Threat modeling with artificial intelligence

Abstract

The present disclosure relates to threat modeling with artificial intelligence. Systems and techniques for threat modeling with artificial intelligence are disclosed. The techniques include providing a first subset of a plurality of content items related to a target system architecture as input to a graph resolver to obtain a graph resolver output. The techniques also include providing the graph resolver output and a second subset of the plurality of content items as input to a first artificial intelligence (AI) embedding model to obtain a first AI embedding model output containing encoded representations of the graph resolver output and the second subset of the plurality of content items. The techniques also include providing the graph resolver output and at least a first portion of the encoded representations of the second subset of the plurality of content items as input to a first generative AI model to obtain a plurality of potential threats related to the target system architecture.

Description

Technical Field

[0001] At least one embodiment relates to a computing system, and more specifically, to performing threat modeling on a computer system. Background Technology

[0002] Computer systems can be vulnerable to malicious attacks, such as unauthorized access and data breaches. To prevent such attacks, threat modeling can be performed, which includes identifying potential attack vectors (attack vectors, attack pathways, attack vectors) and assessing the corresponding risks. Traditional threat modeling can heavily rely on manual review of architecture diagrams, data flow diagrams, and system documentation. This can be time-consuming, error-prone, and dependent on specialized knowledge, leading to inconsistencies in security coverage and vulnerabilities. Attached Figure Description

[0003] Figure 1 This is a block diagram of an example computer system for threat modeling using artificial intelligence, according to at least one embodiment.

[0004] Figure 2 This is a block diagram of an example data stream for using artificial intelligence to model the threat architecture of a target system, according to at least one embodiment.

[0005] Figure 3 This is a block diagram of an example data flow for data processing as part of threat modeling of a target system architecture using artificial intelligence, according to at least one embodiment.

[0006] Figure 4 It is a block diagram of an example data stream for threat generation as part of threat modeling of a target system architecture using artificial intelligence, according to at least one embodiment.

[0007] Figure 5 It is a block diagram of an example data stream generated according to at least one embodiment for use as part of threat modeling of a target system architecture using artificial intelligence.

[0008] Figure 6 It is a block diagram of an example data stream for severity calculation as part of threat modeling of a target system architecture using artificial intelligence, according to at least one embodiment.

[0009] Figure 7 It is a block diagram of an example data stream generated according to at least one embodiment for use as part of threat analysis profiling of a target system architecture using artificial intelligence.

[0010] Figure 8This is a flowchart of an example method for threat modeling using artificial intelligence, according to at least one embodiment.

[0011] Figure 9 This is a flowchart of an example method for threat modeling using artificial intelligence, according to at least one embodiment.

[0012] Figure 10 This is a block diagram illustrating an exemplary computer system according to at least one embodiment.

[0013] Figure 11A This is a block diagram of an example generative language model system applicable to implementing some embodiments of the present disclosure.

[0014] Figure 11B This is a block diagram of an example generative language model of a transformer encoder-decoder suitable for implementing some embodiments of this disclosure.

[0015] Figure 11C This is a block diagram of an example generative language model that includes a decoder-only transformer architecture suitable for implementing some embodiments of this disclosure. Detailed Implementation

[0016] As software systems become increasingly complex, manual processes struggle to keep up, leading to delays in threat identification and mitigation. This lag increases vulnerability to attacks, potentially resulting in significant security incidents and related losses. The manual nature of traditional threat modeling also introduces a high risk of human error, limiting scalability and consistency.

[0017] Certain aspects of this disclosure address the aforementioned and other shortcomings by providing systems and techniques that allow for threat modeling using artificial intelligence (AI). The disclosed AI-driven threat modeling system can perform threat modeling on a specific target system. This AI-driven threat modeling system can first identify the assets, connections, data flows, and architecture of the target system by analyzing architecture diagrams, system documentation, and data flow diagrams. For example, a graphical representation of the system architecture can be provided to a graph resolver to obtain graph resolver output describing the graphical representation of the system architecture. The graph resolver can be an AI visual model or a program that parses one or more digital file formats that can encode a graphical representation of the system architecture. The graph resolver output can include a textual description of the system architecture for identifying system assets and connections between different system assets. In some embodiments, a user can provide a textual description of the system architecture or modify the graph resolver output. The graph resolver output can be provided to an AI embedding model that can encode the information described in the graph resolver output into an embedding space for subsequent retrieval.

[0018] Additional textual descriptions of system assets (e.g., system documentation) can be provided to an AI embedding model to encode the information described in the textual descriptions into the embedding space for subsequent retrieval.

[0019] After parsing the target system's documentation, an AI-driven threat modeling system can generate potential threats to the target system. For example, the AI-driven threat modeling system can determine which system assets are interconnected based on the target system's documentation. For each connection, the AI-driven threat modeling system can generate one or more potential threats. For example, for a first connection between a first asset and a second asset, the AI-driven threat modeling system can retrieve embedded information related to the first asset, the second asset, and the connection itself. This embedded information can be combined with a "threat generation" text prompt to create a "threat generation input."

[0020] In some embodiments, the "threat generation" text prompt may include detailed information to ensure the generated threat is complete and considers the threat to connections and assets and its impact on connections, assets, other assets, and / or the entire system. In some embodiments, the "threat generation" text prompt may include detailed information to generate the threat based on one or more threat assessment methods, such as CIA (confidentiality, integrity, and availability) or STRIDE (spoofing, tampering, denial, information disclosure, denial of service, and privilege escalation).

[0021] Threat generation input can be provided to an AI model (e.g., a large language model (LLM)) that can output one or more potential threats related to the connection between a first and second asset. This process can be repeated for one or more connections in the target system. Embedding information of the assets in the connection can be retrieved, combined with textual prompts, and the threat generation input can be provided to the AI ​​model to generate one or more potential threats related to the connection between the assets.

[0022] After generating potential threats to the target system, an AI-driven threat modeling system can determine which potential threats have been mitigated and provide recommended mitigation strategies. A mitigation catalog can be prepared by providing one or more mitigation reference documents to the AI ​​embedding model. Then, a first identified threat can be selected, and mitigation embedding information can be retrieved based on that first identified threat. Target system asset embedding information can also be retrieved for each asset associated with the threat. Threat information and embedding information can be combined with “mitigation generation” text prompts to create “mitigation generation inputs.” These “mitigation generation inputs” can be provided to an AI model (e.g., an LLM) that can output information describing whether a potential threat in the target system has been mitigated, or information describing steps that should be taken to mitigate a potential threat in the target system. This process can be repeated for one or more previously identified potential threats.

[0023] After generating mitigation measures for potential threats to the target system, an AI-driven threat modeling system can determine a risk score for the potential threat. This risk score can be based on a combination of factors, including the potential impact of the potential threat on the target system, the number of mitigation measures prepared for the potential threat, and the effort, skills, and knowledge required from the attacker.

[0024] In some embodiments, an AI model can be used to generate risk scores. A risk catalog can be prepared by providing the AI ​​embedding model with one or more documents describing an attacker's efforts, resources, skills, etc. The potential threat, mitigation information generated for that potential threat, and risk embedding information from the risk catalog are then combined with a "risk generation" text prompt to create a "risk generation input." This "risk generation input" can be provided to the AI ​​model, which can output a risk level associated with the potential threat based on currently available mitigation measures and the impact of the potential threat. In one embodiment, the risk score can be calculated using one or more algorithms, such as algorithms that assign positive scores (e.g., high scores) to threats based on their potential impact on the target system, and negative scores (e.g., low scores) to threats that have been mitigated. For example, the impact score of a potential threat might be 10, but if the potential threat has been mitigated, the risk score might be 0 (e.g., impact score 10 minus mitigation score 10 = 0 overall risk score).

