# US 2019/0173919 A1 · Systems and methods for aida based second chance

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0173919 A1
- Document ID: US20190173919A1
- Status: Published application
- Kind: A1
- Application number: 15/829,747
- Filed: 2017-12-01
- Published: 2019-06-06
- Earliest claimed: 2017-12-01
- Assignees: KnowBe4, Inc.
- Applicants: KnowBe4, Inc.
- Inventors: Alin Irimie; Stu Sjouwerman; Greg Kras; Eric Sites
- Web page: https://patentgrep.com/patent/US20190173919A1

## CPC

- H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)}
- G06F 21/552: {involving long-term monitoring or reporting}
- G06F 21/554: {involving event detection and direct action}
- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- G06N 3/006: based on simulated virtual individual or collective life forms, e.g. social simulations or particle swarm optimisation [PSO]
- G06N 3/08: Learning methods
- G06N 3/082: modifying the architecture, e.g. adding, deleting or silencing nodes or connections
- G06N 3/09: Supervised learning
- H04L 63/1433: {Vulnerability analysis}
- H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)}
- H04L 2463/121: Timestamp
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

Methods and systems are described in which a system provides a user interface to confirm whether to review or take an action associated with an untrusted email. A driver on a device monitors the startup of any processes. Responsive to monitoring, the driver detects an application process that was created that indicates than an application was launched, and notifies a user console about the creation of the application process. The user console determines if the application process is of significance, if so, it injects a monitor library into the process. Once injected into the process, the monitor library detects if the application process receives an action of a user to access a domain that is not identified as trusted. The monitor library notifies the user console of the user's URL-access request.

## Claims

### Claim 1

A method for using information from intercepted actions to configure a simulated phishing campaign, the method comprising:
(a) receiving, by a campaign controller, information associated with one or more actions of a plurality of users to access, via one or more applications, one or more domains not identified as trusted, the one or more actions intercepted prior to accessing the one or more domains and the plurality of users prompted to either review or take the one or more actions;
(b) storing, by the campaign controller, the information to a database; and
(c) determining, by the campaign controller based on at least the information and independent of any user determining a model or a template based on at least the information, one of the model or the template to use for a simulated phishing campaign.

### Claim 2 (depends on 1)

The method of claim 1, wherein the information comprises one or more of the following: a type of action, a type of exploit, an identifier of an application of the one or more applications, a domain of the one or more domains and whether a user chose to review the action or take the action.

### Claim 3 (depends on 1)

The method of claim 1, wherein (a) further comprises receiving the information comprising a plurality of inputs from a plurality of users, each of the plurality of inputs identifying whether to take or review the one or more actions to access the one or more domains not identified as trusted.

### Claim 4 (depends on 3)

The method of claim 3, further comprising receiving the plurality of inputs from a plurality of user interfaces, each of the plurality of user interfaces displayed while the one or more applications are paused, the plurality of user interfaces configured to receive the plurality of inputs to confirm whether to take or review the one or more actions.

### Claim 5 (depends on 1)

The method of claim 1, wherein (a) further comprising receiving the information responsive to one or more drivers on one or more devices detecting that the one or more applications received one or more actions of the one or more users to access the one or more domains not identified as trusted.

### Claim 6 (depends on 1)

The method of claim 1, wherein (a) further comprising receiving the information responsive to one or more drivers on one or more devices intercepting the one or more actions of the one or more users via the one or more applications to access the one or more domains not identified as trusted.

### Claim 7 (depends on 1)

The method of claim 1, wherein (b) further comprises storing the information in association with a plurality of attributes of one or more users.

### Claim 8 (depends on 1)

The method of claim 1, wherein (b) further comprises storing the information in association with a plurality of attributes of one or more companies of one or more users.

### Claim 9 (depends on 1)

The method of claim 1, wherein (b) further comprises storing the information in association with results of execution of a plurality of simulated phishing campaigns.

### Claim 10 (depends on 1)

The method of claim 1, wherein (c) further comprises correlating, using the information, between selection parameters of one or more simulated phishing campaigns and the one or more actions.

