# US 12,224,992 B2 · AI-driven defensive cybersecurity strategy analysis and recommendation system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,224,992 B2
- Document ID: US12224992B2
- Status: Granted
- Kind: B2
- Application number: 18/402,662
- Filed: 2024-01-02
- Published: 2024-12-05
- Granted: 2025-02-11
- Earliest claimed: 2015-10-28
- Assignees: Qomplx LLC
- Applicants: Qomplx LLC
- Inventors: Jason Crabtree; Richard Kelley; Jason Hopper; David Park
- Web page: https://patentgrep.com/patent/US12224992B2

## CPC

- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- H04L 9/3236: {using cryptographic hash functions}
- H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD}
- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- H04L 63/0815: {providing single-sign-on or federations}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A system and method for automated cybersecurity defensive strategy analysis that predicts the evolution of new cybersecurity attack strategies and makes recommendations for cybersecurity improvements to networked systems based on a cost/benefit analysis. The system and method use machine learning algorithms to run simulated attack and defense strategies against a model of the networked system created using a directed graph. Recommendations are generated based on an analysis of the simulation results against a variety of cost/benefit indicators.

## Claims

### Claim 1

A system for automated cybersecurity defensive strategy analysis and recommendations, comprising:
a computing system comprising a processor, a memory, and a network interface;
an attack implementation subsystem comprising a first plurality of programming instructions that, when operating on the processor, cause the computing system to:
execute a cyberattack on a network under test; and
gather operational information during the cyberattack;
a machine learning simulator subsystem comprising a second plurality of programming instructions that, when operating on the processor, cause the computing system to:
use the operational information to generate a plurality of simulated attack outcomes using iterative simulations of a plurality of cyberattack strategy sequences each comprising a simulated attack on a model of the network under test and a simulated defense against the simulated attack, each simulated attack being generated by a first machine learning algorithm; and
determine a probability of success of the attack and a probability of success of the defense in each cyberattack strategy sequence; and
a recommendation engine subsystem comprising a third plurality of programming instructions that, when operating on the processor, cause the computing system to:
compare the simulated attack outcomes against one or more cost factors and one or more benefit factors; and
determine a cybersecurity improvement recommendation for the network under test based on the comparison.

### Claim 2 (depends on 1)

The system of claim 1, wherein the operational information further comprises system logs of one or more devices on the network under test.

### Claim 3 (depends on 1)

The system of claim 1, wherein the first machine learning algorithm is a reinforcement learning algorithm.

### Claim 4 (depends on 1)

The system of claim 1, further comprising a second machine learning algorithm, wherein each simulated defense is generated by the second machine learning algorithm, such that the first and second machine learning algorithms compete against each other in the simulation.

### Claim 5 (depends on 4)

The system of claim 4, wherein the second machine learning algorithm is an evolutionary algorithm.

### Claim 6 (depends on 5)

The system of claim 5, wherein the machine learning simulation is an online simulation and the evolutionary algorithm is a continual online evolutionary planning algorithm.

### Claim 7 (depends on 1)

The system of claim 1, wherein the cybersecurity improvement recommendation is implemented on the network under test.

### Claim 8 (depends on 7)

The system of claim 7, wherein the system is run iteratively, with each iteration resulting in a new cybersecurity improvement recommendation, which is implemented on the network under test prior to the next iteration.

### Claim 9

A method for automated cybersecurity defensive strategy analysis and recommendations, comprising the steps of:
executing a cyberattack on a network under test;
gathering operational information during the cyberattack;
using the operational information to generate a plurality of simulated attack outcomes using iterative simulations of a cyberattack strategy sequences each comprising a simulated attack on a model of the network under test and a simulated defense against the simulated attack, each simulated attack being generated by a first machine learning algorithm;
determining a probability of success of the attack and a probability of success of the defense in each cyberattack strategy sequence;
comparing the simulated attack outcomes against one or more cost factors and one or more benefit factors; and
determining a cybersecurity improvement recommendation for the network under test based on the comparison.

### Claim 10 (depends on 9)

The method of claim 9, wherein the operational information further comprises system logs of one or more devices on the network under test.

### Claim 11 (depends on 9)

The method of claim 9, wherein the first machine learning algorithm is a reinforcement learning algorithm.

### Claim 12 (depends on 9)

The method of claim 9, further comprising a second machine learning algorithm, wherein each simulated defense is generated by the second machine learning algorithm, such that the first and second machine learning algorithms compete against each other in the simulation.

### Claim 13 (depends on 12)

The method of claim 12, wherein the second machine learning algorithm is an evolutionary algorithm.

### Claim 14 (depends on 13)

The method of claim 13, wherein the machine learning simulation is an online simulation and the evolutionary algorithm is a continual online evolutionary planning algorithm.

### Claim 15 (depends on 9)

The method of claim 9, wherein the cybersecurity improvement recommendation is implemented on the network under test.

### Claim 16 (depends on 15)

The method of claim 15, wherein the method is run iteratively, with each iteration resulting in a new cybersecurity improvement recommendation, which is implemented on the network under test prior to the next iteration.