Intelligent monitoring platform using graph neural networks with a cybersecurity mesh and associated cybersecurity applications

Patent metadata

Field	Value
Publication number	US-12425309-B2
Application number	US-202318237745-A
Country	US
Kind code	B2
Filing date	Aug 24, 2023
Priority date	Aug 24, 2023
Publication date	Sep 23, 2025
Grant date	Sep 23, 2025

Abstract

Arrangements for an intelligent monitoring platform using a cybersecurity mesh and graph neural networks (GNNs) are provided. A platform may train multiple machine learning models (e.g., a GNN model, a cybersecurity engine, and a monitoring model). The platform may generate, using a GNN model, a suspicion score for a received event processing request. Based on determining the suspicion score satisfies a threshold, the platform may generate a threat score using a cybersecurity engine. The platform may generate an anomaly record for the event processing request based on the threat score and using a monitoring model. The platform may determine a preferred node of a cybersecurity mesh for routing the event processing request based on the anomaly record. The platform may determine a threat prevention response based on the preferred node. The platform may initiate one or more security actions based on the threat prevention response.

First claim

What is claimed is:

1. A computing platform comprising:
at least one processor;
a communication interface communicatively coupled to the at least one processor; and
memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
train a plurality of machine learning models, wherein the plurality of machine learning models comprises, at least:
a graph neural network (GNN) model configured to output suspicion scores based on input of event processing information,
a cybersecurity engine configured to output threat scores based on input of event processing information, and
a monitoring model configured to output anomaly records based on input of threat scores and based on input of event processing information;

receive an event processing request comprising first event processing information;
generate, based on inputting the first event processing information into the GNN model, a suspicion score for the event processing request;
determine, based on comparing the suspicion score to a threshold score, whether the suspicion score satisfies the threshold score;
based on a determination that the suspicion score satisfies the threshold score, generate, based on inputting the first event processing information into the cybersecurity engine, a threat score for the event processing request;
input the first event processing information and the threat score for the event processing request into the monitoring model;
generate, based on inputting the first event processing information and the threat score for the event processing request into the monitoring model, an anomaly record for the event processing request;
determine, based on the anomaly record, a preferred node of a cybersecurity mesh for routing the event processing request;
route the event processing request to the preferred node;
determine, based on routing the event processing request to the preferred node, a threat prevention response; and
initiate, based on the threat prevention response, one or more security actions.

2. The computing platform of claim 1 , wherein the threat prevention response is determined based on comparing one or more rules associated with the preferred node to one or more parameters included in the first event processing information.

3. The computing platform of claim 1 , wherein the threat prevention response identifies the one or more security actions based on a type of threat corresponding to the event processing request and indicated by the anomaly record.

4. The computing platform of claim 1 , wherein generating the suspicion score for the event processing request comprises:
determining, based on comparing the first event processing information to one or more historical event processing patterns generated by the GNN model, a likelihood the event processing request is suspicious,
wherein a given historical event processing pattern of the one or more historical event processing patterns comprises:
a plurality of nodes representing a user associated with a historical event processing request; and
a plurality of edges, wherein each edge of the plurality of edges corresponds to a subset of historical event processing information associated with the historical event processing request.

5. The computing platform of claim 1 , wherein training the GNN model comprises training the GNN model based on one or more historical event processing requests, and wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
update the GNN model based on the anomaly record; and
generate, using the updated GNN model, one or more event processing patterns corresponding to the event processing request, wherein a given pattern of the one or more event processing patterns comprises:
a plurality of nodes representing a user associated with the event processing request; and
a plurality of edges, wherein each edge of the plurality of edges corresponds to a subset of the first event processing information.

6. The computing platform of claim 1 , wherein training the cybersecurity engine comprises training the cybersecurity engine based on one or more historical event processing patterns and based on one or more historical event processing requests, and wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to update the cybersecurity engine based on user input responsive to the one or more security actions.

7. The computing platform of claim 1 , wherein training the monitoring model comprises training the monitoring model based on one or more threat prevention rules and based on historical event processing information corresponding to one or more historical threat scores, and wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to update the monitoring model based on the threat prevention response.

8. The computing platform of claim 1 , wherein the anomaly record comprises:
the first event processing information;
the threat score for the event processing request;
an indication of a type of threat corresponding to the event processing request; and
a record of one or more historical threat prevention responses corresponding to the type of threat.

9. The computing platform of claim 1 , wherein the one or more security actions comprise one or more of:
denying the event processing request,
sending an alert to an event processing system,
sending an alert to a remote cybersecurity platform,
routing the event processing request to one or more free nodes of the cybersecurity mesh,
adding, based on a first subset of the first event processing information, a device corresponding to the event processing request to a device watchlist, or
adding, based on a second subset of the first event processing information, an account corresponding to the event processing request to an account watchlist.

10. The computing platform of claim 1 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
receive a second event processing requesting comprising second event processing information;
generate, based on inputting the second event processing information into the GNN model, a second suspicion score for the second event processing request;
determine, based on comparing the second suspicion score to the threshold score, whether the second suspicion score satisfies the threshold; and
based on a determination that the threshold score exceeds the second suspicion score, cause processing of the second event processing request, wherein causing processing of the second event processing request comprises:
updating an entry at a stored distributed ledger, or
adding an entry to the stored distributed ledger.

11. A method comprising:
at a computing device comprising at least one processor, a communication interface, and memory:
training a plurality of machine learning models, wherein the plurality of machine learning models comprises, at least:
a graph neural network (GNN) model configured to output suspicion scores based on input of event processing information,
a cybersecurity engine configured to output threat scores based on input of event processing information, and
a monitoring model configured to output anomaly records based on input of threat scores and based on input of event processing information;

receiving an event processing requesting comprising first event processing info

Assignees

• Bank Of America

Inventors

• Bakshi Sakshi
• Taneja Pushkar
• Baskaran Subhasree
• Kutthumolu Durga Prasad

Classifications

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L63/205

  involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24) · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L41/069

  using logs of notifications; Post-processing of notifications · CPC title

• H04L41/16 Primary

  using machine learning or artificial intelligence · CPC title