patches may be ranked and the ranking may be revised using a feedback mechanism after the one or more patches are implemented by the entity.

First claim

What is claimed is:

1. A method of process corruption prevention, comprising:
storing, by one or more computing devices, a first plurality of processed records associated with an entity in a repository, wherein each of the first plurality of processed records includes a fraud indicator determined by a fraud detection model that classifies a completed transaction as confirmed fraudulent, suspected fraudulent, or not fraudulent;
determining, by the one or more computing devices, a first plurality of security vulnerabilities for the entity and a first plurality of correlation values for the first plurality of security vulnerabilities by applying a machine learning model to the first plurality of processed records, wherein each of the first plurality of correlation values quantifies a relationship strength between a security vulnerability and a fraudulent activity;
generating, by the one or more computing devices, a first security vulnerability score for the entity using the first plurality of correlation values;
identifying, by the one or more computing devices, a security vulnerability having a greatest correlation value from the first plurality of security vulnerabilities;
implementing, by the one or more computing devices, a patch to mitigate one or more security vulnerabilities of the first plurality of security vulnerabilities, wherein the patch is selected from a plurality of patches in a patch lookup table using the security vulnerability having the greatest correlation value;
determining, by the one or more computing devices, based in part on the implementing the patch for a predefined time period, a change in the first security vulnerability score, wherein the predefined time period is determined based on the security vulnerability having the greatest correlation value; and
implementing, by the one or more computing devices, based on determining the change in the first security vulnerability score, a different patch selected from the plurality of patches.

2. The method of claim 1 , wherein generating the first security vulnerability score comprises:
obtaining, by the one or more computing devices, a first plurality of impact values for the first plurality of security vulnerabilities, wherein each of the first plurality of impact values is a revenue amount of the entity attributable to one of the first plurality of security vulnerabilities; and
calculating, by the one or more computing devices, a weighted average based on the first plurality of impact values and the first plurality of correlation values.

3. The method of claim 1 , further comprising:
transmitting, by the one or more computing devices, the first plurality of security vulnerabilities and the first plurality of correlation values to a processor, wherein the processor updates the fraud detection model based on the first plurality of security vulnerabilities and the first plurality of correlation values.

4. The method of claim 1 , wherein the first plurality of security vulnerabilities comprises a user identifier (ID), and wherein the patch for the security vulnerability having the greatest correlation value comprises enforcing user logouts from user devices.

5. The method of claim 1 , further comprising:
issuing, by the one or more computing devices, a report to the entity, wherein the report comprises at least one of the first plurality of security vulnerabilities, the first plurality of correlation values for the first plurality of security vulnerabilities, the first security vulnerability score, the patch, and an average or median security vulnerability score for other entities similar to the entity receiving the report.

6. A system for process corruption prevention, comprising:
a memory; and
a computer processor coupled to the memory and configured to:
store a first plurality of processed records associated with an entity in a repository, wherein each of the first plurality of processed records includes a fraud indicator determined by a fraud detection model that classifies a completed transaction as confirmed fraudulent, suspected fraudulent, or not fraudulent;
determine a first plurality of security vulnerabilities for the entity and a first plurality of correlation values for the first plurality of security vulnerabilities by applying a machine learning model to the first plurality of processed records, wherein each of the first plurality of correlation values quantifies a relationship strength between a security vulnerability and a fraudulent activity;
generate a first security vulnerability score for the entity using the first plurality of correlation values;
identify a security vulnerability having a greatest correlation value from the first plurality of security vulnerabilities;
implement a patch to mitigate one or more security vulnerabilities of the first plurality of security vulnerabilities, wherein the patch is selected from a plurality of patches in a patch lookup table using the security vulnerability having the greatest correlation value;
determine, based in part on the implementing the patch for a predefined time period, a change in the first security vulnerability score, wherein the predefined time period is determined based on the security vulnerability having the greatest correlation value; and
implement based on determining the change in the first security vulnerability score, a different patch selected from the plurality of patches.

7. The system of claim 6 , wherein the computer processor generates the first security vulnerability score by:
obtaining a first plurality of impact values for the first plurality of security vulnerabilities, wherein each of the first plurality of impact values is a revenue amount of the entity attributable to one of the first plurality of security vulnerabilities; and
calculating a weighted average based on the first plurality of impact values and the first plurality of correlation values.

8. The system of claim 6 , wherein the first plurality of security vulnerabilities comprises a user identifier (ID), and wherein the patch for the security vulnerability having the greatest correlation value comprises enforcing user logouts from user devices.

9. The system of claim 6 , wherein the computer processor is further configured to:
update the fraud detection model based on the first plurality of security vulnerabilities and the first plurality of correlation values.

10. The system of claim 6 , wherein the computer processor is further configured to:
issue a report to the entity, wherein the report comprises at least one of the first plurality of security vulnerabilities, the first plurality of correlation values for the first plurality of security vulnerabilities, the first security vulnerability score, the patch, and an average or median security vulnerability score for other entities similar to the entity receiving the report.

11. A non-transitory computer-readable medium having instructions stored thereon that, when executed by at least one computing device, cause the at least one computing device to perform operations comprising:
storing a first plurality of processed records associated with an entity in a repository, wherein each of the first plurality of processed records includes a fraud indicator determined by a fraud detection model that classifies a completed transaction as confirmed fraudulent, suspected fraudulent, or not fraudulent;
determining a first plurality of security vulnerabilities for the entity and a first plurality of correlation values for the first plurality of security vulnerabilities by applying a machine learning model to the first plurality of processed records, wherein each of the first plurality of correlation values quantif

Assignees

• Capital One Services Llc

Inventors

• Rafferty Galen
• Walters Austin
• Goodsitt Jeremy
• Truong Anh
• Pham Vincent
• Farivar Reza
• Watson Mark

Classifications

• G06N3/09

  Supervised learning · CPC title

• G06N3/0442

  characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU] · CPC title

• G06F21/572

  Secure firmware programming, e.g. of basic input output system [BIOS] · CPC title

• G06N3/08

  Learning methods · CPC title

• G06Q10/0635 Primary

  Risk analysis of enterprise or organisation activities · CPC title