# US 12,010,152 B2 · Information security systems and methods for cyber threat event prediction and mitigation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,010,152 B2 - Document ID: US12010152B2 - Status: Granted - Kind: B2 - Application number: 17/643,407 - Filed: 2021-12-08 - Published: 2023-06-08 - Granted: 2024-06-11 - Earliest claimed: 2021-12-08 - Assignees: Bank of America Corporation - Applicants: Bank of America Corporation - Inventors: Daniel John Nunn; Sheenagh Alice Meghen - Web page: https://patentgrep.com/patent/US12010152B2 ## CPC - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/1433: {Vulnerability analysis} - H04L 63/1458: {Denial of Service} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for automatically adjusting one or more device security settings includes receiving a plurality of information feeds received over a communications network from a plurality of information sources. The method further includes accessing a particular information feed from the plurality of information feeds and accessing a predefined trigger associated with the particular information feed. The method further includes determining, by comparing the particular information feed with the predefined trigger, whether a security event is predicted to occur. When the security event is predicted to occur, the method generates an alert for display on a user device and sends, over the communications network, one or more instructions to adjust the one or more device security settings. ## Claims ### Claim 1 A system for automatically adjusting one or more device security settings, the system comprising: a memory configured to store: a plurality of information feeds received over a communications network from a plurality of information sources, the plurality of information sources comprising: a social media source; a news source; or a crypto currency price source; and a plurality of predefined triggers, each predefined trigger comprising criteria for evaluating one or more of the plurality of information feeds for possible security events; and a processor communicatively coupled to the memory, the processor configured to: access a particular information feed from the plurality of information feeds; access a particular predefined trigger associated with the particular information feed; determine, by comparing the particular information feed with criteria of the particular predefined trigger, whether a security event is predicted to occur; and when the security event is predicted to occur: generate an alert for display on a user device; and send, over the communications network, one or more instructions to adjust the one or more device security settings in order to prevent or mitigate the predicted security event, the one or more device security settings operable to: start a denial-of-service preventative operation on a network device; increase a security level of the denial-of-service preventative operation on the network device; start or adjust a geoblocking service on the network device the geoblocking service operable to prevent network traffic from one or more geographic regions; and increase a sensitivity level of a detection service running on the user device, wherein increasing the sensitivity level of the detection service running on the user device comprises increasing a sensitivity of detection of phishing attacks and turning on a multi-factor authentication. ### Claim 2 (depends on 1) The system of claim 1, wherein: the processor is further configured to: determine an Advanced Persistent Threat (APT) associated with the predicted security event; and determine a particular geographic region associated with the determined APT; and the geoblocking service on the network device is adjusted to prevent network traffic from the particular geographic region. ### Claim 3 (depends on 1) The system of claim 1, wherein the processor is further configured to send, after a predetermined amount of time, one or more additional instructions to adjust the one or more device security settings back to a previous setting. ### Claim 4 A system for automatically adjusting one or more device security settings, the system comprising: a memory configured to store: a plurality of information feeds received over a communications network from a plurality of information sources; and a plurality of predefined triggers, each predefined trigger comprising criteria for evaluating one or more of the plurality of information feeds for possible security events; and a processor communicatively coupled to the memory, the processor configured to: access a particular information feed from the plurality of information feeds; access a particular predefined trigger associated with the particular information feed; determine, by comparing the particular information feed with criteria of the particular predefined trigger, whether a security event is predicted to occur; and when the security event is predicted to occur: generate an alert for display on a user device; and send, over the communications network, one or more instructions to adjust the one or more device security settings in order to prevent or mitigate the predicted security event, wherein the one or more instructions to adjust the one or more device security settings are sent to a user device, the one or more instructions operable to increase a sensitivity level of a detection service running on the user device, wherein increasing the sensitivity level of the detection service running on the user device comprises increasing a sensitivity of detection of phishing attacks and turning on a multi-factor authentication. ### Claim 5 (depends on 4) The system of claim 4, wherein the plurality of information sources comprises: a social media source; a news source; and a crypto currency price source. ### Claim 6 (depends on 4) The system of claim 4, wherein the one or more instructions are sent over the communications network to a network device, the one or more device security settings operable to start a denial-of-service preventative operation on the network device. ### Claim 7 (depends on 4) The system of claim 4, wherein the one or more instructions are sent over the communications network to a network device, the one or more device security settings operable to increase a security level of a denial-of-service preventative operation on the network device. ### Claim 8 (depends on 4) The system of claim 4, wherein the one or more instructions are sent over the communications network to a network device, the one or more device security settings operable to start or adjust a geoblocking service on the network device, the geoblocking service operable to prevent network traffic from one or more geographic regions. ### Claim 9 (depends on 8) The system of claim 8, wherein: the processor is further configured to: determine an Advanced Persistent Threat (APT) associated with the predicted security event; and determine a particular geographic region associated with the determined APT; and the geoblocking service on the network device is adjusted to prevent network traffic from the particular geographic region. ### Claim 10 (depends on 4) The system of claim 4, wherein the processor is further configured to send, after a predetermined amount of time, one or more additional instructions to adjust the one or more device security settings back to a previous setting. ### Claim 11 A method for automatically adjusting one or more device security settings, the method comprising: receiving a plurality of information feeds over a communications network from a plurality of information sources; accessing a particular information feed from the plurality of information feeds; accessing a predefined trigger associated with the particular information feed, each predefined trigger comprising criteria for evaluating one or more of the plurality of information feeds for possible security events; determining, by comparing the particular information feed with criteria of the particular predefined trigger, whether a security event is predicted to occur; and when the security event is predicted to occur: generating an alert for display on a user device; and sending, over the communications network, one or more instructions to adjust the one or more device security settings in order to prevent or mitigate the predicted security event, wherein the one or more instructions to adjust the one or more device security settings are sent to a user device, the one or more instructions operable to increase a sensitivity level of a detection service running on the user device, wherein increasing the sensitivity level of the detection service running on the user device comprises increasing a sensitivity of detection of phishing attacks and turning on a multi-factor authentication. ### Claim 12 (depends on 11) The method of claim 11, wherein the plurality of information sources comprises: a social media source; a news source; and a crypto currency price source. ### Claim 13 (depends on 11) The method of claim 11, wherein the one or more instructions are sent over the communications network to a network device, the one or more device security settings operable to start a denial-of-service preventative operation on the network device. ### Claim 14 (depends on 11) The method of claim 11, wherein the one or more instructions are sent over the communications network to a network device, the one or more device security settings operable to increase a security level of a denial-of-service preventative operation on the network device. ### Claim 15 (depends on 11) The method of claim 11, wherein the one or more instructions are sent over the communications network to a network device, the one or more device security settings operable to start or adjust a geoblocking service on the network device, the geoblocking service operable to prevent network traffic from one or more geographic regions. ### Claim 16 (depends on 15) The method of claim 15, wherein: the method further comprises: determining an Advanced Persistent Threat (APT) associated with the predicted security event; and determining a particular geographic region associated with the determined APT; and the geoblocking service on the network device is adjusted to prevent network traffic from the particular geographic region. ### Claim 17 (depends on 11) The method of claim 11, further comprising sending, after a predetermined amount of time, one or more additional instructions to adjust the one or more device security settings back to a previous setting.