[0025] The output of an AI-driven threat modeling system can be a set of potential threats to a target system, mitigation measures for these potential threats, and risk scores corresponding to these potential threats. In some embodiments, the output can be sorted based on the risk scores of the potential threats so that the potential threats with the highest risk scores are displayed to the user first.

[0026] Compared with existing technologies, the disclosed embodiments have advantages including, but not limited to, reducing human error, accelerating threat identification, and simplifying the determination of countermeasures, thereby improving overall security.

[0027] Figure 1 This is a block diagram of an example computer system 100 for threat modeling using artificial intelligence, according to at least one embodiment. System 100 may include a threat modeling subsystem 102 for performing threat modeling on another system or subsystem (e.g., target subsystem 120). Threat modeling subsystem 102 may be connected to one or more client devices 118 via network 116. Network 116 may be a public network (e.g., the Internet), a private network (e.g., a local area network (LAN) or a wide area network (WAN)), a wired network (e.g., Ethernet), a wireless network (e.g., an 802.11 network or a Wi-Fi network), a cellular network (e.g., a Long Term Evolution (LTE) network), a router, a hub, a switch, a server computer, and / or combinations thereof.

[0028] The threat modeling subsystem 102 may include one or more processors, such as a central processing unit (CPU) 104 and / or a graphics processing unit (GPU) 108, and memory 106. In some embodiments, the threat modeling subsystem 102 may be a desktop computer, server, laptop, mobile device, data center processing device, etc. The CPU 104 and / or GPU 108 may be used to perform one or more operations (e.g., execute one or more programs or applications, including artificial intelligence (AI) and / or machine learning applications). For example, the CPU 104 may perform the operation of loading one or more AI models (e.g., AI model 110) from memory 106 into GPU 108 and having them executed by GPU 108. During AI model execution, the CPU 104 may provide one or more inputs to the AI ​​model and may receive one or more outputs from the AI ​​model based on the provided inputs. In one embodiment, AI model 110 may include one or more generative AI models and one or more AI embedded models. Figure 11A , Figure 11B and Figure 11C Examples of possible AI models that can be executed by CPU 104 and / or GPU 108 will be discussed in more detail.

[0029] Memory 106 may include at least one of flash memory or random access memory (RAM), such as dynamic random access memory (DRAM) or synchronous random access memory (SDRAM). Memory 106 may store one or more AI models, such as model weights, coefficients, biases, etc., one or more model inputs, one or more model outputs, content items describing the target subsystem 120 (e.g., content item 130), mitigation items, risk items, and / or similar content.

[0030] In some embodiments, memory 106 may store outputs from an AI embedding model, such as encoded representations of content items (e.g., content item 130) describing the target subsystem 120. In some embodiments, the outputs of the AI ​​embedding model may be stored in data storage 112. Data storage 112 may include one or more data structures for storing information, such as relational databases, document-based databases, vector repositories, etc. Data storage 112 may store one or more encoded representations 114. For example, as will be discussed in more detail below, content items describing the target subsystem 120 may be provided to the AI ​​embedding model. The AI ​​embedding model may convert the content items into one or more encoded representations 114 within a latent embedding space. Data storage 112 may be "queried" to obtain a textual representation of the encoded representation 114 associated with the "query." For example, the query may be encoded into the latent embedding space, and any encoded representation 114 similar to the query (e.g., based on one or more similarity algorithms, such as cosine similarity) may be returned as a response to the query. In some embodiments, the response to the query is a textual representation of an encoded representation similar to the query.

[0031] Target subsystem 120 may be the object of threat modeling performed by threat modeling subsystem 102 using artificial intelligence. In some embodiments, target subsystem 120 may be connected to threat modeling subsystem 102 (e.g., via network 116). In some embodiments, target subsystem 120 may not yet exist. For example, target subsystem 120 may be described by one or more documents (e.g., content item 130) that describe the architecture of target subsystem 120 and the components that will exist in target subsystem 120, but target subsystem 120 may not yet be built (e.g., not yet connected, installed, configured, etc.).

[0032] The target subsystem 120 may include one or more components that can be connected to one or more other components. For example, the target subsystem 120 may include component A 122 connected to component B 124 and component C 126, and component D 128 connected to component C 126. In some embodiments, one or more components of the target subsystem 120 may be connected via one or more networks (not shown).

[0033] In some embodiments, the object of threat modeling can be a component of a computer system. For example, threat modeling using artificial intelligence can be performed on computer chips, circuit boards, cables, etc.

[0034] Content item 130 may describe the target subsystem 120 and its architecture. For example, content item 130 may include one or more design documents, data flow diagrams, system diagrams, visual representations of the target subsystem 120 architecture, textual descriptions of the target subsystem 120 architecture, etc. In some embodiments, content item 130 may be created before the target subsystem 120 is created. For example, content item 130 may include documents detailing the plan for building the target subsystem 120. In some cases, it may be advantageous to use artificial intelligence to perform threat modeling of the target subsystem 120 before spending time and resources to create it.

[0035] As an example, target subsystem 120 may be a system for client-server interaction. Component A 122 may be a device providing services (e.g., a computer, server, data center, etc.). Component B 124 may be a database component connected to component A 122. Component C 126 may be a reverse proxy and / or load balancer that receives requests and routes them to component A 122. Component D 128 may be a client device that sends requests to component C 126 (e.g., via a network (not shown)) to interact with the services provided by component A 122.

[0036] Threat modeling subsystem 102 can use artificial intelligence to perform threat modeling on target subsystem 120. As described below, threat modeling subsystem 102 can use one or more AI models to identify and analyze the various components of target subsystem 120 (e.g., component A 122, component B 124, component C 126, component D 128, etc.) and the connections between them.

[0037] Figure 2 This is a block diagram of an example data flow 200 for threat modeling of a target system architecture using artificial intelligence, according to at least one embodiment. During threat modeling of the target system architecture using artificial intelligence, one or more items may be provided to the data processing subsystem 208. These items may include content items 202, mitigation items 204, and / or risk items 206. Content items 202 may include textual descriptions and visual representations of the target system architecture. For example, content items 202 may include design documents, data flow diagrams, and / or other items describing assets (e.g., components) in the target system and / or interactions between assets in the target system.

[0038] Mitigation Item 204 may include items describing mitigation measures to be taken in response to a specific threat. Mitigation Item 204 may include known response documents, organization-specific strategy documents, standardized control documents, and / or similar content.

[0039] Risk item 206 may include items describing the severity of a specific threat. Risk item 206 may describe the attacker's effort, resources, skills, and / or similar content. Risk item 206 may describe the potential impact on the target system if a specific threat is not mitigated. Risk item 206 may include historical threat models, standard guidelines, estimates of attacker effort, threat impact estimates, and / or similar content.

[0040] Content item 202, mitigation item 204, and risk item 206 can be provided to data processing subsystem 208, which can convert these items into an encoded representation, which can be stored in data storage 210, as will be discussed below. Figure 3 To provide a more detailed description.

[0041] One or more content items from data storage 210, represented as 212a, can be provided to a threat generation subsystem 214, which can generate one or more potential threats 216 based on the target system architecture, as will be discussed below. Figure 4 To provide a more detailed description.

