# US 12,223,060 B2 · Systems and methods for generating security improvement plans for entities

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,223,060 B2
- Document ID: US12223060B2
- Status: Granted
- Kind: B2
- Application number: 18/138,803
- Filed: 2023-04-25
- Published: 2023-08-24
- Granted: 2025-02-11
- Earliest claimed: 2019-07-17
- Assignees: BitSight Technologies, Inc.
- Applicants: BitSight Technologies, Inc.
- Inventors: Marc Noel Light
- Web page: https://patentgrep.com/patent/US12223060B2

## CPC

- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- H04L 63/1433: {Vulnerability analysis}
- G06F 17/18: for evaluating statistical data {, e.g. average values, frequency distributions, probability functions, regression analysis (forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04)}
- G06N 5/04: Inference or reasoning models
- G06N 20/00: Machine learning
- G06N 20/10: using kernel methods, e.g. support vector machines [SVM]
- G06F 2221/034: Test or assess a computer or a system
- G06N 5/01: Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound
- G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks
- G06N 20/20: Ensemble learning
- H04L 63/102: {Entity profiles}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

A computer-implemented method is provided for statistical modeling of entities of a particular type. The method can include obtaining entity data including a plurality of entity data sets, each entity data set associated with a respective entity and including values for one or more static parameters indicative of a type of the entity. Each entity data set can include (i) values for input parameter(s) indicative of a security profile of the entity and (ii) a value of a security class parameter indicative of a security class of the entity based on the values of the input parameters. The method can include training a statistical classifier to infer a value of the security class parameter indicative of the security class of a particular entity of the particular type based on values of one or more of the input parameters indicative of a security profile of the particular entity.

## Claims

### Claim 1

A computer-implemented method for generating a security improvement plan for a particular organization, the method comprising:
adjusting a value of a first input parameter of at least two input parameters indicative of a security profile of a particular organization;
determining a value of a second input parameter of the input parameters based on a relationship between the value of the first input parameter and the value of the second input parameter;
using a trained statistical classifier on the adjusted value of the first input parameter and the determined value of the second input parameter to infer an adjusted value of a security class parameter indicative of a security class of the particular organization; and
generating a security improvement plan based on the adjusted value of the first input parameter and the determined value of the second input parameter, wherein execution of the security improvement plan is configured to cause an increase in the value of the security class parameter of the particular organization.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
comparing the adjusted value of the security class parameter to a target value to determine whether the adjustment of the value of the first input parameter results in a value of the security class parameter at, above, or below the target value.

### Claim 3 (depends on 2)

The method of claim 2, wherein generating the security improvement plan comprises:
generating the security improvement plan based on the adjusted value of the first input parameter and the determined value of the second input parameter, wherein execution of the security improvement plan is configured to cause an increase in the value of the security class parameter of the particular organization at or above the target value.

### Claim 4 (depends on 1)

The method of claim 1, wherein the security improvement plan comprises a target value for at least one input parameter of the input parameters for the particular organization, the target value being different than a value of the at least one input parameter.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
presenting the security improvement plan via a user interface.

### Claim 6 (depends on 1)

The method of claim 1, wherein the security improvement plan includes a prescription to adjust at least one of the input parameters, the method further comprising:
determining an explanation for the prescription using one or more explanation techniques
selected from the group consisting of: (i) local interpretable model-agnostic explanation (LIME),
(ii) high-precision model-agnostic explanation, (iii) Skater model interpretation, or (iv) random
forest feature tweaking.

### Claim 7 (depends on 6)

The method of claim 6, further comprising:
presenting the explanation via a user interface.

### Claim 8 (depends on 1)

The method of claim 1, further comprising:
determining a target value for the first input parameter by:
receiving two or more values of the first input parameter from two or more organization data sets of entities having a value of the security class parameter greater than the target value; and
determining a mean value of the two or more values,
wherein generating the security improvement plan comprises prescribing the mean value for the first input parameter of the particular organization.

### Claim 9 (depends on 1)

The method of claim 1, wherein the relationship between the value of the first input parameter and the value of the second input parameter is stored in a database, and wherein the method comprises:
retrieving the stored relationship from the database.

### Claim 10 (depends on 1)

The method of claim 1, further comprising:
receiving an organization data set for the particular organization comprising a value for the input parameters indicative of the security profile of the particular organization.

### Claim 11 (depends on 1)

The method of claim 1, wherein the security profile comprises security practices and/or a security record of the particular organization.

### Claim 12 (depends on 1)

The method of claim 1, wherein the input parameters indicative of the security profile of the particular organization comprise at least one of:
an amount of capital investment in security of the organization;
a measure of employee training in security of the organization;
a measure of organization of a team dedicated to information security; or
an amount of budget dedicated to information security.

### Claim 13 (depends on 1)

The method of claim 1, wherein the input parameters indicative of the security profile of the particular organization comprise at least one of:
a number and/or severity of botnet infection instances of a computer system associated with the organization;
a number of spam propagation instances originating from a computer network associated with the organization;
a number of malware servers associated with the organization;
a number of potentially exploited devices associated with the organization;
a number of hosts authorized to send emails on behalf of each domain associated with the organization;
a determination of whether a DomainKeys Identified Mail (DKIM) record exists for each domain associated with the organization and/or a key length of a public key associated with a Domain Name System (DNS) record of each domain associated with the organization;
an evaluation of a Secure Sockets Layer (SSL) certificate and/or a Transport Layer Security (TLS) certificate associated with a computer system of the organization;
a number and/or type of service of open ports of a computer network associated with the organization;
an evaluation of security-related fields of an header section of HTTP response messages of hosts associated with the organization;
a rate at which vulnerabilities are patched in a computer network associated with the organization;
an evaluation of file sharing traffic originating from a computer network associated with the organization; or
a number of lost records and/or sensitivity of information in the lost records in a data breach of a computer system associated with the organization.

### Claim 14 (depends on 1)

The method of claim 1, wherein the statistical classifier was trained by:
obtaining organization data including a plurality of organization data sets, each organization data set associated with a respective organization and including:
(i) a value for at least one static parameter indicative of a type of the organization, wherein the values of the static parameter indicates that the type of the organization matches the particular type;
(ii) a value for at least one input parameter indicative of a security profile of the organization;
(iii) a value of a security class parameter indicative of a security class of the organization based on the value of the at least one input parameter;
training the statistical classifier to infer a value of the security class parameter indicative of the security class of a particular organization of the particular type based on values of the at least one input parameter indicative of a security profile of the particular organization, wherein training the statistical classifier comprises fitting the statistical classifier to the plurality of organization data sets.

### Claim 15 (depends on 14)

The method of claim 14, wherein each organization data set includes two or more input parameters indicative of the security profile of the organization, the method further comprising:
for a first input parameter of the two or more input parameters, determining the relationship between at least one value of the first input parameter and at least one value of a second input parameter.

### Claim 16 (depends on 15)

The method of claim 15, further comprising:
determining relationships between a plurality of values of the first input parameter and a plurality of values of the second input parameter, wherein the plurality of values of the first input parameter comprises the at least one value of the first input parameter and the plurality of values of the second input parameter comprises the at least one value of the second input parameter.

### Claim 17 (depends on 14)

The method of claim 14, wherein the values of two or more static parameters for each of the organization data sets indicate that the type of the organization matches the particular type.

### Claim 18 (depends on 14)

The method of claim 14, further comprising:
selecting a target value for the security class parameter indicative of the security class for the particular organization,
wherein the plurality of organization data sets includes at least one organization data set for which the value of the security class parameter is lower than the target value and at least one organization data set for which the value of the security class parameter is at or above than the target value.

### Claim 19 (depends on 18)

The method of claim 18, wherein the plurality of organization data sets includes at least three organization data sets for which the value of the security class parameter is lower than the target value and at least three organization data set for which the value of the security class parameter is at or above than the target value.

### Claim 20 (depends on 1)

The method of claim 1, wherein the security class is a security rating of the particular organization.