Risk scoring using supervised machine learning
AssigneeCrowdStrike, Inc.
InventorsCHRISTOPHER BALLES, KELLEN ARB, MICHAEL COSMADELIS, SEAN CORLIN, JEREMY FINTEL
Life of this patent
Estimating the term…
Abstract
Techniques for using supervised machine learning to train risk models used to analyze group data for security risks are discussed herein. A system can receive a user input identifying risk values associated with categories or attributes of a group having access to computing resources. The system can use the risk model to generate a risk score for the group. The risk score can be used to further analyze aspects of the group or provide recommendations to reduce or eliminate security risks.
Claims20
A system comprising:
- one or more processors;
- and
- one or more non-transitory computer-readable media storing computer-executable instructions that, when executed, cause the one or more processors to perform operations comprising:
- receiving a risk evaluation request to provide a first risk score for a first object of a group and second risk score for a second object of the group;
- selecting a risk model to generate the first risk score and the second risk score, wherein the risk model is generated by:
- deconstructing the group into group attributes;
- deconstructing the group attributes into attribute categories;
- receiving a risk value for each of the attribute categories to generate an initial risk model;
- and
- generating the risk model by training the initial risk model, wherein training the initial risk model comprises modifying the initial risk model until training data applied to the risk model using a machine learning module generates an allowable risk score for a test group object of the training data;
- generating the first risk score and the second risk score using the risk model;
- and
- configuring recommendation data for the group based at least in part on the first risk score or the second risk score, the recommendation data comprising an indication of a high risk associated with the first risk score or the second risk score.
One or more non-transitory computer-readable media storing instructions executable by one or more processors, wherein the instructions, when executed, cause the one or more processors to perform operations comprising:
- receiving a risk evaluation request to provide a first risk score for a first object of a group and second risk score for a second object of the group;
- applying a risk model to generate the first risk score and the second risk score, wherein the risk model is generated by:
- deconstructing the group into group attributes;
- deconstructing the group attributes into attribute categories;
- receiving an input of a risk value for each of the attribute categories to generate an initial risk model;
- and
- generating the risk model by training the initial risk model, wherein training the initial risk model comprises modifying the initial risk model until training data applied to the risk model using a machine learning module generates an allowable risk score for a test group object of the training data;
- generating the first risk score and the second risk score using the risk model;
- and
- configuring recommendation data for the group based at least in part on the first risk score or the second risk score, the recommendation data comprising an indication of a high risk associated with the first risk score or the second risk score.
A computer-implemented method comprising:
- receiving a risk evaluation request to provide a first risk score for a first object of a group and second risk score for a second object of the group;
- applying a risk model to generate the first risk score and the second risk score, wherein the risk model is generated by:
- deconstructing the group into group attributes;
- deconstructing the group attributes into attribute categories;
- receiving an input of a risk value for each of the attribute categories to generate an initial risk model;
- and
- generating the risk model by training the initial risk model, wherein training the risk model comprises modifying the initial risk model until training data applied to the risk model using a machine learning module generates an allowable risk score for a test group object of the training data;
- generating the first risk score and the second risk score using the risk model;
- and
- configuring recommendation data for the group based at least in part on the first risk score or the second risk score, the recommendation data comprising an indication of a high risk associated with the first risk score or the second risk score.
Dependencies are inferred from the claim text.