# US 12,111,933 B2 · System and method for dynamically updating existing threat models based on newly identified active threats > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,111,933 B2 - Document ID: US12111933B2 - Status: Granted - Kind: B2 - Application number: 17/650,168 - Filed: 2022-02-07 - Published: 2023-08-10 - Granted: 2024-10-08 - Earliest claimed: 2022-02-07 - Assignees: Bank of America Corporation - Applicants: Bank of America Corporation - Inventors: Jack Lawson Bishop, III; Robert Hurlbut; Jason Conrad Starin - Web page: https://patentgrep.com/patent/US12111933B2 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 21/562: {Static detection} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 40/194: Calculation of difference between files - G06F 40/30: Semantic analysis - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system includes a database, a memory, and a processor. The database stores data associated with a known security threat. The memory includes a threat model associated with a software application. The processor identifies, based on natural language processing of the data associated with the known security threat, one or more attributes of software susceptible to the known security threat. The processor also identifies, based on natural language processing of the threat model, one or more attributes of the software application. The processor additionally determines, based on a comparison between the one or more attributes of software susceptible to the known security threat and the one or more attributes of the software application, that the software application is susceptible to the known security threat. In response, the processor updates the threat model to reflect the susceptibility of the software application to the known security threat. ## Claims ### Claim 1 A system comprising: a database comprising data associated with a known security threat, wherein the data for the known security threat comprises a first description associated with the known security threat; a memory comprising a threat model associated with a software application; and a hardware processor communicatively coupled to the memory and to the database, the hardware processor configured to: monitor the database at a regular interval to determine whether the database receives data associated with a new security threat, wherein the data associated with the new security threat comprises a new description associated with the new security threat; in response to determining that the data associated with the new security threat is added to the database, the processor is configured to: extract, based on natural language processing of the first description, information associated with the first description; extract, based on natural language processing of the new description, information associated with the new description; determine, based on a comparison of the information associated with the first description and the information associated with the new description, that the new security threat does not correspond to the known security threat in the database; in response to determining that the new security threat does not correspond to the known security threat in the database, the processor is further configured to: identify, based on natural language processing of the new description associated with the new security threat, one or more attributes of software susceptible to the new security threat; identify, based on natural language processing of the threat model, one or more attributes of the software application; determine, based on a comparison between the one or more attributes of software susceptible to the new security threat and the one or more attributes of the software application, that the software application is susceptible to the new security threat; and in response to determining that the software application is susceptible to the new security threat, update the threat model to reflect the susceptibility of the software application to the new security threat. ### Claim 2 (depends on 1) The system of claim 1, wherein determining that the software application is susceptible to the new security threat comprises determining that the one or more attributes of the software susceptible to the new security threat match the one or more attributes of the software application. ### Claim 3 (depends on 1) The system of claim 1, wherein determining that the software application is susceptible to the new security threat comprises: determining a similarity score between the one or more attributes of the software susceptible to the new security threat and the one or more attributes of the software application; and determining that the similarity score is greater than a threshold. ### Claim 4 (depends on 3) The system of claim 3, wherein determining the similarity score comprises applying a machine learning clustering algorithm. ### Claim 5 (depends on 1) The system of claim 1, wherein in response to determining that the software application is susceptible to the new security threat, the hardware processor is further configured to generate an alert indicating that the software application is susceptible to the new security threat. ### Claim 6 (depends on 1) The system of claim 1, wherein the one or more attributes of the software application comprise at least one of a function or a library used within the software application. ### Claim 7 (depends on 1) The system of claim 1, wherein: the memory further comprises a second threat model associated with a second software application; and the hardware processor is further configured to: identify, based on natural language processing of the second threat model, one or more attributes of the second software application; and determine, based on a comparison between the one or more attributes of the software susceptible to the known security threat and the one or more attributes of the second software application, that the second software application is not susceptible to the known security threat. ### Claim 8 A method comprising: monitoring a database comprising data associated with a known security threat at a regular interval to determine whether the database receives data associated with a new security threat, wherein the data associated with the known security threat comprises a first description associated with the known security threat, wherein the data associated with the new security threat comprises a new description associated with the new security threat; in response to determining that the new security threat is added to the database, the method further comprises: extracting, based on natural language processing of the first description, information associated with the first description; extracting, based on natural language processing of the new description, information associated with the new description; determining, based on a comparison of the information associated with the first description and the information associated with the new description, that