[0042] The potential one or more threats 216 and one or more content items represented 212b in data storage 210 can be provided to a mitigation generation subsystem 218, which can generate one or more mitigation recommendations 220, which can be executed to defend against the potential one or more threats 216, as detailed below. Figure 5 Describe it.

[0043] One or more mitigation suggestions 220 and one or more content item representations 212c from one or more data stores 210 may be provided to a severity calculation subsystem 222, which may generate one or more risk scores 224 indicating the severity of one or more potential threats 216 to the target system, with further details to follow. Figure 6 Describe it.

[0044] One or more risk scores 224 and content item representations 212d in data storage 210 can be provided to a threat analysis profile generation subsystem 226, which can generate a user profile 228 that describes the target system architecture, potential threats to the target system (e.g., one or more potential threats 216), recommended mitigation measures to protect the target system (e.g., one or more mitigation recommendations 220), and the severity of the potential threats to the target system (e.g., one or more risk scores 224), as will be discussed below. Figure 7 To describe in more detail.

[0045] Figure 3 This is a block diagram of an example data flow 300 for data processing as part of threat modeling of a target system architecture using artificial intelligence, according to at least one embodiment. Data processing subsystem 302 may receive one or more content items and encode them into a latent embedding space for subsequent querying and / or retrieval. Data processing subsystem 302 may receive one or more text-based items, such as text content item 304, mitigation item 306, and / or risk item 308. These text-based items may be provided to AI embedding model 312, which may include one or more AI models trained to convert text into encoded representations (e.g., vectors) in the latent embedding space. The output of AI embedding model 312 may be stored in a data store, such as data store 318a, data store 318b, or data store 318c. In one embodiment, all outputs from AI embedding model 312 may be stored in the same data store (e.g., data store 318a). In some embodiments, the output based on text content item 304 (e.g., encoded content item 320) may be stored in a first data storage (e.g., data storage 318a), the output based on mitigation item 306 (e.g., encoded mitigation item 322) may be stored in a second data storage (e.g., data storage 318b), and the output based on risk item 308 (e.g., encoded risk item 324) may be stored in a third data storage.

[0046] In some embodiments, the data processing subsystem 302 may include a graph resolver 314. In some embodiments, the graph resolver 314 is a program for parsing one or more digital file formats, such as visual content item 310, capable of encoding a graphical representation of a target system architecture. In some embodiments, the graph resolver 314 is an AI vision model. The graph resolver 314 may generate a graph resolver output 316, which may include a textual description of the target system architecture depicted in the graphical representation (e.g., visual content item 310). The graph resolver output 316 may identify system assets (e.g., components) and connections between system assets.

[0047] In some embodiments, the user may provide a textual description of the system architecture or modify the graph resolver output 316. The graph resolver output 316 may be provided to the AI ​​embedding model 312 along with other text-based items to obtain an encoded representation of the visual content item 310. The encoded representation of the visual content item 310 may be stored in a data store, such as a data store that stores the encoded representation of the text content item 304 (e.g., data store 318a) or a data store (not shown) for storing the encoded representation of the visual content item.

[0048] In some embodiments, more than one AI embedding model may be used. For example, a first AI embedding model may be used to convert content items into encoded representations within a latent embedding space, and a second AI embedding model may be used to convert mitigation items into encoded representations within the same (or different) latent embedding spaces.

[0049] Data storage 318a, data storage 318b, and / or data storage 318c may include a database optimized for storing the output from the AI ​​embedding model 312. For example, data storage 318a may include a vector storage (e.g., an embedded data storage) optimized for storing high-dimensional vectors and performing operations (e.g., similarity search, nearest neighbor search, and / or clustering) on ​​the stored vectors.

[0050] Figure 4 This is a block diagram of an example data stream 400 for threat generation as part of threat modeling of a target system architecture using artificial intelligence, according to at least one embodiment. The threat generation subsystem 402 may use one or more AI models (e.g., generative AI model 410) and based on content items describing the target system architecture to generate one or more potential threats (e.g., potential threats 412) against the target system architecture.

[0051] The threat generation subsystem 402 can receive one or more content item representations 406 from the data storage 408, which can be used to generate input hints for the AI ​​model. For example, the content item representation 406 of the first asset in the target system architecture can be combined with the threat generation hint 404 to create a threat generation input hint.

[0052] Content item representation 406 may include a textual description of an asset in the target system architecture. This description may contain information related to connections between the asset and other assets in the target system architecture. For example, a first asset may be selected from the assets of the target system architecture. Data storage 408 may be queried to obtain information related to the selected asset. Data storage 408 may use similarity algorithms, nearest neighbor algorithms, clustering algorithms, and / or similar algorithms to determine which encoded representations (e.g., using...) Figure 2 The data generated by the data processing subsystem 208 is most relevant to the selected asset. In some embodiments, the similarity algorithm, nearest neighbor algorithm, or clustering algorithm is performed using the vector storage of the data storage 408.

[0053] As an example, assuming the selected asset is a server component, a data storage 408 can be queried against the server component, and the data storage 408 can respond to the query by providing a content item representation 406, which may include a description of the server component of the target system architecture and a description of the connection between the server component and the database component of the target system architecture.

[0054] Threat generation prompt 404 may contain text prompting a generative AI model (e.g., generative AI model 410) to generate one or more potential threats that may affect specific assets of the target system architecture (e.g., the asset represented by content item representation 406). Threat generation prompt 404 may include details to ensure the generated threats are complete and consider the threats to connectivity and assets and their impact on connectivity, assets, other assets, and / or the system as a whole. In some embodiments, threat generation prompt 404 may include details to guide the AI ​​model to generate potential threats based on one or more threat assessment methods (e.g., CIA (Confidentiality, Integrity, and Availability) or STRIDE (Deception, Tampering, Denial, Information Disclosure, Denial of Service, and Privilege Escalation)).

[0055] Threat generation input prompts can be provided as input to a generative AI model 410, which can be an AI model trained to generate text based on a given input, such as a language model or a large language model (LLM). In some embodiments, the generative AI model 410 may include one or more transformer-based AI models. The generative AI model 410 can generate one or more potential threats 412 that may affect assets of the target system architecture represented by the content item representation 406.

[0056] After (or simultaneously with) generating potential threats for the first asset and / or connection of the target system architecture, a second threat generation input prompt can be created using threat generation prompt 404 and a second content item representation from data storage 408. The second content item representation can describe additional assets of the target system architecture and / or connections between previous assets of the target system architecture and other assets of the target system architecture. For example, if the first content item representation describes a server component and the connection between the server component and the database component of the target system architecture, then the second content item representation can describe the server component and the connection between the server component and client devices of the target system architecture. Alternatively, the second content item representation can describe client devices of the target system architecture and the connection between the client devices and the load balancer of the target system architecture. Based on the second threat generation input prompt, a second set of potential threats can be generated.

[0057] This process can be repeated for each asset and / or connection in the target system architecture to obtain a set of potential threats that could affect any part of the target system architecture.

[0058] Figure 5 This is a block diagram of an example data stream 500 for generating mitigation recommendations as part of threat modeling of a target system architecture using artificial intelligence, according to at least one embodiment. The mitigation generation subsystem 502 can generate one or more mitigation recommendations (e.g., mitigation recommendation 516) based on potential threats generated from the target system architecture.

