# US 2025/0165601 A1 · Machine learning techniques to generate negotiation data during computing system attacks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0165601 A1 - Document ID: US20250165601A1 - Status: Published application - Kind: A1 - Application number: 18/511,640 - Filed: 2023-11-16 - Published: 2025-05-22 - Earliest claimed: 2023-11-16 - Assignees: Wells Fargo Bank, N.A. - Applicants: Wells Fargo Bank, N.A. - Inventors: Edward Heuser; Jerry Joseph Reynolds - Web page: https://patentgrep.com/patent/US20250165601A1 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06N 3/044: Recurrent networks, e.g. Hopfield networks - G06N 20/00: Machine learning - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A negotiation evaluation system determines that a target computing system is experiencing a computing system attack. The negotiation evaluation system determines a set of attack characteristics associated with the computing system attack. Based on the set of attack characteristics, a negotiation estimation model generates response value data describing potential responses to the attack. Based on the response value data, a negotiation communication model generates reply text data describing a reply to the computing system attack. The negotiation evaluation system provides the reply text data to a malicious computing system that is associated with the computing system attack. ## Claims ### Claim 1 A system comprising: a processor, and a non-transitory computer-readable storage device storing instructions that are executable by the processor to: receive, from a target computing system, alert data indicating a computing system attack against the target computing system; responsive to receiving the alert data, determine a set of attack characteristics associated with the computing system attack; provide the set of attack characteristics to a trained negotiation estimation model; receive, from the trained negotiation estimation model, response value data that is determined by the trained negotiation estimation model based on the set of attack characteristics; provide the response value data to a trained negotiation communication model; receive, from the trained negotiation communication model, text data that includes a reply to the computing system attack, wherein the reply is based on the response value data; and provide the text data to a malicious computing system that is associated with the computing system attack. ### Claim 2 (depends on 1) The system of claim 1, the instructions further executable by the processor to: provide the set of attack characteristics to a trained risk estimation model; receive, from the trained risk estimation model, risk data that comprises one or more risk data values associated with the computing system attack; and provide the risk data to the trained negotiation estimation model, wherein the response value data is determined by the trained negotiation estimation model based on the risk data. ### Claim 3 (depends on 2) The system of claim 2, the instructions further executable by the processor to: provide the risk data to the target computing system, wherein the target computing system is configured to modify a user interface device based on the risk data. ### Claim 4 (depends on 2) The system of claim 2, wherein the risk data comprises one or more of: a probability of a recurrent computing system attack, an estimation of system compromise, an estimation of data compromise, or an estimation of damages caused by the computing system attack. ### Claim 5 (depends on 1) The system of claim 1, wherein the response value data comprises one or more of: a decision regarding an offer associated with the computing system attack, a numeric value for a counteroffer associated with the computing system attack, or a time frame for providing the text data to the malicious computing system. ### Claim 6 (depends on 1) The system of claim 1, the instructions further executable by the processor to: receive, from a profile generation module, archetype profile data that is based on additional data associated with additional computing system attacks; and provide the archetype profile data to the trained negotiation estimation model, wherein the response value data is determined by the trained negotiation estimation model based on the archetype profile data. ### Claim 7 (depends on 1) The system of claim 1, wherein providing the text data to the malicious computing system includes: providing the text data to a communication module that is implemented via the target computing system; and configuring the communication module to provide the text data to the malicious computing system. ### Claim 8 A method including operations executed by a processor, the operations comprising: determining, based on alert data indicating an initiation of a computing system attack against a target computing system, a set of attack characteristics associated with the computing system attack against the target computing system; receiving, from a trained negotiation estimation model, response value data that is determined by the trained negotiation estimation model based on the set of attack characteristics; receiving, from a trained negotiation communication model, text data that includes a reply to the computing system attack, wherein the reply is determined by the trained negotiation communication model based on the response value data; and providing the text data to a malicious computing system corresponding to the computing system attack. ### Claim 9 (depends on 8) The method of claim 8, the operations further comprising: providing the set of attack characteristics to a trained risk estimation model; receiving, from the trained risk estimation model, risk data that comprises one or more risk values associated with the computing system attack; and providing the risk data to the trained negotiation estimation model, wherein the response value data is determined by the trained negotiation estimation model based on the risk data. ### Claim 10 (depends on 9) The method of claim 9, the operations further comprising: providing the risk data to the target computing system, wherein the target computing system is configured to modify an output device based on the risk data. ### Claim 11 (depends on 9) The method of claim 9, wherein the risk data comprises one or more of: a probability of a recurrent computing system attack, an estimation of system compromise, an estimation of data compromise, or an estimation of damages caused by attack. ### Claim 12 (depends on 8) The method of claim 8, wherein the response value data comprises one or more of: a decision regarding an offer associated with the computing system attack, a numeric value for a counteroffer associated with the computing system attack, or a time frame for providing the text data to the malicious computing system. ### Claim 13 (depends on 8) The method of claim 8, the operations further comprising: receiving, from a profile generation module, archetype profile data that is based on additional data associated with additional computing system attacks; and providing the archetype profile data to the trained negotiation estimation model, wherein the response value data is determined by the trained negotiation estimation model based on the archetype profile data. ### Claim 14 (depends on 8) The method of claim 8, wherein providing the text data to the malicious computing system includes: providing the text data to a communication application that is implemented via the target computing system; and configuring the communication application to provide the text data to the malicious computing system. ### Claim 15 A non-transitory computer-readable medium embodying program code that, when executed by a processor, causes the processor to perform operations comprising: determining, based on alert data indicating an initiation of a computing system attack against a target computing system, a set of attack characteristics associated with the computing system attack against the target computing system; receiving, from a trained negotiation estimation model, response value data that is determined by the trained negotiation estimation model based on the set of attack characteristics; receiving, from a trained negotiation communication model, text data that includes a reply to the computing system attack, wherein the reply is determined by the trained negotiation communication model based on the response value data; and providing the text data to a malicious computing system corresponding to the computing system attack. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, the operations further comprising: providing the set of attack characteristics to a trained risk estimation model; receiving, from the trained risk estimation model, risk data that comprises one or more risk values associated with the computing system attack; and providing the risk data to the trained negotiation estimation model, wherein the response value data is determined by the trained negotiation estimation model based on the risk data. ### Claim 17 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein the risk data comprises one or more of: a probability of a recurrent computing system attack, an estimation of system compromise, an estimation of data compromise, or an estimation of damages caused by attack. ### Claim 18 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the response value data comprises one or more of: a decision regarding an offer associated with the computing system attack, a numeric value for a counteroffer associated with the computing system attack, or a time frame for providing the text data to the malicious computing system. ### Claim 19 (depends on 15) The non-transitory computer-readable medium of claim 15, the operations further comprising: receiving, from a profile generation module, archetype profile data that is based on additional data associated with additional computing system attacks; and providing the archetype profile data to the trained negotiation estimation model, wherein the response value data is determined by the trained negotiation estimation model based on the archetype profile data. ### Claim 20 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein providing the text data to the malicious computing system includes: providing the text data to a communication application that is implemented via the target computing system; and configuring the communication application to provide the text data to the malicious computing system.