# US 12,184,697 B2 · AI-driven defensive cybersecurity strategy analysis and recommendation system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,184,697 B2 - Document ID: US12184697B2 - Status: Granted - Kind: B2 - Application number: 17/392,232 - Filed: 2021-08-02 - Published: 2022-07-14 - Granted: 2024-12-31 - Earliest claimed: 2015-10-28 - Assignees: Qomplx LLC - Applicants: Qomplx LLC - Inventors: Jason Crabtree; Andrew Sellers - Web page: https://patentgrep.com/patent/US12184697B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 16/2477: {Temporal data queries} - G06F 16/951: Indexing; Web crawling techniques - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06N 3/006: based on simulated virtual individual or collective life forms, e.g. social simulations or particle swarm optimisation [PSO] - G06N 3/126: Evolutionary algorithms, e.g. genetic algorithms or genetic programming - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A system and method for automated cybersecurity defensive strategy analysis that predicts the evolution of new cybersecurity attack strategies and makes recommendations for cybersecurity improvements to networked systems based on a cost/benefit analysis. The system and method use machine learning algorithms to run simulated attack and defense strategies against a model of the networked system created using a directed graph. Recommendations are generated based on an analysis of the simulation results against a variety of cost/benefit indicators. ## Claims ### Claim 1 A system for automated cybersecurity defensive strategy analysis and recommendations, comprising: an attack implementation engine comprising a first plurality of programming instructions stored in a memory of, and operating on a processor of, a computing device, wherein the first plurality of programming instructions, when operating on the processor, cause the computing device to: execute a cyberattack on a network under test; and gather system information about the operation of the network under test during the cyberattack, the system information comprising information about the sequence of events and response of affected devices during the cyberattack; a malware detection system comprising a second plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the second plurality of programming instructions, when operating on the processor, cause the computing device to: capture packets from the network under test; analyze the captured packets from the network under test; and classify the captured packets as benign or malicious, wherein the captured packets may be classified individually or in some combination, based on their contents and the metadata of the packets; a security logic engine comprising a third plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the third plurality of programming instructions, when operating on the processor, cause the computing device to: classify captured packets with known malicious behavior as malware; analyze a risk of level of detected malware; and report detected malware to administrators; a machine learning simulator comprising a fourth plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the fourth plurality of programming instructions, when operating on the processor, cause the computing device to: use the system information, the classification of captured packets, and reported malware to initiate an iterative simulation of a cyberattack strategy sequence, each iteration comprising a simulated attack on a model of the network under test and a simulated defense against the simulated attack, each simulated attack being generated by a machine learning algorithm; obtain a simulation result comprising the cyberattack strategy sequence and a probability of success of the attack and the defense in each iteration; a recommendation engine comprising a fifth plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the fifth plurality of programming instructions, when operating on the processor, cause the computing device to: compare the simulation result against one or more cost factors and one or more benefit factors; and determine a cybersecurity improvement recommendation for the network under test based on the comparison. ### Claim 2 (depends on 1) The system of claim 1, wherein the system information further comprises system logs of one or more of the affected devices. ### Claim 3 (depends on 1) The system of claim 1, wherein the first machine learning algorithm is a reinforcement learning algorithm. ### Claim 4 (depends on 1) The system of claim 1, further comprising a second machine learning algorithm, wherein each simulated defense is generated by the second machine learning algorithm, such that the first and second machine learning algorithms compete against each other in the simulation. ### Claim 5 (depends on 4) The system of claim 4, wherein the second machine learning algorithm is an evolutionary algorithm. ### Claim 6 (depends on 5) The system of claim 5, wherein the machine learning simulation is an online simulation and the evolutionary algorithm is a continual online evolutionary planning algorithm. ### Claim 7 (depends on 6) The system of claim 6, wherein the system is run iteratively, with each iteration resulting in a new cybersecurity improvement recommendation, which is implemented on the network under test prior to the next iteration. ### Claim 8 (depends on 1) The system of claim 1, wherein the cybersecurity improvement recommendation is implemented on the network under test. ### Claim 9 A method for automated cybersecurity defensive strategy analysis and recommendations, comprising the steps of: using an attack implementation engine: executing a cyberattack on a network under test; and gathering system information about the operation of the network under test during the cyberattack, the system information comprising information about the sequence of events and response of affected devices during the cyberattack; using a malware detection system comprising a memory storing instructions that are executed on a processor of a computing system to: capture packets from the network under test, the packets having been sent to or from another device on the network under test during the cyberattack; analyze the captured packets; and classify the captured packets as benign or malicious, wherein the captured packets may be classified individually or in some combination, based on their contents and the metadata of the packets; using a security logic engine: classifying captured packets with known malicious behavior as malware; analyzing a risk of level of detected malware; and reporting detected malware to administrators; and using a machine learning simulator implemented as programming instructions stored in the memory and executing on the processor: using the system information, the classification of captured packets, and reported malware to initiating an iterative simulation of a cyberattack strategy sequence, each iteration comprising a simulated attack on a model of the network under test and a simulated defense against the simulated attack, each simulated attack being generated by a first machine learning algorithm; and obtaining a simulation result comprising the cyberattack strategy sequence and a probability of success of the attack and the defense in each iteration; and using a recommendation engine: comparing the simulation result against one or more cost factors and one or more benefit factors; and determining a cybersecurity improvement recommendation for the network under test based on the comparison. ### Claim 10 (depends on 9) The method of claim 9, wherein the system information further comprises system logs of one or more of the affected devices. ### Claim 11 (depends on 9) The method of claim 9, wherein the first machine learning algorithm is a reinforcement learning algorithm. ### Claim 12 (depends on 9) The method of claim 9, further comprising a second machine learning algorithm, wherein each simulated defense is generated by the second machine learning algorithm, such that the first and second machine learning algorithms compete against each other in the simulation. ### Claim 13 (depends on 12) The method of claim 12, wherein the second machine learning algorithm is an evolutionary algorithm. ### Claim 14 (depends on 13) The method of claim 13, wherein the machine learning simulation is an online simulation and the evolutionary algorithm is a continual online evolutionary planning algorithm. ### Claim 15 (depends on 9) The method of claim 9, wherein the cybersecurity improvement recommendation is implemented on the network under test. ### Claim 16 (depends on 15) The method of claim 15, wherein the method is run iteratively, with each iteration resulting in a new cybersecurity improvement recommendation, which is implemented on the network under test prior to the next iteration.