Correcting security vulnerabilities with generative artificial

Patent metadata

Field	Value
Publication number	US-2025077681-A1
Application number	US-202318462369-A
Country	US
Kind code	A1
Filing date	Sep 6, 2023
Priority date	Sep 6, 2023
Publication date	Mar 6, 2025
Grant date	—

Abstract

An example operation may include one or more of monitoring communications that occur with user devices over a shared computer network, detecting a security threat from the monitored communications, generating a software program to simulate the security threat over the shared computer network based on execution of a generative artificial intelligence (GenAI) model on a description of the security threat and a repository of source code, installing the source code for simulating the security threat on a system associated with the computer network, and executing the source code for simulating the security threat via the system.

First claim

What is claimed is:

1 . An apparatus comprising:
a memory comprising a repository of source code; and a processor coupled to the memory and configured to: monitor communications that occur with user devices over a shared computer network, detect a security threat from the monitored communications, generate a software program to simulate the security threat over the shared computer network based on execution of a generative artificial intelligence (GenAI) model on the repository of source code and a description of the security threat, install the source code for simulating the security threat on a system associated with the computer network, and execute the source code for simulating the security threat via the system.

2 . The apparatus of claim 1 , wherein the processor is further configured to record data from the network communications that occur between the user devices via a log and detect the security threat based on execution of a machine learning model on the log.

3 . The apparatus of claim 2 , wherein the processor is further configured to generate the description for the security threat based on execution of the machine learning model on the log of the monitored communications.

4 . The apparatus of claim 1 , wherein the processor is configured to monitor communications that occur between the user devices and a software application hosted on a host platform, and the detecting comprises detecting a vulnerability in the software application hosted by the host platform based on responses from the software application to the user devices.

5 . The apparatus of claim 1 , wherein the communications comprise one or more of client-server communications, network payloads, and network traffic patterns that occur on the shared computer network.

6 . The apparatus of claim 1 , wherein the processor is configured to install the source code for simulating the security threat within a digital twin of the shared computer network, and execute the installed source code via the digital twin of the shared computer network.

7 . The apparatus of claim 1 , wherein the processor is configured to install the source code for simulating the security threat within a system on a different computer network, and execute the source code on the shared computer network via the system on the different computer network.

8 . The apparatus of claim 1 , wherein the processor is further configured to generate a software patch for fixing the security threat based on execution of the GenAI model on results of the execution of the source code for simulating the security threat, and store the software patch in the memory.

9 . A method comprising:
monitoring communications that occur with user devices over a shared computer network; detecting a security threat from the monitored communications; generating a software program to simulate the security threat over the shared computer network based on execution of a generative artificial intelligence (GenAI) model on a description of the security threat and a repository of source code; installing the source code for simulating the security threat on a system associated with the computer network; and executing the source code for simulating the security threat via the system.

10 . The method of claim 9 , wherein the method further comprises recording network communications that occur between the user devices via a log and detecting the security threat based on execution of a machine learning model on the log.

11 . The method of claim 10 , wherein the method further comprises generating the description for the security threat based on execution of the machine learning model on the log of the monitored communications.

12 . The method of claim 9 , wherein the monitoring comprises monitoring communications that occur between the user devices and a software application hosted on a host platform, and the detecting comprises detecting a vulnerability in the software application hosted by the host platform based on responses from the software application to the user devices.

13 . The method of claim 9 , wherein the communications comprise one or more of client-server communications, network payloads, and network traffic patterns that occur on the shared computer network.

14 . The method of claim 9 , wherein the installing comprises installing the source code for simulating the security threat within a digital twin of the shared computer network, and executing the installed source code via the digital twin of the shared computer network.

15 . The method of claim 9 , wherein the installing comprises installing the source code for simulating the security threat within a system on a different computer network, and executing the source code on the shared computer network via the system on the different computer network.

16 . The method of claim 9 , wherein the method further comprises generating a software patch for fixing the security threat based on execution of the GenAI model on results of the execution of the source code for simulating the security threat, and storing the software patch in a storage device.

17 . A computer-readable medium comprising instructions which when executed by a processor cause a computer to perform:
monitoring communications that occur with user devices over a shared computer network; detecting a security threat from the monitored communications; generating a software program to simulate the security threat over the shared computer network based on execution of a generative artificial intelligence (GenAI) model on a description of the security threat and a repository of source code; installing the source code for simulating the security threat on a system associated with the computer network; and executing the source code for simulating the security threat via the system.

18 . The computer-readable medium of claim 17 , wherein the computer is further configured to perform recording network communications that occur between the user devices via a log and detecting the security threat based on execution of a machine learning model on the log.

19 . The computer-readable medium of claim 17 , wherein the monitoring comprises monitoring communications that occur between the user devices and a software application hosted on a host platform, and the detecting comprises detecting a vulnerability in the software application hosted by the host platform based on responses from the software application to the user devices.

20 . The computer-readable medium of claim 17 , wherein the installing comprises installing the source code for simulating the security threat within a digital twin of the shared computer network, and executing the installed source code via the digital twin of the shared computer network.

Assignees

• Toronto Dominion Bank

Inventors

• Sen Gopendu

Classifications

• G06N20/00

  Machine learning · CPC title

• G06F8/61

  Installation · CPC title

• G06N3/0475

  Generative networks · CPC title

• G06F2221/033

  Test or assess software · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title