US 11,777,986 B2Granted

Systems and methods for AIDA based exploit selection

AssigneeKnowBe4, Inc.

InventorsAlin Irimie, Stu Sjouwerman, Greg Kras, Eric Sites

Life of this patent

Estimating the term…

Loading patent…

Abstract

Systems and methods of embodiments are described of a campaign controller that establishes a model for using a plurality of types of exploits based on at least results of simulated phishing communications using those exploits, and uses the model to communicate a first simulated phishing communication to one or more devices of a user where the type of exploit used for the first simulated phishing communication is selected using the model. The campaign controller applies either artificial intelligence or machine learning to the results of simulated phishing communications to establish the model. The campaign controller selects the exploit by applying either artificial intelligence or machine learning to one or more attributes of the user and/or one or more responses from the user.

Claims30

Dependent claims

A method for selecting a type of exploit for a simulated phishing communication, the method comprising:

training a model by applying machine learning on at least one or more attributes of a plurality of users and one or more responses of a plurality of users from results of simulated phishing communications using a plurality of types of exploits, the model comprising a neural network trained to take as input one or more attributes of a user and one or more responses of the user and provides as output a type of exploit to use for that user responsive to the input;
establishing, by a campaign controller, the model for selecting the type of exploit from a plurality of types of exploits to use in a simulated phishing communication to the user;
identifying, by the campaign controller, the user for which to communicate the simulated phishing communication and one or more attributes of the user and one or more responses of the user to one or more simulated phishing communications;
providing, by the campaign controller, each of the one or more attributes of the user and the one or more responses of the user as input to the model;
receiving from the model, by the campaign controller responsive to providing the input, an output identifying a first type of exploit from the plurality of types of exploits to use for the user in the simulated phishing communication;
selecting, by the campaign controller, the first type of exploit from the plurality of types of exploits, identified by the campaign controller from output of the model received by the campaign controller from the model;
communicating, by the campaign controller, to the one or more devices of the user the simulated phishing communication comprising the first type of exploit selected by the campaign controller from output of the model.

4 more elements

A system for selecting a type of exploit for a simulated phishing communication, the system comprising:

a model, stored in memory, and trained by applying machine learning to one or more attributes of a plurality of users and one or more responses of a plurality of users from results of simulated phishing communications using a plurality of types of exploits, wherein the model i-s comprises a neural network trained to take as input at least one or more attributes of a user and one or more responses of the user and provides as output a type of exploit to use for that user responsive to the input;
a campaign controller executable on a processor, coupled to the memory and configured to:
identify a user for which to communicate the simulated phishing communication and one or more attributes of the user and one or more responses of the user to one or more simulated phishing communications;
provide each of the one or more attributes of the user and the one or more responses of the user as input to the model;
receive from the model, responsive to the input, an output identifying a first type of exploit from the plurality of types of exploits to use for the user in the simulated phishing communication;
select a first type of exploit from the plurality of types of exploits, identified by the campaign controller from output received by the campaign controller from the model;
and
communicate to the one or more devices of the user the simulated phishing communication comprising the first type of exploit.

5 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/829,732Filed 1 Dec 2017
Published: US 2019/0173915 A16 Jun 2019
Granted: 3 Oct 2023
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

H04L 63/1483
Countermeasures against malicious traffic: service impersonation, e.g. phishing, pharming or web spoofing
G06N 3/0499
Architecture, e.g. interconnection topology: feedforward networks
G06N 3/09
Learning methods: supervised learning
H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection