# US 10,320,849 B2 · Security enhancement tool > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,320,849 B2 - Document ID: US10320849B2 - Status: Granted - Kind: B2 - Application number: 15/345,195 - Filed: 2016-11-07 - Published: 2018-05-10 - Granted: 2019-06-11 - Earliest claimed: 2016-11-07 - Assignees: Bank of America Corporation - Applicants: Bank of America Corporation - Inventors: Sasidhar Purushothaman - Web page: https://patentgrep.com/patent/US10320849B2 ## CPC - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04L 63/105: {Multiple levels of security} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method comprises receiving a notification of a new system violation and determining whether the new system violation in combination with one or more of a plurality of existing system violations presents a threat to the system. The method further comprises increasing the security of the system in response to determining that the new system violation in combination with one or more of the plurality of existing system violations presents a threat to the system, wherein increasing the security of the system comprises one or more of increasing an authorization level and increasing an authentication level. ## Claims ### Claim 1 A security enhancement tool comprising: a memory configured to store: a plurality of entries, wherein each entry comprises at least: a classification of at least two or more system violations; and an indication of whether the at least two or more system violations is a threat to a system; wherein: each system violation comprises a deviation from a baseline, the baseline being assigned to a specific user of the system; and each system violation is classified as one of: an access violation; a configurational violation; an unauthorized modification; a usage violation; and an unsecured surface violation; a plurality of existing system violations, wherein each existing system violation indicates a previous attempt to compromise the system and comprises at least a classification of the existing system violation; an identification engine configured to: receive a notification of a new system violation, the new system violation being different than each existing violation, the new system violation is performed by a user of the system; and identify a component of the system threatened by the new violation; an evaluation engine configured to determine whether the new system violation in combination with one or more of the plurality of existing system violations presents a threat to the system; and an enhancement engine configured to increase the security of the system in response to determining that the new system violation in combination with one or more of the plurality of existing system violations presents a threat to the system, wherein increasing the security of the system comprises one or more of increasing an authorization level and increasing an authentication level, increasing the authorization level comprises assigning a baseline to the user, the baseline corresponds to activities on the system that the user is approved to participate in, activity of the user that deviates from the baseline triggers the new system violation. ### Claim 2 (depends on 1) The security enhancement tool of claim 1, wherein the threatened component is part of: an application stack of the system; a middleware stack of the system; a database stack of the system; an operating system stack of the system; a hardware stack of the system; and a network stack of the system. ### Claim 3 (depends on 1) The security enhancement tool of claim 1, wherein the threat to the system is one or more of: a loss of confidentiality of the system; a loss of integrity of the system; a loss of availability of the system; a loss of accountability of the system; a damage to a reputation of the system; a non-compliance issue; and a violation of privacy. ### Claim 4 (depends on 1) The security enhancement tool of claim 1, wherein increasing the authentication level comprises requesting an authentication, in addition to but different from a previous authentication, wherein the authentication may comprise one or more of: a password; a code sent to an electronic device; a selection of a visual image; and a security question. ### Claim 5 (depends on 1) The security enhancement tool of claim 1, wherein increasing the authorization level comprises prompting a user of the system to re-authenticate one or more times. ### Claim 6 (depends on 1) The security enhancement tool of claim 1, wherein increasing the security of the system may correspond to one or more of: reducing system requests from unauthorized users of the system; and permitting system responses to authorized users. ### Claim 7 A method comprising: receiving, by an interface associated with a system, a notification of a new system violation, the new system violation being different than each of a plurality of existing system violations, wherein the new system violation and the plurality of existing system violations each indicate an attempt to compromise the system, the new system violation is performed by a user of the system; determining, by at least one processor associated with the system, a component of the system threatened by the new violation; determining, by the at least one processor, whether the new system violation in combination with one or more of the plurality of existing system violations presents a threat to the system by: determining a plurality of combinations based on the new system violation and one or more of the plurality of existing system violations; and identifying, within a memory associated with the system, an entry comprising one of the plurality of combinations, wherein each entry comprises a classification of at least two or more system violations and an indication of whether the at least two or more system violations is a threat to the system, wherein: each system violation indicates a deviation