Inferential analysis using feedback for extracting and combining cyber risk information

• US 10,230,764 B2
• Filed: 12/06/2016
• Issued: 03/12/2019
• Est. Priority Date: 12/29/2014
• Status: Active Grant

• Current Assignee: Cyence LLC. (Guidewire Software Incorporated)
• Original Assignee: Guidewire Software Incorporated
• Inventors: Ng, George Y., Wu, Brian, Yang, Ming, Yang, Paul, Tancioco, Jr., Fernando
• Primary Examiner(s): Rahman, Mahfuzur
• Application Number:
  US15/371,047
• Publication Number:
  US 20170085595A1
• Time in Patent Office: 826 Days
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06Q 30/012 Providing warranty services
• CPC Class Codes: G06Q 40/06 Asset management; Financial planning or analysis
• CPC Class Codes: G06Q 40/08 Insurance
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Various embodiments of the present technology include methods of assessing risk of a cyber security failure in a computer network of an entity. Some embodiments involve using continual or periodic data collecting to improve inferential analysis, as well as obtaining circumstantial or inferential information from social networks. Machine learning may be used to improve predicitive capabilities. Some embodiments allow for identification of an entity from circumstantial or inferential information based on the machine learning and comparative analyses.

Claims

1. A method, comprising:

assessing risk of a cyber security failure in a computer network of an entity, using a computer agent configured to collect information from at least one accessible Internet elements, wherein the collection of information occurs periodically or continually over time, wherein the assessing of risk comprises;

determining circumstantial or indirect information that is indicative of the entity based on the collected information;

confirming or inferring that the entity is referenced in the circumstantial or indirect information that is indicative of the entity being referenced in the circumstantial or indirect information by cross-referencing data in the collected information; and

increasing or decreasing the assessed risk if the circumstantial or indirect information indicative of the entity is respectively negative or positive;

automatically determining, based on the assessed risk, a change or a setting to at least one element of policy criteria of a cyber security policy;

automatically recommending, based on the assessed risk, computer network changes to reduce the assessed risk;

providing one or more recommended computer network changes to reduce the assessed risk, enactment by the entity of at least one of the one or more of the recommended computer network changes to reduce the assessed risk to the entity; and

in response to determining that the entity has enacted at least a portion of the recommended computer network changes, initiating the change or the setting to the at least one element of policy criteria of the cyber security policy.

2. The method of claim 1, further comprising:

in response to the determining that the entity has enacted at least a portion of the recommended computer network changes;

automatically reassessing the risk of a cyber security failure in the computer network of the entity based on the enacted recommended computer network changes; and

dynamically re-determining, based on the reassessed risk of a cyber security failure in the computer network of the entity, the change or the setting to the at least one element of policy criteria of the cyber security policy; and

periodically re-assessing the risk of a cyber security failure in the computer network of the entity over time as the periodic or continual collecting of the information occurs over time, wherein the re-assessing of the risk results in any of;

an update to the change or setting to the at least one element of policy criteria of the cyber security policy; and

an update to the computer network changes.

3. The method of claim 2, further comprising predicting an action of the entity based on the periodic re-assessing.

4. The method of claim 3, wherein the predicting is based on machine learning.

5. The method of claim 1, wherein the cyber security failure comprises a privacy incident involving sensitive information.

6. The method of claim 1, wherein the computer agent is further configured to perform at least one of collecting information from the computer network of the entity, and analyzing information from the computer network of the entity.

7. The method of claim 1, further comprising:

based on the assessing of risk of the cyber security failure in the computer network of the entity, plotting one or more features of the entity and other members of a peer group of the entity, the plotting being configured to visually illustrate the risk of a cyber security failure in the computer network of the entity; and

the automatically recommending of computer network changes being based on the plotting.

8. The method of claim 1, wherein the assessing of risk of a cyber security failure in the computer network of the entity further comprises:

assessing, using a plurality of sophistication elements for the entity, a sophistication for the entity with respect to preventing the cyber security failure, the sophistication being one of a plurality of features of the entity;

assessing, using a plurality of motivation elements regarding the entity, a motivation of an actor to initiate the cyber security failure, the motivation being another one of the features of the entity; and

calculating a composite score from a motivation score and a sophistication score, the motivation score representing the plurality of motivation elements, the sophistication score representing the plurality of sophistication elements.

