# US 12,602,485 B2 · Monitoring security risk of a computing device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,602,485 B2 - Document ID: US12602485B2 - Status: Granted - Kind: B2 - Application number: 17/945,452 - Filed: 2022-09-15 - Published: 2024-03-21 - Granted: 2026-04-14 - Earliest claimed: 2022-09-15 - Assignees: Capital One Services, LLC - Applicants: Capital One Services, LLC - Inventors: Rui Zhang; Sudheendra Kumar Kaanugovi; Jeremy Goodsitt; Dustin Summers; Austin Walters - Web page: https://patentgrep.com/patent/US12602485B2 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Disclosed herein are system, method, and computer program product embodiments for determining a probability of a device at risk. The device may be associated with a plurality of security parameters. For a security parameter, the device can be in multiple states. A probability value corresponding to a security parameter can indicate the security parameter being in a state among the multiple states. A probabilistic graphical model may be used to represent dependences of the plurality of security parameters. A device security risk prediction module may determine a probability of the device at risk based on the probabilistic graphical model and the probability assignments to the plurality of nodes of the probabilistic graphical model, and further determine a user action instruction to be provided to a user of the device based on the probability of the device at risk. ## Claims ### Claim 1 A computing device, comprising: a memory configured to store a plurality of probability values corresponding to a plurality of security parameters of a device, wherein a first probability value of the plurality of probability values indicates a first security parameter of the plurality of security parameters being in a first state and a second probability value of the plurality of probability values indicates a second security parameter of the plurality of security parameters being in a second state; a processor coupled to the memory; and a device security risk prediction module operated by the processor, and configured to: determine a structure of a probabilistic graphical model including a plurality of nodes, wherein a first node of the plurality of nodes corresponds to the first security parameter and is assigned the first probability value and a second node of the plurality of nodes corresponds to the second security parameter and is assigned the second probability value, and wherein the probabilistic graphical model represents dependences of the plurality of security parameters; determine a probability of the device at risk based on the probabilistic graphical model and the plurality of probability values assigned to the plurality of nodes of the probabilistic graphical model; determine a user action instruction based on the probability of the device at risk; and provide the user action instruction to the device. ### Claim 2 (depends on 1) The computing device of claim 1, wherein the plurality of security parameters of the device includes a security parameter corresponding to a status of a software component or a hardware component of the device. ### Claim 3 (depends on 2) The computing device of claim 2, wherein the plurality of probability values corresponding to the plurality of security parameters includes a probability value of the software component or the hardware component being in a secure state. ### Claim 4 (depends on 2) The computing device of claim 2, wherein the first security parameter indicates whether a malware presents on the device, wherein the second security parameter indicates whether the device is currently being debugged, and wherein the plurality of security parameters further includes at least one of a third security parameter to indicate whether the device is rooted or jailbroken, a fourth security parameter to indicate whether an application is an unauthorized copy version of an authorized copy of the application, a fifth security parameter to indicate whether a keyboard is detected, a sixth security parameter to indicate whether the device is being re-engineered, a seventh security parameter to indicate whether an application is running on an emulator or a virtual environment, an eighth security parameter to indicate whether a user has a malware detection capability disabled, or a security ninth parameter to indicate whether the user runs on a custom ROM device. ### Claim 5 (depends on 1) The computing device of claim 1, wherein the device is the computing device, and the computing device further includes a device security status monitor to collect the plurality of probability values corresponding to the plurality of security parameters of the computing device. ### Claim 6 (depends on 5) The computing device of claim 5, wherein the device is the computing device, and the computing device further includes an application operated on the computing device, and the user action instruction includes an action instruction to prevent a user from login to the application operated on the computing device. ### Claim 7 (depends on 1) The computing device of claim 1, wherein the probabilistic graphical model includes a Bayesian network, and the structure of the probabilistic graphical model includes a directed and acyclic graph. ### Claim 8 (depends on 7) The computing device of claim 7, wherein the directed