# US 2019/0318085 A1 · Methods and apparatus to analyze computer system attack mechanisms > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0318085 A1 - Document ID: US20190318085A1 - Status: Published application - Kind: A1 - Application number: 16/455,473 - Filed: 2019-06-27 - Published: 2019-10-17 - Earliest claimed: 2019-06-27 - Assignees: Intel Corporation - Applicants: Intel Corporation - Inventors: Rachit Mathur; Brendan Traw; Justin Gottschlich - Web page: https://patentgrep.com/patent/US20190318085A1 ## CPC - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/554: {involving event detection and direct action} - G06F 40/30: Semantic analysis - G06N 3/00: Computing arrangements based on biological models - G06N 3/08: Learning methods - G06N 3/09: Supervised learning - G06N 5/022: Knowledge engineering; Knowledge acquisition - G06F 2221/033: Test or assess software - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Methods, apparatus, systems and articles of manufacture are disclosed that analyze computer system attack mechanisms. An example apparatus includes a graph generator utilizing a natural language processing model to generate a graph based on a publication, an analyzer to: analyze two or more nodes in the graph by identifying respective attributes of the two or more nodes in the graph, and provide an indication of the two or more nodes that include similar respective attributes, a variation generator to generate an attack mechanism based on the indication, and a weight postulator to obtain the generated attack mechanism and, based on (A) the two or more nodes in the graph and (B) the generated attack mechanism, indicate a weight associated with a severity of the generated attack mechanism. ## Claims ### Claim 1 An apparatus to analyze an attack mechanism, the apparatus comprising: a graph generator utilizing a natural language processing model to generate a graph based on a publication; an analyzer to: analyze two or more nodes in the graph by identifying respective attributes of the two or more nodes in the graph; and provide an indication of the two or more nodes that include similar respective attributes; a variation generator to generate an attack mechanism based on the indication; and a weight postulator to, based on (A) the two or more nodes in the graph and (B) the generated attack mechanism, indicate a weight associated with a severity of the generated attack mechanism. ### Claim 2 (depends on 1) The apparatus of claim 1, further including a graph determiner to determine whether the graph is generated and, in response to determining the graph is generated, transmit the graph to the analyzer. ### Claim 3 (depends on 2) The apparatus of claim 2, wherein the graph determiner is to determine the graph is generated by communicating with the graph generator. ### Claim 4 (depends on 1) The apparatus of claim 1, wherein the two or more nodes in the graph are included in two or more attack mechanisms, respectively. ### Claim 5 (depends on 1) The apparatus of claim 1, wherein the respective attributes are respective objective attributes of the two or more nodes in the graph. ### Claim 6 (depends on 1) The apparatus of claim 1, wherein the two or more nodes in the graph are child nodes of two or more parent nodes, respectively. ### Claim 7 (depends on 1) The apparatus of claim 1, wherein the generated attack mechanism is not included in the graph generated based on the publication. ### Claim 8 (depends on 7) The apparatus of claim 7, wherein the publication is at least one of a security conference publication, a PowerPoint presentation, a word document, a portable document format (PDF) file, or transcript of a video presentation. ### Claim 9 A non-transitory computer readable storage medium comprising instructions which, when executed, cause at least one processor to at least: generate a graph based on a publication; analyze two or more nodes in the graph by identifying respective attributes of the two or more nodes in the graph; provide an indication of the two or more nodes that include similar respective attributes; generate an attack mechanism based on the indication; and indicate a weight associated with a severity of the generated attack mechanism, the weight based on (A) the two or more nodes in the graph and (B) the generated attack mechanism. ### Claim 10 (depends on 9) The non-transitory computer readable storage medium of claim 9, wherein the instructions, when executed, cause the at least one processor to determine whether the graph is generated and, in response to determining the graph is generated, transmit the graph to an analyzer. ### Claim 11 (depends on 10) The non-transitory computer readable storage medium of claim 10, wherein the instructions, when executed, cause the at least one processor to determine the graph is generated by communicating with a graph generator. ### Claim 12 (depends on 9) The non-transitory computer readable storage medium of claim 9, wherein the two or more nodes in the graph are included in two or more attack mechanisms, respectively. ### Claim 13 (depends on 9) The non-transitory computer readable storage medium of claim 9, wherein the respective attributes are respective objective attributes of the two or more nodes in the graph. ### Claim 14 (depends on 9) The non-transitory computer readable storage medium of claim 9, wherein the two or more nodes in the graph are child nodes of two or more parent nodes, respectively. ### Claim 15 (depends on 9) The non-transitory computer readable storage medium of claim 9, wherein the generated attack mechanism is not included in the graph generated based on the publication. ### Claim 16 (depends on 15) The non-transitory computer readable storage medium of claim 15, wherein the publication is at least one of a security conference publication, a PowerPoint presentation, a word document, a portable document format (PDF) file, or transcript of a video presentation. ### Claim 17 A method to analyze an attack mechanism, the method comprising: generating a graph based on a publication; analyzing two or more nodes in the graph by identifying respective attributes of the two or more nodes in the graph; providing an indication of the two or more nodes that include similar respective attributes; generating an attack mechanism based on the indication; and indicating a weight associated with a severity of the generated attack mechanism, the weight based on (A) the two or more nodes in the graph and (B) the generated attack mechanism. ### Claim 18 (depends on 17) The method of claim 17, further including determining whether the graph is generated and, in response to determining the graph is generated, transmitting the graph to an analyzer. ### Claim 19 (depends on 18) The method of claim 18, further including determining the graph is generated by communicating with a graph generator. ### Claim 20 (depends on 17) The method of claim 17, wherein the two or more nodes in the graph are included in two or more attack mechanisms, respectively. ### Claim 21 (depends on 17) The method of claim 17, wherein the respective attributes are respective objective attributes of the two or more nodes in the graph. ### Claim 22 (depends on 17) The method of claim 17, wherein the two or more nodes in the graph are child nodes of two or more parent nodes, respectively. ### Claim 23 (depends on 17) The method of claim 17, wherein the generated attack mechanism is not included in the graph generated based on the publication. ### Claim 24 (depends on 23) The method of claim 23, wherein the publication is at least one of a security conference publication, a PowerPoint presentation, a word document, a portable document format (PDF) file, or transcript of a video presentation. ### Claim 25 (canceled) ### Claim 26 (canceled) ### Claim 27 (canceled) ### Claim 28 (canceled) ### Claim 29 (canceled) ### Claim 30 (canceled) ### Claim 31 (canceled) ### Claim 32 (canceled)