[0059] In some embodiments, the mitigation measure generation subsystem 502 can generate mitigation recommendations in two steps: first, generating possible mitigation measures based on potential threats; and second, generating mitigation recommendations based on generated but not yet implemented possible mitigation measures (such as those indicated in target system architecture documentation / content items). In some embodiments, the mitigation measure generation subsystem 502 can generate mitigation recommendations in a single step, combining potential threats and target system architecture to generate mitigation recommendations, without the intermediate step of separately generating possible mitigation measures based on potential threats.

[0060] For example, the mitigation generation subsystem 502 can receive one or more potential threats 506 (e.g., from...). Figure 4 The threat generation subsystem 402 in the system. Potential threats 506 can be combined with mitigation item representations 508, content item representations 510, and mitigation generation prompts 504 to generate mitigation generation input prompts for the AI ​​model.

[0061] Potential threat 506 may include potential threats generated against specific assets and / or connections in the target system architecture. Content item representation 510 may include a textual description of the assets and / or connections targeted by potential threat 506. Queryable data storage 512 can retrieve information related to the assets and / or connections targeted by potential threat 506.

[0062] The mitigation item representation 508 may include a textual description of known mitigation measures that can be performed against a specific threat. For example, the data storage 512 may contain mitigation information from one or more previously addressed mitigation item representations (e.g., using...). Figure 2 The data processing subsystem 208 can query the data storage 512 based on potential threats 506 to obtain mitigation information related to potential threats.

[0063] The mitigation action generation prompt 504 may contain text to prompt the generative AI model (e.g., generative AI model 514) to generate one or more mitigation suggestions 516 targeting the potential threat 506 based on the mitigation action item representation 508 and the content item representation 510. The mitigation suggestion 516 may include steps to be performed to protect the assets and / or connections of the target system from the potential threat 506, and / or information describing that the potential threat has been mitigated.

[0064] In some embodiments, mitigation recommendation 516 may include additional information explaining why a potential threat is considered mitigated or not yet mitigated. For example, if a mitigation recommendation indicates that a potential threat has been mitigated, the mitigation recommendation may include one or more portions of content item representation 510 to demonstrate that the potential threat has been mitigated. For example, the potential threat may involve a malicious actor eavesdropping on network traffic between two devices. If the target system architecture (as indicated by content item representation 510) is using encrypted communication (e.g., Transport Layer Security (TLS)) between the two devices, the potential threat can be considered “mitigated,” and the mitigation recommendation may include one or more portions of content item representation 510 indicating that the target system architecture is using encrypted communication.

[0065] As another example, if a mitigation recommendation indicates that a potential threat has not been mitigated, the mitigation recommendation may include one or more portions of Content Item Representation 510 explaining why the potential threat is considered unmitigated. For example, the potential threat might involve a malicious actor eavesdropping on network traffic between two devices. If the target system architecture (as indicated by Content Item Representation 510) is using unencrypted communication, the potential threat may be considered "unmitigated," and the mitigation recommendation may include one or more portions of Content Item Representation 510 indicating that the target system architecture is using unencrypted communication.

[0066] As another example, if a potential threat involves a malicious actor eavesdropping on network traffic between two devices, and content item representation 510 does not contain information about whether the communication is encrypted, then the potential threat can be considered "unmitigated" (or "unknown"). Mitigation recommendations might include one or more sections of content item representation 510 that discuss the communication between the two devices and indicate that it is unclear whether the communication is encrypted.

[0067] After (or simultaneously with) generating mitigation recommendations for the first potential threat to the target system architecture, a second mitigation generation input prompt can be created using mitigation generation prompt 504 and the second potential threat, along with associated mitigation information and content item information from data storage 512. The second potential threat may point to another asset in the target system architecture, and data storage 512 can be queried to obtain information related to that asset. Data storage 512 can also be queried to obtain information related to the second potential threat.

[0068] This process can be repeated for each potential threat to the target system architecture to obtain a set of mitigation recommendations that can be implemented to defend against the generated set of potential threats.

[0069] Figure 6 This is a block diagram of an example data flow 600 for severity calculation as part of threat modeling of a target system architecture using artificial intelligence, according to at least one embodiment. The severity generation subsystem 602 can generate one or more risk scores (e.g., risk score 616) based on potential threats generated according to the target system architecture and on mitigation recommendations corresponding to those potential threats.

[0070] The severity generation subsystem 602 can receive one or more potential threats 606 (e.g., from...). Figure 4 The threat generation subsystem 402 in the system). Potential threats 606 can be associated with mitigation recommendations 608 (e.g., from...). Figure 5 The system combines the mitigation measures generation subsystem 502, risk item representation 610, and risk generation prompt 604 to generate input prompts for risk scores for the AI ​​model.

[0071] Potential threats 606 may include potential threats to specific assets and / or connections of the target system architecture. Mitigation recommendations 608 may include mitigation recommendations for preventing potential threats arising from specific assets and / or connections of the target system architecture.

[0072] Risk item representation 610 may include a textual description of the severity of the generated potential threat. For example, data storage 612 may contain previously processed (e.g., using...) Figure 2The data processing subsystem 208 in the system provides severity information for one or more risk items. Data storage 612 can be queried based on a potential threat 606 to obtain severity information related to that potential threat. Severity information may be based on historical threat models, standard guidelines, attacker effort estimates, threat impact estimates, and / or similar content.

[0073] Risk generation prompt 604 may contain text prompting the generative AI model (e.g., generative AI model 614) to generate one or more risk scores 616 pointing to a potential threat 606 based on risk item representation 610. The risk score 616 may indicate the severity of the impact on the target system if the potential threat occurs.

[0074] In some embodiments, the severity generation subsystem 602 may generate a risk score 616 using one or more algorithms without employing an AI model. For example, an algorithm may be used to generate the risk score by combining multiple values ​​determined based on potential threats and mitigation recommendations. This algorithm may assign positive scores (e.g., high scores) to threats based on their potential impact on the target system, and negative scores (e.g., low scores) to mitigated threats. Thus, the impact score of a potential threat might be 10, but if the potential threat has been mitigated, the risk score might be 0 (e.g., impact score 10 minus mitigation score 10 = 0 overall risk score). In some embodiments, these values ​​may have corresponding weighting coefficients.

[0075] In some embodiments, the severity generation subsystem 602 may use a risk matrix to generate a risk score 616. Potential threats may be assigned a "probability" score, indicating the likelihood of a threat occurring; and an "impact score," indicating the magnitude of the impact if the threat occurs. The risk score may be calculated based on a combination of the probability and impact scores.

[0076] After (or simultaneously with) generating a risk score for the first potential threat to the target system architecture, a second risk score generation input prompt can be created using risk generation prompt 604 and the second potential threat, along with associated mitigation recommendations and risk item information from data storage 612. The second potential threat may point to another asset in the target system architecture. Data storage 612 can be queried to obtain risk information related to the second potential threat.

[0077] This process can be repeated for each potential threat to the target system architecture to obtain a set of risk scores associated with the target system architecture.

[0078] Figure 7This is a block diagram of an example data flow 700 for generating a threat analysis profile as part of a threat modeling of a target system architecture using artificial intelligence, according to at least one embodiment. The threat analysis profile generation subsystem 702 can generate a user profile (e.g., user profile 718) based on potential threats, mitigation recommendations, and risk scores generated according to the target system architecture.

[0079] The threat analysis summary generation subsystem 702 can receive one or more potential threats 706 (e.g., from...). Figure 4 Threat generation subsystem 402), one or more mitigation recommendations 708 (e.g., from... Figure 5 The mitigation suggestion generation subsystem 502) and one or more risk scores 710 (e.g., from Figure 6 (Severity generation subsystem 602). This information can be combined with summary generation prompts 704 and content item representations 712 to generate user summary input prompts for the AI ​​model.

[0080] Potential threat 706 may include potential threats to specific assets and / or connections in the target system architecture. Content item representation 712 may include a textual description of the assets and / or connections targeted by potential threat 706. Data storage 714 can be queried to obtain information related to the assets and / or connections targeted by potential threat 706.

[0081] Mitigation recommendations 708 may include generated mitigation recommendations for preventing potential threats to specific assets and / or connections in the target system architecture.

[0082] The risk score 710 may include a severity score, which indicates the potential impact on the target system architecture if a potential threat occurs.

[0083] Summary generation prompt 704 may contain text prompting the generative AI model (e.g., generative AI model 716) to summarize the assets contained in the target system architecture, potential threats to the target system architecture, mitigation recommendations to prevent these potential threats, and / or risk scores (e.g., severity scores) associated with these potential threats. User summary 718 may contain a human-readable summary of threat modeling.

[0084] In some embodiments, user profile 718 may present a list of recommended mitigation measures that can be implemented to protect a target system architecture. The recommended mitigation measures can be sorted according to the risk scores of the associated potential threats. For example, the recommended mitigation measures for the potential threats with the highest risk scores may be included at the top (e.g., at the beginning) of user profile 718.

[0085] In some embodiments, a first user profile can be generated at a first time point for a first potential threat and its associated mitigation recommendations and risk scores, and a second user profile can be generated at a later second time point for a second potential threat and its associated mitigation recommendations and risk scores. The first and second user profiles can be merged based on the risk score of each potential threat before being presented to users (e.g., users associated with the target system architecture).

[0086] In some embodiments, user profiles can be generated simultaneously for a first potential threat and its associated mitigation recommendations and risk scores, as well as for a second potential threat and its associated mitigation recommendations and risk scores (e.g., after both the first and second potential threats have passed through the threat modeling pipeline).

[0087] In the foregoing discussion, it should be understood that in some embodiments, the generative AI models described in relation to the accompanying figures are the same generative AI models. In some embodiments, one or more generative AI models described in relation to the accompanying figures may be different. For example, a first generative AI model may be trained and / or fine-tuned to generate potential threats, and a second generative AI model may be trained and / or fine-tuned to generate mitigation suggestions.

[0088] Figure 8 This is a flowchart of an example method 800 for threat modeling using artificial intelligence, according to at least one embodiment. Figure 9 This is a flowchart of an example method 900 for threat modeling using artificial intelligence, according to at least one embodiment.

[0089] Methods 800 and / or 900 may be executed using one or more processing units (e.g., CPU, GPU, accelerator, physical processing unit (PPU), data processing unit (DPU), etc.), which may include one or more memory devices (or communicate with one or more memory devices). In at least one embodiment, methods 800 and / or 900 may be executed using one or more processing devices. In at least one embodiment, methods 800 and / or 900 may use... Figure 1The processing unit (e.g., CPU 104, GPU 108) of the threat modeling subsystem 102 executes the method. In at least one embodiment, the processing unit executing any of methods 800 and / or 900 can execute instructions stored on a non-transitory computer-readable storage medium. In at least one embodiment, any of methods 800 and / or 900 can be executed using multiple processing threads (e.g., CPU threads and / or GPU threads), each thread executing one or more individual functions, routines, subroutines, or operations of the method. In at least one embodiment, the processing threads implementing any of methods 800 and / or 900 can be synchronized (e.g., using semaphores, critical sections, and / or other thread synchronization mechanisms). Alternatively, the processing threads implementing any of methods 800 and / or 900 can execute asynchronously with each other. Various operations of methods 800 and / or 900 can be performed in conjunction with... Figure 8 and / or Figure 9 The operations shown are executed in different sequences. Some operations in methods 800 and / or 900 can be executed concurrently with other operations. In at least one embodiment, Figure 8 and / or Figure 9 One or more of the operations shown may not always be executed.

[0090] Figure 8 This is a flowchart of an example method 800 for threat modeling using artificial intelligence, according to at least one embodiment. In block 802, a processing unit performing method 800 may provide a first subset of multiple content items related to a target system architecture as input to a graph resolver to obtain the output of the graph resolver. In some embodiments, the graph resolver is a trained AI vision model for converting a graphical representation of the target system architecture into a textual description of the target system architecture. In some embodiments, the graph resolver is a program for parsing one or more digital file formats that can encode a graphical representation of the system architecture. The output of the graph resolver may include a textual description of the system architecture that identifies system assets and connections between different system assets.

[0091] In some embodiments, multiple content items related to the target system architecture may include at least one of a visual representation of the target system architecture (e.g., a diagram of the target system architecture), a textual description of the target system architecture, design documents related to the target system architecture, data flow diagrams, and / or similar content.

[0092] In block 804, the processing unit may provide the graph resolver output and a second subset of multiple content items related to the target system architecture as input to the first artificial intelligence (AI) embedding model to obtain the first AI embedding model output. The first AI embedding model output may include the encoded representation of the graph resolver output and the second subset of multiple content items related to the target system architecture.

[0093] In some embodiments, the processing unit may store the output of the first AI embedding model in an embedded data storage in a memory accessible to the processing unit.

[0094] In block 806, the processing unit may provide at least a first portion of the encoded representation of the graph resolver output and a second subset of multiple content items as input to a first generative AI model to obtain multiple potential threats related to the target system architecture.

[0095] In some embodiments, in block 808, the processing unit may provide one or more mitigation items as input to the second AI embedding model to obtain the output of the second AI embedding model. The output of the second AI embedding model may include encoded representations of one or more mitigation items.

[0096] In some embodiments, one or more mitigation measures may include at least one of known policy documents, organization-specific policy documents, standardized control documents, and / or similar documents.

[0097] In some embodiments, in block 810, the processing unit may provide at least a portion of the encoded representation of one or more mitigation items, and at least a first potential threat among a plurality of potential threats related to the target system architecture, as input to a second generative AI model to obtain one or more mitigation measures related to the first potential threat among the plurality of potential threats.

[0098] Figure 9 This is a flowchart of an example method 900 for threat modeling using artificial intelligence, according to at least one embodiment. In some embodiments, the processing unit may be executing... Figure 8 Block 902 is executed after block 810. In block 902, the processing unit of execution method 900 may provide at least a first mitigation measure among one or more mitigation measures related to a first potential threat among multiple potential threats, and at least a second portion of the encoded representation of the graph resolver output and a second subset of multiple content items related to the target system architecture, as input to a third generative AI model to obtain one or more mitigation recommendations related to the first potential threat among multiple potential threats.

[0099] In block 904, the processing unit may generate a first risk score based at least on a first mitigation suggestion from one or more mitigation suggestions associated with a first potential threat among a plurality of potential threats. In one embodiment, the first risk score is generated using one or more algorithms, such as algorithms that assign positive scores (e.g., high scores) to threats and negative scores (e.g., low scores) to mitigated threats based on their potential impact on the target system. For example, the impact score of a potential threat might be 10, but if the potential threat has been mitigated, the risk score might be 0 (e.g., impact score 10 minus mitigation score 10 = 0 total risk score). In some embodiments, the first risk score is generated according to blocks 906 and 908.