and acyclic graph includes a node that represents a security parameter that is not directly observable by a user. ### Claim 9 (depends on 7) The computing device of claim 7, wherein the directed and acyclic graph includes a hidden causality among the plurality of nodes of the directed and acyclic graph, and wherein the hidden causality is determined by machine learning. ### Claim 10 (depends on 1) The computing device of claim 1, wherein the probabilistic graphical model includes a Markov network, and the structure of the probabilistic graphical model includes an undirected and cyclic graph. ### Claim 11 A computer-implemented method for a computing device, the method comprising: determining a structure of a probabilistic graphical model including a plurality of nodes, wherein a first node of the plurality of nodes corresponds to a first security parameter of a plurality of security parameters of a device and a second node of the plurality of nodes corresponds to a second security parameter of the plurality of security parameters, wherein the first node is assigned a first probability value of a plurality of probability values and the second node is assigned a second probability value of the plurality of probability values, wherein the probabilistic graphical model represents dependences of the plurality of security parameters of the device, and wherein the first probability value indicates the first security parameter being in a first state and the second probability value indicates the second security parameter being in a second state; determining a probability of the device at risk based on the probabilistic graphical model and the plurality of probability values assigned to the plurality of nodes of the probabilistic graphical model; determining a user action instruction based on the probability of the device at risk; and provide the user action instruction to the device. ### Claim 12 (depends on 11) The method of claim 11, further comprising: collecting the plurality of probability values corresponding to the plurality of security parameters of the device. ### Claim 13 (depends on 11) The method of claim 11, wherein the determining the user action instruction comprises: determining an action instruction to prevent a user from login to an application operated on the device. ### Claim 14 (depends on 11) The method of claim 11, wherein the determining the structure of the probabilistic graphical model comprises: determining the probabilistic graphical model includes a Bayesian network, and the structure of the probabilistic graphical model includes a directed and acyclic graph. ### Claim 15 (depends on 14) The method of claim 14, wherein the determining the structure of the probabilistic graphical model comprises: determining the directed and acyclic graph includes a node that represents a security parameter that is not directly observable by a user. ### Claim 16 (depends on 11) The method of claim 11, wherein the determining the structure of the probabilistic graphical model comprises: determining the probabilistic graphical model includes a Markov network, and the structure of the probabilistic graphical model includes an undirected and cyclic graph. ### Claim 17 A non-transitory computer-readable medium storing instructions, the instructions, when executed by a processor, cause the processor to perform operations comprising: determining a structure of a probabilistic graphical model including a plurality of nodes, wherein a first node of the plurality of nodes corresponds to a first security parameter of a plurality of security parameters of a device and a second node of the plurality nodes corresponds to a second security parameter of the plurality of security parameters, wherein the first node is assigned a first probability value of a plurality of probability values and the second node is assigned a second probability value of the plurality of probability values, wherein the probabilistic graphical model represents dependences of the plurality of security parameters of the device, and wherein the first probability value indicates the first security parameter being in a first state and the second probability value indicates the second security parameter being in a second state; determining a probability of the device at risk based on the probabilistic graphical model and the plurality of probability values assigned to the plurality of nodes of the probabilistic graphical model; determining a user action instruction based on the probability of the device at risk; and providing the user action instruction to the device. ### Claim 18 (depends on 17) The non-transitory computer-readable medium of claim 17, further comprises: collecting the plurality of probability values corresponding to the plurality of security parameters of the device. ### Claim 19 (depends on 17) The non-transitory computer-readable medium of claim 17, wherein the determining the user action instruction comprises: determining an action instruction to prevent a user from login to an application operated on the device. ### Claim 20 The non-transitory computer-readable medium of 17, wherein the determining the structure of the probabilistic graphical model comprises: determining the probabilistic graphical model includes a Bayesian network, and the structure of the probabilistic graphical model includes a directed and acyclic graph.