the new security threat does not correspond to the known security threat in the database; in response to determining that the new security threat does not correspond to the known security threat in the database, the method further comprises: identifying, based on natural language processing of the new description associated with the new security threat, one or more attributes of software susceptible to the new security threat; identifying, based on natural language processing of a threat model associated with a software application, one or more attributes of the software application; determining, based on a comparison between the one or more attributes of software susceptible to the new security threat and the one or more attributes of the software application, that the software application is susceptible to the known security threat; and in response to determining that the software application is susceptible to the new security threat, updating the threat model to reflect the susceptibility of the software application to the new security threat. ### Claim 9 (depends on 8) The method of claim 8, wherein determining that the software application is susceptible to the new security threat comprises determining that the one or more attributes of software susceptible to the new security threat match the one or more attributes of the software application. ### Claim 10 (depends on 8) The method of claim 8, wherein determining that the software application is susceptible to the new security threat comprises: determining a similarity score between the one or more attributes of software susceptible to the new security threat and the one or more attributes of the software application; and determining that the similarity score is greater than a threshold. ### Claim 11 (depends on 10) The method of claim 10, wherein determining the similarity score comprises applying a machine learning clustering algorithm. ### Claim 12 (depends on 8) The method of claim 8, wherein in response to determining that the software application is susceptible to the new security threat, the method further includes generating an alert indicating that the software application is susceptible to the new security threat. ### Claim 13 (depends on 8) The method of claim 8, wherein the one or more attributes of the software application comprise at least one of a function or a library used within the software application. ### Claim 14 (depends on 8) The method of claim 8, further comprising: identifying, based on natural language processing of a second threat model associated with a second software application, one or more attributes of the second software application; and determining, based on a comparison between the one or more attributes of software susceptible to the new security threat and the one or more attributes of the second software application, that the second software application is not susceptible to the new security threat. ### Claim 15 A non-transitory computer-readable medium comprising instructions that, when executed by a hardware processor, cause the processor to: monitor a database comprising data associated with a known security threat at a regular interval to determine whether the database receives data associated with a new security threat, wherein the data associated with the known security threat comprises a first description associated with the known security threat, wherein the data associated with the new security threat comprises a new description associated with the new security threat; in response to determining that the new security threat is added to the database, the instructions when executed by the processor, cause the processor to: extract, based on natural language processing of the first description, information associated with the first description; extract, based on natural language processing of the new description, information associated with the new description; determine, based on a comparison of the information associated with the first description and the information associated with the new description, that the new security threat does not correspond to the known security threat in the database; in response to determining that the new security threat does not correspond to the known security threat in the database, the instructions when executed by the processor, cause the processor to: identify, based on natural language processing of the new description associated with the new security threat, one or more attributes of software susceptible to the new security threat; identify, based on natural language processing of a threat model associated with a software application, one or more attributes of the software application; determine, based on a comparison between the one or more attributes of software susceptible to the new security threat and the one or more attributes of the software application, that the software application is susceptible to the new security threat; and in response to determining that the software application is susceptible to the new security threat, update the threat model to reflect the susceptibility of the software application to the known security threat. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein determining that the software application is susceptible to the new security threat comprises determining that the one or more attributes of software susceptible to the new security threat match the one or more attributes of the software application. ### Claim 17 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein determining that the software application is susceptible to the new security threat comprises: determining a similarity score between the one or more attributes of software susceptible to the new security threat and the one or more attributes of the software application; and determining that the similarity score is greater than a threshold. ### Claim 18 (depends on 17) The non-transitory computer-readable medium of claim 17, wherein determining the similarity score comprises applying a machine learning clustering algorithm. ### Claim 19 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein in response to determining that the software application is susceptible to the new security threat, the instructions, when executed by the hardware processor, cause the processor to generate an alert indicating that the software application is susceptible to the known security threat. ### Claim 20 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the instructions, when executed by the hardware processor, further cause the processor to: identify, based on natural language processing of a second threat model associated with a second software application, one or more attributes of the second software application; and determine, based on a comparison between the one or more attributes of software susceptible to the new security threat and the one or more attributes of the second software application, that the second software application is not susceptible to the new security threat.