from a baseline, the baseline being assigned to a specific user of the system; and each system violation is classified as one of: an access violation; a configurational violation; an unauthorized modification; a usage violation; and an unsecured surface violation; and increasing the security of the system in response to determining that the new system violation in combination with one or more of the plurality of existing system violations presents a threat to the system, wherein increasing the security of the system comprises one or more of increasing an authorization level and increasing an authentication level, increasing the authorization level comprises assigning a baseline to the user, the baseline corresponds to activities on the system that the user is approved to participate in, activity of the user that deviates from the baseline triggers the new system violation. ### Claim 8 (depends on 7) The method of claim 7, wherein the threatened component is part of: an application stack of the system; a middleware stack of the system; a database stack of the system; an operating system stack of the system; a hardware stack of the system; and a network stack of the system. ### Claim 9 (depends on 7) The method of claim 7, wherein the threat to the system is one or more of: a loss of confidentiality of the system; a loss of integrity of the system; a loss of availability of the system; a loss of accountability of the system; a damage to a reputation of the system; a non-compliance issue; and a violation of privacy. ### Claim 10 (depends on 7) The method of claim 7, wherein increasing the authentication level comprises requesting an authentication, in addition to but different from a previous authentication, wherein the authentication may comprise one or more of: a password; a code sent to an electronic device; a selection of a visual image; and a security question. ### Claim 11 (depends on 7) The method of claim 7, wherein increasing the authorization level comprises prompting a user of the system to re-authenticate one or more times. ### Claim 12 (depends on 7) The method of claim 7, wherein increasing the security of the system may correspond to one or more of: reducing system requests from unauthorized users of the system; and permitting system responses to authorized users. ### Claim 13 One or more computer-readable non-transitory storage media embodying software that is operable when executed to: receive a notification of a new system violation, the new system violation being different than each of a plurality of existing system violations, wherein the new system violation and the plurality of existing system violations each indicate an attempt to compromise a system, the new system violation is performed by a user of the system; determine a component of the system threatened by the new violation; determine whether the new system violation in combination with one or more of the plurality of existing system violations presents a threat to the system by: determining a plurality of combinations based on the new system violation and one or more of the plurality of existing system violations; and identifying, within a memory associated with the system, an entry comprising one of the plurality of combinations, wherein each entry comprises a classification of at least two or more system violations and an indication of whether the at least two or more system violations is a threat to the system, wherein: each system violation indicates a deviation from a baseline, the baseline being assigned to a specific user of the system; and each system violation is classified as one of: an access violation; a configurational violation; an unauthorized modification; a usage violation; and an unsecured surface violation; and increase the security of the system in response to determining that the new system violation in combination with one or more of the plurality of existing system violations presents a threat to the system, wherein increasing the security of the system comprises one or more of increasing an authorization level and increasing an authentication level, increasing the authorization level comprises assigning a baseline to the user, the baseline corresponds to activities on the system that the user is approved to participate in, activity of the user that deviates from the baseline triggers the new system violation. ### Claim 14 (depends on 13) The media of claim 13, wherein increasing the authentication level comprises requesting an authentication, in addition to but different from a previous authentication, wherein the authentication may comprise one or more of: a password; a code sent to an electronic device; a selection of a visual image; and a security question. ### Claim 15 (depends on 13) The media of claim 13, wherein increasing the authorization level comprises prompting a user of the system to re-authenticate one or more times. ### Claim 16 (depends on 13) The media of claim 13, wherein increasing the security of the system may correspond to one or more of: reducing system requests from unauthorized users of the system; and permitting system responses to authorized users. ### Claim 17 (depends on 13) The media of claim 13, wherein the threat to the system is one or more of: a loss of confidentiality of the system; a loss of integrity of the system; a loss of availability of the system; a loss of accountability of the system; a damage to financials associated with the system; a damage to a reputation of the system; a non-compliance issue; and a violation of privacy. ### Claim 18 (depends on 13) The media of claim 13, wherein: the new system violation is performed by a user of the system; increasing the authorization level comprises assigning a baseline to the user, wherein the baseline corresponds to activities on the system that the user is approved to participate in; and activity of the user that deviates from the baseline triggers the new system violation.