Systems and methods for determining individual and group risk scores

Patent metadata

Field	Value
Publication number	US-2020287917-A1
Application number	US-202016855502-A
Country	US
Kind code	A1
Filing date	Apr 22, 2020
Priority date	May 16, 2018
Publication date	Sep 10, 2020
Grant date	—

Abstract

Embodiments disclosed herein describe a server, for example a security awareness server or an artificial intelligence machine learning system that establishes a risk score or vulnerable for a user of a security awareness system, or for a group of users of a security awareness system. The server may create a frequency score for a user, which predicts the frequency at which the user is to be hit with a malicious attack. The frequency score may be based on at least a job score, which may be represented by a value that is based on the type of job the user has, and a breach score that may be represented by a value that is based on the user's level of exposure to email.

First claim

We claim:

1 . A method comprising:
identifying, by one or more processers, a first score comprising a first value representing a frequency at which a user is to receive a phishing communication; identifying, by the one or more processors, a second score comprising a second value representing a propensity of the user to interact with the phishing communication; determining, by the one or more processors, a risk score for the user based at least on a function of the first value of the first score and the second value of the second score, the risk score identifying a probability that the user will interact with one or more subsequent phishing communications; and providing, by the one or more processors, the risk score for display via a user interface.

2 . The method of claim 1 , further comprising identifying, by the one or more processors, a third score comprising a third value representing a severity of the user's interaction with the phishing communication.

3 . The method of claim 2 , further comprising determining, by the one or more processors, the risk score comprising the function of the first value of the first score and the second value of the second score and the third value of the third score.

4 . The method of claim 2 , further comprises determining, by the one or more processors, the third value of the third score based at least on individual access of the user.

5 . The method of claim 1 , further comprising determining, by the one or more processors, the risk score comprising the function of applying weights to the first value of the first score and the second value of the second score.

6 . The method of claim 1 , further comprising determining, by the one or more processors, the first value of the first scored based at least on one of a job score value or a breach score value.

7 . The method of claim 6 , wherein the job score value identifies a type of job of the user

8 . The method of claim 6 , wherein the breach score value identifies the user's level of exposure to email.

9 . The method of claim 1 , wherein the phishing communication is a malicious attack

10 . The method of claim 1 , wherein the phishing communication is a simulated phishing communication.

11 . A system comprising:
one or more processers, coupled to memory, and configured to: identify a first score comprising a first value representing a frequency at which a user is to receive a phishing communication; identify, a second score comprising a second value representing a propensity of the user to interact with the phishing communication; determine a risk score for the user based at least on a function of the first value of the first score and the second value of the second score, the risk score identifying a probability that the user will interact with one or more subsequent phishing communications; and provide the risk score for display via a user interface.

12 . The system of claim 11 , wherein the one or more processors are further configured to identify a third score comprising a third value representing a severity of the user's interaction with the phishing communication.

13 . The system of claim 12 , wherein the one or more processors are further configured to determine the risk score comprising the function of the first value of the first score and the second value of the second score and the third value of the third score.

14 . The system of claim 12 , wherein the one or more processors are further configured to determine the third value of the third score based at least on individual access of the user.

15 . The system of claim 11 , wherein the one or more processors are further configured to determine the risk score comprising the function of applying weights to the first value of the first score and the second value of the second score.

16 . The system of claim 11 , wherein the one or more processors are further configured to determine the first value of the first scored based at least on one of a job score value or a breach score value.

17 . The system of claim 16 , wherein the job score value identifies a type of job of the user

18 . The system of claim 16 , wherein the breach score value identifies the user's level of exposure to email.

19 . The system of claim 11 , wherein the phishing communication is a malicious attack

20 . The system of claim 11 , wherein the phishing communication is a simulated phishing communication.

Assignees

• Knowbe4 Inc

Inventors

• Sites Eric
• Kras Greg
• Irimie Alin
• Sjouwerman Stu
• Castilho Marcio
• Martens Siegfried
• Bonabeau Eric
• Kime Kristian

Classifications

• H04L63/1408 Primary

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/14

  for detecting or protecting against malicious traffic · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title