[0100] In block 906, the processing unit may provide one or more risk items as input to the third AI embedding model to obtain the output of the third AI embedding model. The output of the third AI embedding model may include the encoded representation of one or more risk items.

[0101] In some embodiments, the one or more risk items may include at least one of historical threat models, standard guidelines, attacker effort estimates, threat impact estimates, and / or similar content.

[0102] In block 908, the processing unit may provide at least a portion of the encoded representation of the one or more risk items, and at least a first mitigation suggestion from one or more mitigation suggestions related to a first potential threat among a plurality of potential threats relating to the target system architecture, as input to a fourth generative AI model to obtain a first risk score.

[0103] In block 910, the processing unit may provide multiple risk scores to a user associated with the target system architecture. In some embodiments, the user is a developer, analyst, owner, or similar person of the target system architecture. The multiple risk scores may include a first risk score associated with a potential threat related to the first mitigation recommendation, and one or more additional risk scores associated with other potential threats related to the target system architecture.

[0104] Figure 10 This is a block diagram of an exemplary computer system according to at least one embodiment of the present disclosure. Computer system 1000 may correspond to... Figure 1 The threat modeling subsystem 102 described herein. In some embodiments, the computer system 1000 may also correspond to the threat modeling subsystem 102 described herein. Figure 1The target subsystem 120 or one or more components of the target subsystem 120, such as component A 122, component B 124, component C 126, and / or component D 128, are described herein. The computer system 1000 may operate as a server or endpoint machine in an endpoint-server network environment, or as a peer machine in a peer-to-peer (or distributed) network environment. This machine may be a television, personal computer (PC), tablet computer, set-top box (STB), personal digital assistant (PDA), mobile phone, network device, server, network router, switch, or bridge, or any machine capable of executing a set of instructions (sequentially or otherwise) specifying the actions to be performed by the machine. Furthermore, although only a single machine is shown in the figure, the term "machine" should also include any collection of machines that individually or collectively execute a set (or more) of instructions to perform one or more methods discussed herein.

[0105] Example computer system 1000 includes a processing device (processor) 1002, main memory 1004 (e.g., read-only memory (ROM), flash memory, dynamic random access memory (DRAM), such as synchronous DRAM (SDRAM), double data rate DRAM (DDR SDRAM) or DRAM (RDRAM), etc.), static memory 1006 (e.g., flash memory, static random access memory (SRAM), etc.) and data storage device 1016, which communicate with each other via bus 1028.

[0106] Processor (processing device) 1002 represents one or more general-purpose processing devices, such as microprocessors, central processing units, etc., and may include processing logic 1022. More specifically, processor 1002 may be a Complex Instruction Set Computing (CISC) microprocessor, a Reduced Instruction Set Computing (RISC) microprocessor, a Very Long Instruction Word (VLIW) microprocessor, or a processor implementing other instruction sets, or may be a processor implementing combinations of instruction sets. Processor 1002 may also be one or more special-purpose processing devices, such as application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), network processors, etc. Processor 1002 is configured to execute instructions 1026 (e.g., for generating threat indication alerts) to perform the operations discussed herein.

[0107] The computer system 1000 may also include a network interface device 1008. The computer system 1000 may also include a video display unit 1010 (e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)), an input device 1012 (e.g., a keyboard, including alphanumeric keypads, motion-sensing input devices, and touchscreens), a cursor control device 1014 (e.g., a mouse), and a signal generation device 1018 (e.g., a speaker). In one embodiment, the computer system 1000 may not include the video display unit 1010, the input device 1012, and / or the cursor control device 1014 (e.g., in a headless configuration).

[0108] Data storage device 1016 may include a non-transitory machine-readable storage medium 1024 (also a computer-readable storage medium) storing one or more sets of instructions 1026 (e.g., for threat modeling using artificial intelligence), which embody one or more methods or functions described herein. During the execution of instructions by computer system 1000, the instructions 1026 may also reside wholly or at least partially in main memory 1004 and / or processor 1002, which also constitute machine-readable storage media. Instructions may also be transmitted or received on network 1020 via network interface device 1008.

[0109] In one embodiment, instruction 1026 includes instructions for using artificial intelligence for threat modeling. While in one exemplary embodiment, computer-readable storage medium 1024 (machine-readable storage medium) is shown as a single medium, the terms "computer-readable storage medium" and "machine-readable storage medium" should be understood to include a single medium or multiple media (e.g., a centralized or distributed database, and / or associated caches and servers) storing one or more sets of instructions. The terms "computer-readable storage medium" and "machine-readable storage medium" should also be understood to include any medium capable of storing, encoding, or carrying a set of instructions for machine execution, and causing the machine to perform one or more methods of this disclosure. Therefore, the terms "computer-readable storage medium" and "machine-readable storage medium" should be understood to include, but are not limited to, solid-state storage, optical discs, and magnetic media.

[0110] In at least some embodiments, language models, such as large language models (LLMs) and / or other types of generative artificial intelligence (AI), can be implemented. These models may be able to understand, summarize, translate, and / or otherwise generate text (e.g., natural language text, code, etc.), images, videos, computer-aided design (CAD) assets, cosmic and / or metaverse file information (e.g., USD format), etc., based on context provided in input prompts or queries. In some embodiments, these language models can be considered “large” because they are trained on massive datasets and their architectures have a large number of learnable network parameters (weights and biases)—e.g., millions or billions of parameters. LLMs / VLMs, etc., can be implemented to summarize textual data, analyze data (e.g., text, images, videos, etc.) and extract insights from data, and generate new text / images / videos, etc., in user-specified styles, styles, and / or formats. The LLMs of this disclosure may be specifically designed for text processing in some embodiments, while in other embodiments, multimodal LLMs may be implemented to accept, understand, and / or generate text and other types of content, such as images, audio, and / or video. For example, a visual language model (VLM), or more generally, a multimodal language model, can be implemented to accept images, videos, audio, text, 3D designs (e.g., CAD) and / or other input data types, and / or generate or output images, videos, audio, text, 3D designs and / or other output data types.

[0111] Various types of LLM / VLM architectures can be implemented in various embodiments. For example, different architectures can be implemented that use different techniques to understand and generate outputs such as text, audio, video, images, etc. In some embodiments, LLM architectures such as recurrent neural networks (RNNs) or long short-term memory networks (LSTMs) can be used, while in other embodiments, architectures such as transformer architectures that rely on self-attention mechanisms can be used to understand and recognize relationships between words or tokens. One or more generative processing pipelines containing an LLM can also include one or more diffusion modules (e.g., denoisers). The language model of this disclosure can include encoder blocks and / or decoder blocks. For example, discriminative or encoder-only LLMs, such as BERT (transformer-based bidirectional encoder representation), can be implemented for tasks involving language understanding, such as classification, sentiment analysis, question answering, and named entity recognition. As another example, generative or decoder-only LLMs, such as GPT (generative pre-trained transformer), can be implemented for tasks involving language and content generation, such as text completion, story generation, and dialogue generation. LLMs that include both encoder and decoder components, such as T5 (text-to-text transformer), can be implemented for understanding and generating content, for example, for translation and summarization. These examples are not intended to be limiting; any architecture type (including, but not limited to, those described herein) can be implemented depending on the specific implementation and the task performed using the model.

