# US 2019/0171822 A1 · Systems and methods for aida campaign controller intelligent records

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0171822 A1
- Document ID: US20190171822A1
- Status: Published application
- Kind: A1
- Application number: 15/829,721
- Filed: 2017-12-01
- Published: 2019-06-06
- Earliest claimed: 2017-12-01
- Assignees: KnowBe4, Inc.
- Applicants: KnowBe4, Inc.
- Inventors: Stu Sjouwerman; Eric Sites
- Web page: https://patentgrep.com/patent/US20190171822A1

## CPC

- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- G06F 30/20: Design optimisation, verification or simulation (optimisation, verification or simulation of circuit designs G06F30/30)
- G06N 3/0499: Feedforward networks
- G06N 3/08: Learning methods
- G06N 3/09: Supervised learning
- G06N 20/00: Machine learning
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)}
- G06F 2221/034: Test or assess a computer or a system
- H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Systems and methods, disclosed herein, of a campaign controller that stores information to a database about execution of multiple simulated phishing campaigns for multiple users, where each of the simulated phishing campaigns use one or more models for communicating simulated phishing communications. Based on this information, the campaign controller may determine a rate of success of the model, in causing a user to interact with a link in one of the simulated phishing campaigns, and may display the model's rate of success via a user interface.

## Claims

### Claim 1

A method for determining a rate of success of one or more models used by simulated phishing campaigns, the method comprising:
(a) storing, by a campaign controller, information to a database about execution of a plurality of simulated phishing campaigns directed to a plurality of users, each of the plurality of simulated phishing campaigns using one or more models of a plurality of models for communicating simulated phishing communications to the plurality of users, wherein each of the plurality of models take as input information related to a simulated phishing campaign and provides as output information for performing a next action for the simulated phishing campaign;
(b) identifying, by a campaign controller from the information in the database, a model from the plurality of models used for one or more simulated phishing campaigns of the plurality of simulated phishing campaigns;
(c) determining, by the campaign controller from the information in the database, a rate of success of the model among the plurality of models to cause an interaction of one or more users of the plurality of users with a link of the one or more simulated phishing campaigns; and
(d) providing, by the campaign controller responsive to the determination, the rate of success of the model for display via a user interface.

### Claim 2 (depends on 1)

The method of claim 1, wherein (a) further comprises storing to the database information about a plurality of attributes of the plurality of users.

### Claim 3 (depends on 2)

The method of claim 2, wherein (c) further comprises determining the rate of success of the model when used for one or more users of the plurality of users with at least one or more attributes of the plurality of attributes.

### Claim 4 (depends on 1)

The method of claim 1, wherein (a) further comprises storing to the database information about a plurality of attributes of one or more companies associated with the plurality of users.

### Claim 5 (depends on 4)

The method of claim 4, wherein (c) further comprises determining the rate of success of the model when used for one or more users at a company with at least one or more attributes of the plurality of attributes of the one or more companies.

### Claim 6 (depends on 1)

The method of claim 1, wherein (b) further comprises identifying a template from a plurality of templates used with the model.

### Claim 7 (depends on 6)

The method of claim 6, wherein (c) further comprises determining the rate of success of the model when the template is used.

### Claim 8 (depends on 7)

The method of claim 7, further comprising determining the rate of success of the model when the template is used for a selected group of users of the plurality of users.

### Claim 9 (depends on 1)

The method of claim 1, wherein (c) further comprises determining the rate of success of the model when used for a selected group of users of the plurality of users.

### Claim 10 (depends on 1)

The method of claim 1, wherein (c) further comprises determining one or more metrics about one of the model, the template or the one or more simulated phishing campaigns using the model.

### Claim 11 (depends on 10)

The method of claim 10, wherein (d) further comprises providing the one or more metrics for display.

### Claim 12 (depends on 10)

The method of claim 10, wherein the one or more metrics comprises a number of interactions with the link.

### Claim 13 (depends on 10)

The method of claim 10, wherein the one or more metrics comprises a number of simulated phishing communications communicated across one or more users to cause an interaction with the link.

### Claim 14 (depends on 10)

The method of claim 10, wherein the one or more metrics comprises one of a timing of or a type of simulated phishing communication communicated across one or more users to cause an interaction with the link.

### Claim 15 (depends on 1)

The method of claim 1, wherein (d) further comprises displaying via a graphical user interface the rate of success for the model, the model identified via the graphical user interface.

### Claim 16

A system for determining a rate of success of one or more models used by simulated phishing campaigns, the system comprising:
one or more processors comprising hardware and coupled to memory;
a database configured to store information about execution of a plurality of simulated phishing campaigns directed to a plurality of users, each of the plurality of simulated phishing campaigns using one or more models of a plurality of models for communicating simulated phishing communications to the plurality of users, wherein each of the plurality of models take as input information related to a simulated phishing campaign and provides as output information for performing a next action for the simulated phishing campaign;
a campaign controller configured to execute on the one or more processors, and to:
identify from the information in the database, a model from the plurality of models used for one or more simulated phishing campaigns of the plurality of simulated phishing campaigns;
determine, from the information in the database, a rate of success of the model among the plurality of models to cause an interaction of one or more users of the plurality of users with a link of the one or more simulated phishing campaigns; and
provide, responsive to the determination, the rate of success of the model for display via a user interface.

### Claim 17 (depends on 16)

The system of claim 16, wherein the database is further configured to store information about a plurality of attributes of the plurality of users.

### Claim 18 (depends on 17)

The system of claim 17, wherein the campaign controller is further configured to determine the rate of success of the model when used for one or more users of the plurality of users with at least one or more attributes of the plurality of attributes.

### Claim 19 (depends on 16)

The system of claim 16, wherein the database is further configured to store information about a plurality of attributes of one or more companies associated with the plurality of users.

### Claim 20 (depends on 19)

The system of claim 19, wherein the campaign controller is further configured to determine the rate of success of the model when used for one or more users at a company with at least one or more attributes of the plurality of attributes of the one or more companies.

### Claim 21 (depends on 16)

The system of claim 16, wherein the campaign controller is further configured to identify a template from a plurality of templates used with the model.

### Claim 22 (depends on 21)

The system of claim 21, wherein the campaign controller is further configured to determine the rate of success of the model when the template is used.

### Claim 23 (depends on 22)

The system of claim 22, wherein the campaign controller is further configured to determine the rate of success of the model when using the template for a selected group of users of the plurality of users.

### Claim 24 (depends on 16)

The system of claim 16, wherein the campaign controller is further configured to determine the rate of success of the model when used for a selected group of users of the plurality of users.

### Claim 25 (depends on 16)

The system of claim 16, wherein the campaign controller is further configured to determine one or more metrics about one of the model, the template or the one or more simulated phishing campaigns using the model.

### Claim 26 (depends on 25)

The system of claim 25, wherein the campaign controller is further configured to provide the one or more metrics for display.

### Claim 27 (depends on 25)

The system of claim 25, wherein the one or more metrics comprises a number of interactions with the link.

### Claim 28 (depends on 25)

The system of claim 25, wherein the one or more metrics comprises a number of simulated phishing communications communicated across one or more users to cause an interaction with the link.

### Claim 29 (depends on 25)

The system of claim 25, wherein the one or more metrics comprises one of a timing of or a type of simulated phishing communication communicated across one or more users to cause an interaction with the link.

### Claim 30 (depends on 16)

The system of claim 16, wherein the campaign controller is further configured to display via a graphical user interface the rate of success for the model, the model identified via the graphical user interface.