Cybersecurity threat modeling and analysis with text miner and data flow diagram editor

Patent metadata

Field	Value
Publication number	US-2022038490-A1
Application number	US-202117443633-A
Country	US
Kind code	A1
Filing date	Jul 27, 2021
Priority date	Jul 28, 2020
Publication date	Feb 3, 2022
Grant date	—

Abstract

A computing system is provided implementing a text miner configured to mine unstructured data from unstructured text sources and extract features of a target computer system, and a data flow diagram editor configured to process the extracted features to identify system elements of the target computer system and interrelationships between the identified system elements, and to identify system-related candidate properties of the system elements, and to populate a system element template for each identified system element with the system-related candidate properties for that element. The data flow diagram editor is configured to generate a data flow diagram for the target computer system comprising each identified system element having the candidate properties adopted according to the system property adoption user input, and is configured to display the generated data flow diagram in the graphical user interface.

First claim

What is claimed is:

1 . A cybersecurity computing system, comprising:
a processor and a memory storing executable instructions that, in response to execution by the processor, cause the processor to implement at least: an artificial intelligence model comprising:
a text miner configured to mine unstructured data from unstructured text sources and extract one or more features of a target computer system, and
a data flow diagram editor configured to process the one or more features to identify system elements of the target computer system and interrelationships between the identified system elements, to identify system-related candidate properties of the system elements, and to populate a system element template for each identified system element with the system-related candidate properties for that element; and
a graphical user interface to be displayed on a display device, the graphical user interface being configured to display the system-related candidate properties for each system element in a data flow diagram region, and configured to receive a system property adoption user input for each system-related candidate property of each identified system element, wherein the data flow diagram editor is configured to generate a data flow diagram for the target computer system comprising each identified system element having the system-related candidate properties adopted according to the system property adoption user input, and is configured to display the generated data flow diagram in the graphical user interface via the display device.

2 . The cybersecurity computing system of claim 1 , wherein the system property adoption user input comprises an indication of whether to accept or reject each of the system-related candidate properties.

3 . The cybersecurity computing system of claim 2 , wherein the system property adoption user input further comprises a modification to at least one system-related candidate property and an acceptance of the modification.

4 . The cybersecurity computing system of claim 1 , wherein the text miner comprises one or more neural networks.

5 . The cybersecurity computing system of claim 4 , wherein the one or more neural networks have been trained using feedback training based on the system property adoption user input.

6 . The cybersecurity computing system of claim 1 , wherein the artificial intelligence model is a first artificial intelligence model, and the text miner is a first text miner, the one or more features are one or more first features, and the unstructured data is first unstructured data, and wherein the executable instructions cause the processor to further implement:
a second artificial intelligence model comprising:
a second text miner configured to mine second unstructured text sources and extract one or more second features of at least one cybersecurity threat, and
a threat template editor configured to process the one or more second features, identify cybersecurity threats associated with the one or more second features and their interrelationships with the system elements, and populate a threat template for each identified cybersecurity threat with threat-specific candidate properties for that threat; and
wherein the graphical user interface is further configured to display the threat-specific candidate properties in a threat template editor region, and receive a threat property adoption user input for each of the threat-specific candidate properties for each identified cybersecurity threat, wherein the threat template editor is configured to generate a set of cybersecurity threat characteristics comprising a list of cybersecurity threats and the cybersecurity threat characteristics for each of the cybersecurity threats based on the threat property adoption user input, and is configured to display the list of cybersecurity threats and the cybersecurity threat characteristics in the graphical user interface.

7 . The cybersecurity computing system of claim 6 , wherein the threat property adoption user input comprises an indication of whether to accept or reject each of the threat-specific candidate properties.

8 . The cybersecurity computing system of claim 7 , wherein the threat property adoption user input further comprises a modification to at least one of the threat-specific candidate properties and an acceptance of the modification.

9 . The cybersecurity computing system of claim 6 , wherein the second text miner comprises one or more neural networks.

10 . The cybersecurity computing system of claim 9 , wherein the one or more neural networks of the second text miner are trained using feedback training based upon the threat property adoption user input.

11 . A computing method, comprising:
at one or more processors of a cybersecurity computing system:
mining unstructured data from unstructured text sources to extract features of a target computer system;
processing the extracted features to identify system elements of the target computer system and interrelationships between the identified system elements, and to identify candidate system-related candidate properties of the system elements;
populating a system element template for each identified system element with the system-related candidate properties for that element;
facilitating a display of the system-related candidate properties for each system element in a data flow diagram region;
receiving a system property adoption user input for each system-related candidate property of each identified system element;
generating data flow diagrams comprising each identified system element having the system-related candidate properties adopted according to the system property adoption user input; and
facilitating a presentation of the generated data flow diagrams in a graphical user interface.

12 . The computing method of claim 11 , wherein
the system property adoption user input comprises an indication of whether to accept or reject each of the system-related candidate properties; and the system property adoption user input further comprises a modification to at least one system-related candidate property and an acceptance of the modification.

13 . The computing method of claim 11 , wherein mining unstructured text sources comprises processing the unstructured text sources using a text miner that comprises one or more neural networks, the method further comprising:
performing feedback training of the one or more neural networks based upon the system property adoption user input.

14 . The computing method of claim 11 , wherein the unstructured data is first unstructured data, and the method further comprises:
mining second unstructured text sources to extract features of one or more cybersecurity threats; processing the extracted features to identify cybersecurity threats associated with the extracted features and interrelationships between the cybersecurity threats and the system elements; populating a threat template for each identified cybersecurity threat with threat-specific candidate properties for that threat; facilitating a display of the threat-specific candidate properties in a threat template editor region of the graphical user interface; receiving a threat property adoption user input for each of the threat-specific candidate properties for each identified cybersecurity threat; generating a set of cybersecurity threat characteristics comprising a list of cybersecurity threats and the cybersecurity threat characteristics for each of the cybersecurity threats based on the threat property adoption user input; and facilitating a display of the list of cybersecurity threats

Assignees

• Boeing Co

Inventors

• Thakur Bhanu Pratap Singh
• Kamat Ameya Deepak
• Durairaj Surya Sundar Raj
• Anstey Tim W
• Patro Sangeeta Suresh

Classifications

• G06N3/044

  Recurrent networks, e.g. Hopfield networks · CPC title

• G06N3/045

  Combinations of networks · CPC title

• G06N3/09

  Supervised learning · CPC title

• G06N3/0442

  characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU] · CPC title

• G06N3/0464

  Convolutional networks [CNN, ConvNet] · CPC title