[0112] In various embodiments, language learning models (LLM / VLM, etc.) can be trained using unsupervised learning, where the LLM learns patterns from large amounts of unlabeled text / audio / video / image data, etc. Due to extensive training, in some embodiments, the model may not require task-specific or domain-specific training. An LLM extensively pre-trained on large amounts of unlabeled text data can be referred to as a base model and may excel at various tasks, such as question answering, summarizing, filling in missing information, and translation. Some LLMs can be customized for specific use cases using techniques such as cue tuning, fine-tuning, retrieval augmentation generation (RAG), adding adapters (e.g., custom neural networks and / or neural network layers to fine-tune or adjust cues or labels to bias the language model towards a specific task or domain), and / or using other optimization models for task-specific and / or domain-specific fine-tuning or customization techniques.

[0113] In some embodiments, the LLM / VLM of this disclosure may be implemented using various model alignment techniques. For example, in some embodiments, safeguards may be implemented to identify inappropriate or undesirable inputs (e.g., prompts) and / or outputs of the model. In some non-limiting embodiments, the implemented safeguards may be similar to those described in U.S. Patent Application No. 18,304,341, filed April 20, 2023, the entire contents of which are incorporated herein by reference. In some embodiments, one or more additional models (or layers thereof) may be implemented to identify problems with the model's inputs and / or outputs. For example, these "protective" models may be trained to identify "safe" or otherwise acceptable or desirable inputs and / or outputs, as well as "unsafe" or otherwise undesirable inputs and / or outputs, in a particular application / implementation. Therefore, the LLM / VLM of this disclosure is less likely to output offensive, vulgar, inappropriate, unsafe, out-of-domain, and / or otherwise undesirable language / text / audio, etc., in a particular application / implementation.

[0114] In some embodiments, LLM / VLM, etc., can be configured or able to access or use one or more plugins, application programming interfaces (APIs), databases, data stores, repositories, etc. For example, for certain tasks or operations where the model is not well-suited, the model may have instructions (e.g., through training and / or based on instructions in a given prompt) to access one or more plugins (e.g., third-party plugins) to help process the current input. In such an example, if at least part of the prompt is related to a restaurant or weather, the model can access one or more restaurant or weather plugins (e.g., via one or more APIs) to retrieve relevant information. As another example, when at least part of the response requires mathematical computation, the model can access one or more mathematical plugins or APIs to assist in solving the problem, and then use the responses from the plugins and / or APIs for the model's output. This process can be repeated (e.g., recursively), can be iterated any number of times, and can use any number of plugins and / or APIs until a response to the input prompt that satisfies each query / question / request / process / operation, etc., can be generated. Therefore, models can rely not only on the knowledge they gain from training on large datasets, but also on the expertise or optimized features of one or more external resources (such as APIs, plugins, etc.).

[0115] In some embodiments, multiple language models (e.g., LLM / VLM, etc.), multiple instances of the same language model, and / or multiple prompts provided to the same language model or instances of the same language model can be implemented, executed, or accessed (e.g., using one or more plugins, user interfaces, APIs, databases, data stores, repositories, etc.) to provide output in response to the same query or in response to different parts of the query. In at least one embodiment, multiple language models can provide the same input query and prompts (e.g., a set of constraints, conditions, etc.), such as language models with different architectures or language models trained on different (e.g., updated) data corpora. In one or more embodiments, these language models can be different versions of the same underlying model. In one or more embodiments, at least one language model can be instantiated as multiple agents—e.g., more than one prompt can be provided to constrain, guide, or otherwise influence the style, content, or characteristics of the provided output. In one or more examples (non-limiting embodiments), the same language model can be required to provide output corresponding to different roles, perspectives, characteristics, or different knowledge bases—these outputs are defined by the provided prompts.

[0116] In any such embodiment, the outputs of two or more (e.g., each) language models, two or more versions of at least one language model, two or more instance proxies of at least one language model, and / or two or more prompts provided to at least one language model can be further processed, such as by aggregation, comparison, or filtering, or used to determine (and provide) a consistent response. In one or more embodiments, the output of one language model (or its version, instance, or proxy) can be provided as input to another language model for further processing and / or validation. In one or more embodiments, the language model can be required to generate or otherwise obtain output associated with the input source material. This association can include, for example, generating a description or text portion embedded (e.g., as metadata) along with the input source text or image. In one or more embodiments, the output of the language model can be used to determine the validity of the input source material for further processing or inclusion in a dataset. For example, the language model can be used to evaluate the presence (or absence) of a target word in an object in a text portion or image and to annotate the text or image to record this presence (or absence). Alternatively, the determination from the language model can be used to determine whether the source material should be included in the organized dataset, as an example but not limited to.

[0117] Figure 11A This is a block diagram of an example generative language model system 1100 applicable to implementing at least some embodiments of this disclosure. Figure 11AIn the example shown, the generative language model system 1100 includes a retrieval augmentation (RAG) component 1182, an input processor 1105, a tokenizer 1110, an embedding component 1120, a plugin / API 1185, and a generative language model (LM) 1130 (which may include LLM, VLM, multimodal LM, etc.).

[0118] At a high level, input processor 1105 can receive input 1101, which includes text and / or other types of input data (e.g., audio data, video data, image data, sensor data (e.g., LiDAR, RADAR, ultrasound, etc.), 3D design data, CAD data, generic scene descriptor (USD) data, etc.), depending on the architecture of generative LM 1130. In some embodiments, input 1101 contains plain text existing in the form of one or more sentences, paragraphs, and / or documents. Additionally or alternatively, input 1101 may also contain numerical sequences, pre-computed embeddings (e.g., word embeddings or sentence embeddings), and / or structured data (e.g., tabular formats, JSON, or XML). In some implementations, when generative LM 1130 is capable of handling multimodal input, input 1101 may combine text with image data, audio data, and / or other types of input data (e.g., but not limited to the data described herein). Taking raw input text as an example, input processor 1105 can process raw input text in various ways. For example, input processor 1105 can perform various types of text filtering to remove noise (e.g., special characters, punctuation marks, HTML tags, stop words) from relevant text content. In examples involving stop words (common words that are often semantically insignificant), input processor 1105 can remove stop words to reduce noise and focus the attention of generative LM 1130 on more meaningful content. Input processor 1105 can also apply text normalization, such as converting all characters to lowercase, removing accent marks, and / or handling special cases (e.g., abbreviations or shorthand) to ensure consistency. These are just a few examples; other types of input processing methods can also be applied.

[0119] In some embodiments, RAG component 1182 may be used to retrieve additional information to be used as part of input 1101 or a prompt. For example, in some embodiments, in addition to the data retrieved using RAG component 1182, input 1101 may also be generated using a query or input of the model (e.g., a question, request, etc.). In some embodiments, input processor 1105 may analyze input 1101 and communicate with RAG component 1182 (or in some embodiments, RAG component 1182 may be part of input processor 1105) to identify relevant text and / or other data to provide as additional context or information sources to generative LM 1130, thereby typically identifying a response, answer, or output 1180 based on the additional context or information sources. For example, when the input indicates that the user is interested in the ideal tire pressure for a particular brand and model of vehicle, RAG component 1182 may use methods such as vector search in the embedding space to retrieve tire pressure information or corresponding text from a digital (embedded) version of the owner's manual for that particular brand and model of vehicle. Similarly, when a user revisits the chatbot related to a specific product or service, the RAG component 1182 can retrieve previously stored conversation history (or at least its summary) and pass the previous conversation history along with the current question / request as part of input 1101 to the generative LM 1130.