9. The method of claim 1, wherein the assessing of the risk of a cyber security failure in the computer network of the entity further comprises:

assessing, using a plurality of sophistication elements for the entity, a sophistication for the entity with respect to preventing the cyber security failure, the sophistication being one of a plurality of features of the entity; and

assessing, using a plurality of motivation elements regarding the entity, a motivation of an actor to initiate the cyber security failure, the motivation being another one of the features of the entity;

wherein the method further comprises;

calculating a composite score based on the assessing of the risk;

calculating a motivation score from the composite score, the motivation score representing the plurality of motivation elements; and

calculating a sophistication score from the composite score, the sophistication score representing the plurality of sophistication elements.

10. The method of claim 8, wherein the actor is a hacker.

11. The method of claim 8, further comprising:

creating an aggregate risk score of a portfolio of entities based on a plurality of motivation scores including the motivation score and a plurality of sophistication scores including the sophistication score; and

benchmarking over time at least one of the sophistication score, the motivation score, the composite score, and the aggregate risk score.

12. The method of claim 11, further comprising:

determining a position of the entity relative to the aggregate risk score of the portfolio of entities, the portfolio of entities belonging to at least one of an industry group, a geographic location, a company size, a technology sector, or any combinations thereof, wherein the assessed risk of a cyber security failure in the computer network of the entity is a function of the aggregate risk score of the portfolio of entities;

comparing the assessed risk of a cyber security failure in the computer network of the entity to the aggregate risk score; and

automatically generating and recommending additional computer network changes to reduce the assessed risk of a cyber security failure in the computer network of the entity.

13. The method of claim 2, further comprising estimating at least one impact to the entity for the cyber security failure, the estimating being dynamically calculated based on the determining that the entity has enacted at least a portion of the recommended computer network changes.

14. The method of claim 1, wherein at least one of the one or more recommended computer network changes is implemented automatically without intervention of the entity.

15. The method of claim 1, wherein the cyber security policy is at least one of:

a cyber security policy from another entity; and

a product warranty for first and/or third party costs that the entity purchases from at least one of a networking, security product, and services provider.

16. A method, comprising:

determining circumstantial or indirect information, that is indicative of an entity, based on information collected from at least one publicly available Internet elements, the information being collected periodically or continually over time;

matching the obtained circumstantial or indirect information to entity information included in a database;

confirming or inferring that the entity is referenced in the circumstantial or indirect information that is indicative of the entity being referenced in the circumstantial or indirect information by cross-referencing data in the collected information with the information in the database;

automatically determining a change or a setting to at least one element of policy criteria of a cyber security policy of the entity based on the collected information;

automatically recommending computer network changes that improve the cyber security policy based on the collected information; and

determining that the entity has enacted at least a portion of the recommended computer network changes.

17. The method of claim 16, further comprising:

in response to the determining that the entity has enacted at least a portion of the recommended computer network changes;

automatically assessing the risk of a cyber security failure in the computer network of the entity based on the enacted recommended computer network changes; and

dynamically determining, based on the assessed risk of a cyber security failure in the computer network of the entity, the change or the setting to the at least one element of policy criteria of the cyber security policy.

18. The method of claim 17, further comprising:

periodically re-assessing the risk of a cyber security failure in the computer network of the entity over time as the periodic or continual collecting of the information occurs over time, wherein the re-assessing of the risk results in any of;

an update to the change or setting to at least one element of policy criteria of the cyber security policy; and

an update to the computer network changes.

19. The method of claim 16, wherein the at least one publicly accessible Internet elements comprises at least one social network, and wherein social media conversations are obtained from the at least one social network.

20. The method of claim 19, wherein at least a portion of the circumstantial or indirect information to entity information is determined from the social media conversations.

21. The method of claim 16, further comprising predicting an action of the entity based on the circumstantial or indirect information to entity information.

22. The method of claim 16, further comprising outputting a list that includes an identification of one or more entities based on the matching.