# US 10,454,958 B2 · System and method for assessing cybersecurity awareness

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,454,958 B2
- Document ID: US10454958B2
- Status: Granted
- Kind: B2
- Application number: 15/291,331
- Filed: 2016-10-12
- Published: 2017-04-13
- Granted: 2019-10-22
- Earliest claimed: 2015-10-12
- Assignees: Verint Systems Ltd.
- Applicants: Verint Systems Ltd.; B. G. Negev Technologies and Applications Ltd.
- Inventors: Asaf Shabtai; Rami Puzis; Lior Rokach; Liran Orevi; Genady Malinsky; Ziv Katzir; Ron Bitton
- Web page: https://patentgrep.com/patent/US10454958B2

## CPC

- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G06F 21/552: {involving long-term monitoring or reporting}
- G06N 20/00: Machine learning
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- G06F 2221/034: Test or assess a computer or a system
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

Described embodiments include a system that includes a monitoring agent, configured to automatically monitor usage of a computing device by a user, and a processor. The processor is configured to compute, based on the monitoring, a score indicative of a cyber-security awareness of the user, and to generate an output indicative of the score.

## Claims

### Claim 1

A system, comprising:
a monitoring agent, configured to automatically monitor usage of a computing device by a user; and
a processor, configured:
to receive an input that includes a type of cyber-security attack,
to compute a characteristic vector of coefficients, each of which quantifies competence of the user in a different one of a plurality of cyber-security areas based on the monitored usage of the computing device by the user;
to compute, based on the monitoring, a score indicative of a cyber-security awareness of the user with respect to the type of attack, wherein the score is computed based on the characteristic vector of coefficients and respective weightings of each of the coefficients with respect to type of attack, wherein each of the respective weightings quantifies importance of a corresponding coefficient and a corresponding cyber-security area for the type of attack; and
to generate an output indicative of the score.

### Claim 2 (depends on 1)

The system according to claim 1, wherein the monitoring agent comprises a network probe configured to monitor the usage of the computing device by monitoring network traffic exchanged with the computing device.

### Claim 3 (depends on 1)

The system according to claim 1, wherein the monitoring agent comprises a software agent installed on the computing device.

### Claim 4 (depends on 1)

The system according to claim 1, wherein the processor is configured to compute the score by:
recommending a simulated cyber-security attack, and
computing the score, based on a response of the user to the simulated attack.

### Claim 5 (depends on 1)

The system according to claim 1, wherein the processor is configured to compute the score by computing, using the weightings, a weighted sum of the coefficients.

### Claim 6 (depends on 1)

The system according to claim 1, wherein the processor is configured to use a machine-learned model to compute the characteristic vector of coefficients.

### Claim 7

A method, comprising:
receiving an input that includes a type of cyber-security attack;
using a monitoring agent, automatically monitoring usage of a computing device by a user;
computing a characteristic vector of coefficients, each of which quantifies competence of the user in a different one of a plurality of cyber-security areas based on the monitored usage of the computing device by the user;
based on the monitoring, computing a score indicative of a cyber-security awareness of the user with respect to a type of attach, wherein the score is computed based on the characteristic vector of coefficients and respective weightings of each of the coefficients with respect to the type of attack, wherein each of the respective weightings quantifies importance of a corresponding coefficient and a corresponding cyber-security area for the type of attack; and
generating an output indicative of the score.

### Claim 8 (depends on 7)

The method according to claim 7, wherein monitoring the usage of the computing device comprises monitoring the usage of the computing device by monitoring network traffic exchanged with the computing device.

### Claim 9 (depends on 7)

The method according to claim 7, wherein the monitoring agent includes a software agent installed on the computing device.

### Claim 10 (depends on 7)

The method according to claim 7, wherein computing the score comprises:
recommending a simulated cyber-security attack, and
computing the score, based on a response of the user to the simulated attack.

### Claim 11 (depends on 7)

The method according to claim 7, wherein computing the score comprises computing the score by computing, using the weightings, a weighted sum of the coefficients.

### Claim 12 (depends on 7)

The method according to claim 7, wherein computing the characteristic vector of coefficients comprises using a machine-learned model to compute the characteristic vector of coefficients.

### Claim 13 (depends on 7)

The method according to claim 7, wherein computing the characteristic vector of coefficients comprises computing the characteristic vector of coefficients by mapping a plurality of features, obtained from the monitoring, to the coefficients.

### Claim 14 (depends on 13)

The method according to claim 13, further comprising, prior to computing the characteristic vector:
using the monitoring agent, by monitoring at least one user, obtaining a first plurality of features,
by monitoring the at least one user using a monitoring technique that is not used by the monitoring agent, obtaining a second plurality of features, and
calibrating the mapping such that a characteristic vector of coefficients mapped from the first plurality of features is within a threshold of similarity of a characteristic vector of coefficients mapped from the second plurality of features.

### Claim 15 (depends on 13)

The method according to claim 13, further comprising, prior to computing the characteristic vector, calibrating the mapping, by:
using characteristic vectors of coefficients obtained from the mapping, computing respective scores, for a plurality of users, that indicate awareness of the users with respect to a particular type of cyber-security attack, and
checking a correlation between the scores and respective responses of the users to a simulated attack of the particular type.