Systems and methods for an at-risk system identification via analysis of online hacker community discussions
AssigneeArizona Board of Regents on behalf of Arizona State University
InventorsEric Nunes, Jana Shakarian, Paulo Shakarian, Mohammed Almukaynizi, Harshdeep Singh, Gerardo Simari, Anant Sharma
Life of this patent
Estimating the term…
Abstract
Various embodiments of systems and methods for an at-risk system identification via analysis of discussions from various online hacker communities are disclosed herein.
Claims20
A method for computer-implemented prediction of whether systems are at-risk of being targeted by malicious hackers prior to a cyber-attack occurring, comprising:
- executing by a processor, operations including:
- accessing input data, the input data including
- constructs comprising a set of facts observed from a knowledge base of historical hacker discussions, strict rules including logical combinations of the set of facts deemed to always be true, and defeasible rules, and
- features of a hacker discussion including at least one hacker discussing a vulnerability;
- constructing, using an argumentation model for a given query using heuristics, arguments for and against each of a set of system components being of risk to exploitation based on the hacker discussion, the argumentation model constraining the set of system components to a reduced set of system components;
- and
- executing a machine learning model configured to use as input the reduced set of components and the query to identify and generate a risk assessment for a system associated with the reduced set of components that is susceptible to the vulnerability and at risk to a cyber-attack that has not yet occurred, identification of the system being based on a totality of its own stack of one or more of the set of system components.
A system for computer-implemented prediction of of at-risk systems prior to a cyber-attack occurring, comprising:
- a processor in communication with a tangible storage medium storing instructions that are executed by the processor such that the processor:
- accesses input data including a set of facts, rules, and a query relevant to a system, the set of facts instantiated by hacker communication discussing a vulnerability;
- generates, using the set of facts as input to an argumentation model which uses heuristics, all arguments for and against each of a set of components of a system being of risk to exploitation based on the hacker communication to constrain the set of components to a reduced set of components;
- conducts machine learning using as input the reduced set of components and the query to identify a system associated with the reduced set of components that is susceptible to the vulnerability and at risk to a cyber-attack, identification of the system being prior to the cyber-attack occurring.
A tangible, non-transitory, computer-readable media having instructions encoded thereon, such that a processor, executing the instructions, is configured to perform operations to predict at-risk systems prior to a cyber-attack occurring, the operations including:
- constructing arguments for a given query associated with a set of at-risk system components using elements in a predetermined knowledge base, the arguments for and against each of the set of components of a system being of risk to exploitation based on a hacker communication to constrain the set of components to a reduced set of components;
- and
- conducting machine learning using as input the reduced set of components and the query to identify a system associated with the reduced set of components that is susceptible to the vulnerability and at risk to a cyber-attack, identification of the system being prior to the cyber-attack occurring.
Dependencies are inferred from the claim text.