### Claim 11 (depends on 10)

The method of claim 10, further comprising determining one of the model or the template based on the correlation.

### Claim 12 (depends on 1)

The method of claim 1, wherein (c) further comprises training, by a model trainer, the model, using at least a portion of the information.

### Claim 13 (depends on 1)

The method of claim 1, wherein (c) further comprises selecting, by the campaign controller, the template from a plurality of templates based on at least a portion of the information.

### Claim 14 (depends on 1)

The method of claim 1, wherein (c) further comprises selecting, by the campaign controller, content for the template based on at least a portion of the information.

### Claim 15 (depends on 1)

The method of claim 1, wherein (c) further comprises selecting, by the campaign controller, parameters for a simulated phishing campaign based on at least a portion of the information.

### Claim 16

A system for using information from intercepted actions to configure a simulated phishing campaign, the system comprising:
a campaign controller, executable on one or more processors, coupled to memory and configured to receive information associated with one or more actions of a plurality of users to access, via one or more applications, one or more domains not identified as trusted, wherein the one or more actions intercepted prior to accessing the one or more domains and the plurality of users prompted to either review or take the one or more actions;
wherein the campaign controller is configured to:
store the information to a database; and
determine, based on at least the information information and independent of any user determining a model or a template based on at least the information, one of the model or the template to use for a simulated phishing campaign.

### Claim 17 (depends on 16)

The system of claim 16, wherein the information comprises one or more of the following: a type of action, a type of exploit, an identifier of an application of the one or more applications, a domain of the one or more domains and whether a user chose to review the action or take the action.

### Claim 18 (depends on 16)

The system of claim 16, wherein the information comprises a plurality of inputs from a plurality of users, each of the plurality of inputs identifying whether to take or review the one or more actions to access the one or more domains not identified as trusted.

### Claim 19 (depends on 18)

The system of claim 18, wherein the campaign controller is further configured to receive the plurality of inputs from a plurality of user interfaces, each of the plurality of user interfaces displayed while the one or more applications are paused, the plurality of user interfaces configured to receive the plurality of inputs to confirm whether to take or review the one or more actions.

### Claim 20 (depends on 16)

The system of claim 16, wherein the campaign controller is further configured to receive the information responsive to one or more drivers on one or more devices detecting that the one or more applications received one or more actions of the one or more users to access the one or more domains not identified as trusted.

### Claim 21 (depends on 16)

The system of claim 16, wherein the campaign controller is further configured to receive the information responsive to one or more drivers on one or more devices intercepting the one or more actions of the one or more users via the one or more applications to access the one or more domains not identified as trusted.

### Claim 22 (depends on 16)

The system of claim 16, wherein the campaign controller is further configured to store the information in association with a plurality of attributes of one or more users.

### Claim 23 (depends on 16)

The system of claim 16, wherein the campaign controller is further configured to store the information in association with a plurality of attributes of one or more companies of one or more users.

### Claim 24 (depends on 16)

The system of claim 16, wherein the campaign controller is further configured to store the information in association with results of execution of a plurality of simulated phishing campaigns.

### Claim 25 (depends on 16)

The system of claim 16, wherein the campaign controller is further configured to receive correlating, using the information, between selection parameters of one or more simulated phishing campaigns and the one or more actions.

### Claim 26 (depends on 25)

The system of claim 25, wherein the campaign controller is further configured to determine one of the model or the template based on the correlation.

### Claim 27 (depends on 16)

The system of claim 16, further comprising a model trainer configured to train the model using at least a portion of the information.

### Claim 28 (depends on 16)

The system of claim 16, wherein the campaign controller is further configured to select the template from a plurality of templates based on at least a portion of the information.

### Claim 29 (depends on 16)

The system of claim 16, wherein the campaign controller is further configured to select content for the template based on at least a portion of the information.

### Claim 30 (depends on 16)

The system of claim 16, wherein the campaign controller is further configured to select parameters for a simulated phishing campaign based on at least a portion of the information.