# US 12,015,629 B2 · Tailored network risk analysis using deep learning modeling > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,015,629 B2 - Document ID: US12015629B2 - Status: Granted - Kind: B2 - Application number: 17/034,241 - Filed: 2020-09-28 - Published: 2022-03-31 - Granted: 2024-06-18 - Earliest claimed: 2020-09-28 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Qihong Shao; David John Zacks; Yue Liu; Xinjun Zhang - Web page: https://patentgrep.com/patent/US12015629B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06F 18/211: Selection of the most significant subset of features - G06F 40/30: Semantic analysis - G06N 3/02: Neural networks - G06N 3/0464: Convolutional networks [CNN, ConvNet] - G06N 3/08: Learning methods - G06N 3/09: Supervised learning - H04L 43/065: related to network devices - G06F 40/284: Lexical analysis, e.g. tokenisation or collocates - G06N 3/044: Recurrent networks, e.g. Hopfield networks - G06N 3/045: Combinations of networks - H04L 41/16: using machine learning or artificial intelligence - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A method, computer system, and computer program product are provided for network risk analysis. A plurality of risk reports relating to a network device in a network are obtained, wherein each risk report is associated with a particular dimension of a plurality of dimensions of risk for the network device in the network. A count of the plurality of risk reports is determined for each dimension of the plurality of dimensions of risk. A regression model is applied to determine a risk value for the network device in the network based on the count of the plurality of risk reports for each dimension and based a role of the network device in the network. ## Claims ### Claim 1 A computer-implemented method comprising: obtaining a plurality of risk reports relating to a network device in a network, wherein each risk report is associated with a particular dimension of a plurality of dimensions of risk for the network device in the network, wherein the plurality of risk reports are obtained from one or more providers of hardware or software for the network device, and wherein the plurality of dimensions of risk include one or more of: a best practices dimension, a security advisories dimension, and a field notices dimension; determining a count of the plurality of risk reports for each dimension of the plurality of dimensions of risk; and applying a regression model to determine a risk value for the network device in the network based on the count of the plurality of risk reports for each dimension and based a role of the network device in the network. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising: generating a vector representation of each risk report of the plurality of risk reports, wherein the vector representation of each risk report represents word embeddings of the risk report; and wherein applying the regression model comprises determining the risk value based on the vector representation of each risk report. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, further comprising: training the regression model using groups of risk reports of the plurality of risk reports, the groups of risk reports representing the plurality of dimensions of risk, wherein each group of risk reports is labeled with an estimated risk value. ### Claim 4 (depends on 3) The computer-implemented method of claim 3, wherein training comprises training the regression model based on one or more of: the count of the plurality of risk reports for each dimension of risk represented in each group of risk reports, and a vector representation of each risk report in each group of risk reports, wherein the vector representation of each risk report represents word embeddings of the risk report. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the plurality of dimensions of risk further include one or more of: a software end-of-life dimension, and a hardware end-of-life dimension. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the regression model comprises a neural network including at least two hidden layers. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein the role of the network device is determined according to one or more user-provided tags, each tag describing an attribute of the network device with respect to the network. ### Claim 8 A computer system comprising: one or more computer processors; one or more computer readable storage media; program instructions stored on the one or more computer readable storage media for execution by at least one of the one or more computer processors, the program instructions comprising instructions to: obtain a plurality of risk reports relating to a network device in a network, wherein each risk report is associated with a particular dimension of a plurality of dimensions of risk for the network device in the network, wherein the plurality of risk reports are obtained from one or more providers of hardware or software for the network device, and wherein the plurality of dimensions of risk include one or more of: a best practices dimension, a security advisories dimension, and a field notices dimension; determine a count of the plurality of risk reports for each dimension of the plurality of dimensions of risk; and apply a regression model to determine a risk value for the network device in the network based on the count of the plurality of risk reports for each dimension and based a role of the network device in the network. ### Claim 9 (depends on 8) The computer system of claim 8, wherein the program instructions further comprise instructions to: generate a vector representation of each risk report of the plurality of risk reports, wherein the vector representation of each risk report represents word embeddings of the risk report; and wherein applying the regression model comprises determining the risk value based on the vector representation of each risk report. ### Claim 10 (depends on 8) The computer system of claim 8, wherein the program instructions further comprise instructions to: train the regression model using groups of risk reports of the plurality of risk reports, the groups of risk reports representing the plurality of dimensions of risk, wherein each group of risk reports is labeled with an estimated risk value. ### Claim 11 (depends on 10) The computer system of claim 10, wherein the instructions to train comprise instructions to train the regression model based on one or more of: the count of the plurality of risk reports for each dimension of risk represented in each group of risk reports, and a vector representation of each risk report in each group of risk reports, wherein the vector representation of each risk report represents word embeddings of the risk report. ### Claim 12 (depends on 8) The computer system of claim 8, wherein the plurality of dimensions of risk further include one or more of: a software end-of-life dimension, and a hardware end-of-life dimension. ### Claim 13 (depends on 8) The computer system of claim 8, wherein the regression model comprises a neural network including at least two hidden layers. ### Claim 14 (depends on 8) The computer system of claim 8, wherein the role of the network device is determined according to one or more user-provided tags, each tag describing an attribute of the network device with respect to the network. ### Claim 15 A computer program product comprising one or more computer readable storage media collectively having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to: obtain a plurality of risk reports relating to a network device in a network, wherein each risk report is associated with a particular dimension of a plurality of dimensions of risk for the network device in the network, wherein the plurality of risk reports are obtained from one or more providers of hardware or software for the network device, and wherein the plurality of dimensions of risk include one or more of: a best practices dimension, a security advisories dimension, and a field notices dimension; determine a count of the plurality of risk reports for each dimension of the plurality of dimensions of risk; and apply a regression model to determine a risk value for the network device in the network based on the count of the plurality of risk reports for each dimension and based a role of the network device in the network. ### Claim 16 (depends on 15) The computer program product of claim 15, wherein the program instructions further cause the computer to: generate a vector representation for each risk report of the plurality of risk reports, wherein the vector representation of each report represents word embeddings of the risk report; and wherein applying the regression model comprises determining the risk value based on the vector representation of each risk report. ### Claim 17 (depends on 15) The computer program product of claim 15, wherein the program instructions further cause the computer to: train the regression model using groups of risk reports of the plurality of risk reports, the groups of risk reports representing the plurality of dimensions of risk, wherein each group of risk reports is labeled with an estimated risk value. ### Claim 18 (depends on 17) The computer program product of claim 17, wherein the instructions to train comprise instructions to train the regression model based on one or more of: the count of the plurality of risk reports for each dimension of risk represented in each group of risk reports, and a vector representation of each risk report in each group of risk reports, wherein the vector representation of each risk report represents word embeddings of the risk report. ### Claim 19 (depends on 15) The computer program product of claim 15, wherein the plurality of dimensions of risk further include one or more of: a software end-of-life dimension, and a hardware end-of-life dimension. ### Claim 20 (depends on 15) The computer program product of claim 15, wherein the regression model comprises a neural network including at least two hidden layers.