# US 12,111,921 B2 · Incident response according to risk score > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,111,921 B2 - Document ID: US12111921B2 - Status: Granted - Kind: B2 - Application number: 17/691,413 - Filed: 2022-03-10 - Published: 2023-09-14 - Granted: 2024-10-08 - Earliest claimed: 2022-03-10 - Assignees: Denso Corporation - Applicants: Denso Corporation - Inventors: Carlos Mora-Golding; Ameer Kashani; Gopalakrishnan Iyer; Hirofumi Yamashita - Web page: https://patentgrep.com/patent/US12111921B2 ## CPC - G06F 21/552: {involving long-term monitoring or reporting} - B60R 25/30: Detection related to theft or to other events relevant to anti-theft systems - G06F 21/554: {involving event detection and direct action} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - B60R: VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR ## Abstract Systems, methods, and other embodiments described herein relate to improving incident response within a vehicle environment. In one embodiment, a method includes, responsive to detecting an attack on a threatened component of a computing system, gathering information about the threatened component, including at least a dependency list that specifies related components to the threatened component. The method includes determining a risk score for the attack according to a risk level associated with the attack, a risk type of the threatened component, and combined risks associated with compromising the related components. The method includes providing a report specifying information about the attack, including at least the risk score. ## Claims ### Claim 1 A security system, comprising: one or more processors; and a memory communicably coupled to the one or more processors and storing: a control module including instructions that, when executed by the one or more processors, cause the one or more processors to: responsive to detecting an attack on a threatened component of a computing system, gather information about the threatened component, including at least a dependency list that specifies related components to the threatened component, wherein the control module includes instructions to gather the information including instructions to identify information about the threatened component and generate the dependency list by identifying the related components according to interactions with the threatened component, the interactions including at least shared memory, and execution dependencies; determine a risk score for the attack according to a risk level associated with the attack, a risk type of the threatened component, and combined risks associated with compromising the related components; and provide a report specifying information about the attack, including at least the risk score. ### Claim 2 (depends on 1) The security system of claim 1, wherein the control module includes instructions to determine the risk score including instructions to identify the attack within a risk database that indicates characteristics of known threats, and instructions to generate the risk score using the characteristics including at least the risk level derived from the risk database in combination with the risk type, and the combined risks that is an effect on the related components from the attack. ### Claim 3 (depends on 1) The security system of claim 1, wherein the control module includes instructions to generate the dependency list including instructions to parse a pre-populated list to identify relationships between the threatened component and the related components. ### Claim 4 (depends on 1) The security system of claim 1, wherein the control module includes instructions to provide the report including instructions to generate an automated response to the attack when the risk score satisfies a response threshold, the automated response including at least one of controlling the threatened component, and a computing system associated with the threatened component to counteract the attack. ### Claim 5 (depends on 1) The security system of claim 1, wherein the control module includes instructions to provide the report including instructions to communicate the report to a security operations center for reporting the attack, the report including an identifier of the threatened component, characteristics of the attack including a current state of a memory stack, the dependency list, and the risk score. ### Claim 6 (depends on 1) The security system of claim 1, wherein the control module includes instructions to detect the attack including instructions to detect an anomaly in operation of the threatened component and identifying characteristics of a computing system associated with the threatened component. ### Claim 7 (depends on 1) The security system of claim 1, wherein the security system is embedded within a vehicle, and the computing system is part of the vehicle. ### Claim 8 A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to: responsive to detecting an attack on a threatened component of a computing system, gather information about the threatened component, including at least a dependency list that specifies related components to the threatened component, wherein the instructions to gather the information include instructions to identify information about the threatened component and generate the dependency list by identifying the related components according to interactions with the threatened component, the interactions including at least shared memory, and execution dependencies; determine a risk score for the attack according to a risk level associated with the attack, a risk type of the threatened component, and combined risks associated with compromising the related components; and provide a report specifying information about the attack, including at least the risk score. ### Claim 9 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the instructions to determine the risk score include instructions to identify the attack within a risk database that indicates characteristics of known threats, and instructions to generate the risk score using the characteristics including at least the risk level derived from the risk database in combination with the risk type, and the combined risks that is an effect on the related components from the attack. ### Claim 10 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the instructions to generate the dependency list include instructions to parse a pre-populated list to identify relationships between the threatened component and the related components. ### Claim 11 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the instructions to provide the report include instructions to generate an automated response to the attack when the risk score satisfies a response threshold, the automated response including at least one of controlling the threatened component, and a computing system associated with the threatened component to counteract the attack. ### Claim 12 A method, comprising: responsive to detecting an attack on a threatened component of a computing system, gathering information about the threatened component, including at least a dependency list that specifies related components to the threatened component, wherein gathering the information includes identifying information about the threatened component and generating the dependency list by identifying the related components according to interactions with the threatened component, the interactions including at least shared memory, and execution dependencies; determining a risk score for the attack according to a risk level associated with the attack, a risk type of the threatened component, and combined risks associated with compromising the related components; and providing a report specifying information about the attack, including at least the risk score. ### Claim 13 (depends on 12) The method of claim 12, wherein determining the risk score includes identifying the attack within a risk database that indicates characteristics of known threats, and generating the risk score using the characteristics including at least the risk level derived from the risk database in combination with the risk type, and the combined risks that is an effect on the related components from the attack. ### Claim 14 (depends on 12) The method of claim 12, wherein generating the dependency list includes parsing a pre-populated list to identify relationships between the threatened component and the related components. ### Claim 15 (depends on 12) The method of claim 12, wherein providing the report includes generating an automated response to the attack when the risk score satisfies a response threshold, the automated response including at least one of controlling the threatened component, and a computing system associated with the threatened component to counteract the attack. ### Claim 16 (depends on 12) The method of claim 12, wherein providing the report includes communicating the report to a security operations center for reporting the attack, the report including an identifier of the threatened component, characteristics of the attack including a current state of a memory stack, the dependency list, and the risk score. ### Claim 17 (depends on 12) The method of claim 12, wherein detecting the attack includes detecting an anomaly in operation of the threatened component and identifying characteristics of a computing system associated with the threatened component.