# US 11,451,550 B2 · System for automated electronic data exfiltration path identification, prioritization, and remediation

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,451,550 B2
- Document ID: US11451550B2
- Status: Granted
- Kind: B2
- Application number: 16/856,316
- Filed: 2020-04-23
- Published: 2021-10-28
- Granted: 2022-09-20
- Earliest claimed: 2020-04-23
- Assignees: Bank of America Corporation
- Applicants: Bank of America Corporation
- Inventors: Brandon Sloane; Michael Thomas Malarkey
- Web page: https://patentgrep.com/patent/US11451550B2

## CPC

- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 16/9024: {Graphs; Linked lists (G06F16/9027 takes precedence)}
- G06N 20/00: Machine learning
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/18: {using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215)}
- G06Q 50/265: {Personal security, identity or safety}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

A system for identifying and remediating data exfiltration paths is provided. In particular, the system may generate a map of the network environment which identifies all of the possible pathways and the steps of such pathways through which sensitive data may be exfiltrated. The system may then evaluate the potential impact associated with each exfiltration pathway and generate a prioritization scheme which may sort the pathways by their potential impacts. Based on the prioritization scheme, the system may, via a machine learning engine, provide one or more remediation processes that may be executed to reduce the chance of data exfiltration through certain potentially high-impact pathways.

## Claims

### Claim 1

A system for identifying and remediating data exfiltration paths, the system comprising:
a memory with computer-readable program code stored thereon;
a communication device; and
a processing circuitry operatively coupled to the memory and the communication device, wherein the processing circuitry is configured to execute the computer-readable program code to:
identify one or more sets of target data for exfiltration;
generate a map of exfiltration pathways for each of the one or more sets of target data;
identify one or more implemented data security controls and one or more unimplemented data security controls for each exfiltration pathway in the map of exfiltration pathways;
generate a prioritization scheme based on the map of exfiltration pathways, wherein generating the prioritization scheme comprises generating an exfiltration score for each exfiltration pathway, wherein the exfiltration score is based on the one or more implemented data security controls, the one or more unimplemented data security controls, and an exfiltration frequency, wherein the exfiltration frequency comprises a number of times exfiltration was attempted and a number of times exfiltration succeeded; and
display to a user one or more recommendations based on the prioritization scheme.

### Claim 2 (depends on 1)

The system according to claim 1, wherein displaying the one or more recommendations comprises:
determining that implementing the one or more unimplemented data security controls would increase the exfiltration score for an exfiltration pathway; and
providing a recommendation to implement the one or more unimplemented data security controls.

### Claim 3 (depends on 1)

The system according to claim 1, wherein the map of exfiltration pathways is a graph database comprising one or more nodes representing structures through which the target data passes.

### Claim 4 (depends on 3)

The system according to claim 3, wherein the one or more nodes each represent a hardware device or computing system.

### Claim 5 (depends on 3)

The system according to claim 3, wherein the one or more nodes each represent an application.

### Claim 6 (depends on 3)

The system according to claim 3, wherein the one or more nodes each represent a logical layer.

### Claim 7

A computer program product for identifying and remediating data exfiltration paths, the computer program product comprising at least one non-transitory computer readable medium having computer-readable program code portions embodied therein, the computer-readable program code portions comprising executable code portions for:
identifying one or more sets of target data for exfiltration;
generating a map of exfiltration pathways for each of the one or more sets of target data;
identifying one or more implemented data security controls and one or more unimplemented data security controls for each exfiltration pathway in the map of exfiltration pathways;
generating a prioritization scheme based on the map of exfiltration pathways, wherein generating the prioritization scheme comprises generating an exfiltration score for each exfiltration pathway, wherein the exfiltration score is based on the one or more implemented data security controls, the one or more unimplemented data security controls, and an exfiltration frequency, wherein the exfiltration frequency comprises a number of times exfiltration was attempted and a number of times exfiltration succeeded; and
displaying to a user one or more recommendations based on the prioritization scheme.

### Claim 8 (depends on 7)

The computer program product according to claim 7, wherein displaying the one or more recommendations comprises:
determining that implementing the one or more unimplemented data security controls would increase the exfiltration score for an exfiltration pathway; and
providing a recommendation to implement the one or more unimplemented data security controls.

### Claim 9 (depends on 7)

The computer program product according to claim 7, wherein the map of exfiltration pathways is a graph database comprising one or more nodes representing structures through which the target data passes.

### Claim 10 (depends on 9)

The computer program product according to claim 9, wherein the one or more nodes each represent a hardware device or computing system.

### Claim 11 (depends on 9)

The computer program product according to claim 9, wherein the one or more nodes each represent an application.

### Claim 12

A computer-implemented method for identifying and remediating data exfiltration paths, wherein the computer-implemented method comprises:
identifying one or more sets of target data for exfiltration;
generating a map of exfiltration pathways for each of the one or more sets of target data;
identifying one or more implemented data security controls and one or more unimplemented data security controls for each exfiltration pathway in the map of exfiltration pathways;
generating a prioritization scheme based on the map of exfiltration pathways, wherein generating the prioritization scheme comprises generating an exfiltration score for each exfiltration pathway, wherein the exfiltration score is based on the one or more implemented data security controls, the one or more unimplemented data security controls, and an exfiltration frequency, wherein the exfiltration frequency comprises a number of times exfiltration was attempted and a number of times exfiltration succeeded; and
displaying to a user one or more recommendations based on the prioritization scheme.

### Claim 13 (depends on 12)

The computer-implemented method according to claim 12, wherein displaying the one or more recommendations comprises:
determining that implementing the one or more unimplemented data security controls would increase the exfiltration score for an exfiltration pathway; and
providing a recommendation to implement the one or more unimplemented data security controls.

### Claim 14 (depends on 12)

The computer-implemented method according to claim 12, wherein the map of exfiltration pathways is a graph database comprising one or more nodes representing structures through which the target data passes.

### Claim 15 (depends on 14)

The computer-implemented method according to claim 14, wherein the one or more nodes each represent a hardware device or computing system.

### Claim 16 (depends on 14)

The computer-implemented method according to claim 14, wherein the one or more nodes each represent an application.

### Claim 17 (depends on 14)

The computer-implemented method according to claim 14, wherein the one or more nodes each represent a logical layer.