[0120] The tokenizer 1110 can segment (e.g., processed) text into smaller units (tags) for subsequent analysis and processing. Depending on the specific implementation, the tags can represent individual words, sub-words, characters, etc. Word-based tokenization segments the text into individual words, treating each word as a separate tag. Sub-word tokenization breaks down words into smaller meaningful units (e.g., prefixes, suffixes, stems), enabling the generative LM 1130 to understand lexical variations and handle words outside the vocabulary more effectively. Character-based tokenization represents each character as a separate tag, enabling the generative LM 1130 to process text at a finer-grained level. The choice of tokenization strategy may depend on various factors, such as the language being processed, the current task, and / or the characteristics of the training dataset. Therefore, the tokenizer 1110 can convert (e.g., processed) text into a structured format according to the tokenization scheme implemented in a particular embodiment.

[0121] Embedding component 1120 can use any known embedding technique to convert discrete tokens into semantically meaningful (e.g., dense, continuous vector) representations. For example, embedding component 1120 can use pre-trained word embeddings (e.g., Word2Vec, GloVe, or FastText), one-hot encoding, term frequency-inverse document frequency (TF-IDF) encoding, one or more embedding layers of a neural network, and / or other methods.

[0122] In some implementations, if input 1101 contains image data, input processor 1105 may resize the image data to a standard size compatible with the corresponding input channel format, and / or normalize pixel values ​​to a common range (e.g., 0 to 1) to ensure consistent representation, and embedding component 1120 may encode the image data using any known technique (e.g., using one or more convolutional neural networks (CNNs) to extract visual features). In some implementations, if input 1101 contains audio data, input processor 1105 may resample the audio file to a consistent sampling rate for uniform processing, and embedding component 1120 may use any known technique to extract and encode audio features, such as in the form of a spectrogram (e.g., a Mel spectrogram). In some implementations, if input 1101 contains video data, input processor 1105 may extract frames or apply resizing to extracted frames, and embedding component 1120 may extract features such as optical flow embedding or video embedding, and / or may encode temporal information or frame sequences. In some implementations, if the input 1101 contains multimodal data, the embedded component 1120 can use techniques such as early fusion (stitching), late fusion (sequential processing), and attention-based fusion to fuse representations of different types of data (e.g., text, images, audio).

[0123] Other components of the generative LM 1130 and / or generative language model system 1100 may employ different types of neural network architectures depending on the specific implementation. For example, a transformer-based architecture (such as the one used in models like GPT) may be implemented, and it may include a self-attention mechanism that weights the importance of different words or tokens in the input sequence and / or a feedforward network for processing the output of the self-attention layer, thereby applying a nonlinear transformation to the input representation and extracting higher-level features. Some non-limiting architectural examples include: transformers (e.g., encoder-decoder, decoder-only, multimodal), RNNs, LSTMs, fusion models, diffusion models, cross-modal embedding models that learn a joint embedding space, graph neural networks (GNNs), hybrid architectures that combine different types of adversarial networks (e.g., generative adversarial networks or GANs or adversarial autoencoders (AAEs) for joint distributed learning), and so on. Therefore, depending on the implementation scheme and architecture, the embedded component 1120 can apply the encoded representation of the input 1101 to the generative LM 1130, and the generative LM 1130 can process the encoded representation of the input 1101 to generate an output 1180, which may contain responsive text and / or other types of data.

[0124] As described herein, in some embodiments, the generative LM 1130 may be configured to access or use (or be able to access or use) plugins / APIs 1185 (which may include one or more plugins, application programming interfaces (APIs), databases, data stores, repositories, etc.). For example, for certain tasks or operations where the generative LM 1130 is not well-suited, the model may have instructions (e.g., as a result of training, and / or based on instructions in a given prompt, such as instructions retrieved using RAG component 1182) to access one or more plugins / APIs 1185 (e.g., third-party plugins) to help process the current input. In such an example, if at least part of the prompt information is related to a restaurant or weather, the model may access one or more restaurant or weather plugins (e.g., via one or more APIs), sending at least the portion of the prompt information that is related to a specific plugin / API 1185 to those plugins / APIs 1185, which can process this information and return an answer to the generative LM 1130, which can then use this response to generate output 1180. This process can be repeated (e.g., recursively), iterated an arbitrary number of times, and used with an arbitrary number of plugins / APIs 1185 until an output 1180 is generated that can handle each query / question / request / procedure / action, etc., in the input 1101. Therefore, the model can rely not only on the knowledge gained from training on a large dataset and / or on data retrieved using the RAG component 1182, but also on the expertise or optimized properties of one or more external resources (e.g., plugins / APIs 1185).

[0125] Figure 11B This is a block diagram of an example implementation scheme where the generative LM 1130 contains a transformer encoder-decoder. For example, suppose the input text (e.g., "Who discovered gravity") is tokenized (e.g., via...) Figure 11A The tokenizer 1110 in the middle is converted into tokens (e.g., words), and each token is encoded (e.g., by...). Figure 11A The embedding component 1120 in the input sequence is converted into a corresponding embedding (e.g., size 512). Since these token embeddings do not typically represent the position of the tokens in the input sequence, positional encoding can be added to each token embedding using any known technique to encode the order relation and context of the tokens in the input sequence. In this way, the resulting embeddings can be applied to one or more encoders 1135 of the generative LM 1130.

[0126] In one example implementation, encoders 1135 constitute an encoder stack, where each encoder contains a self-attention layer and a feedforward network. In the example transformer architecture, each token (e.g., a word) follows a separate path. Therefore, each encoder can accept a sequence of vectors and pass each vector sequentially to the self-attention layer, then to the feedforward network, and then up the stack to the next encoder. Any known self-attention technique can be used. For example, to compute a self-attention score for each token (word), a query vector, a key vector, and a value vector can be created for each token; for a token pair, the self-attention score can be computed by taking the dot product of the query vector and the corresponding key vector, normalizing the resulting score, multiplying it by the corresponding value vector, and then summing the weighted value vectors. The encoders can apply a multi-head attention mechanism, where the attention mechanism is applied multiple times in parallel with different learned weight matrices. Any number of encoders can be cascaded to generate context vectors that encode the input. Attention projection layer 1140 can transform the context vectors into attention vectors (keys and values) for decoder 1145.

[0127] In one example implementation, decoder 1145 constitutes a decoder stack, where each decoder contains a self-attention layer, an encoder-decoder self-attention layer (which uses attention vectors (keys and values) from the encoder to focus on relevant parts of the input sequence), and a feedforward network. Similar to encoder 1135, in one example transformer architecture, each token (e.g., a word) flows through a separate path in decoder 1145. In the first pass, decoder 1145, classifier 1150, and generation mechanism 1155 can generate a first token, and generation mechanism 1155 can take the generated token as input in the second pass. This process can be repeated cyclically, generating tokens (e.g., words) and adding them to the output of the previous pass, and applying the token embedding of a composite sequence with positional encoding as input to decoder 1145 in subsequent passes, generating one token at a time (called autoregression) until a symbol or token representing the end of the response is predicted. In each decoder, the self-attention layer is typically restricted to focusing only on previous positions in the output sequence by applying a masking technique (e.g., setting future positions to negative infinity) before the softmax operation. In one example implementation, the encoder-decoder attention layer operates similarly to the (e.g., multi-head) self-attention mechanism in encoder 1135, except that it creates its queries from its lower layer and obtains keys and values ​​(e.g., matrices) from the output of encoder 1135.

[0128] Therefore, decoder 1145 can output a decoded representation (e.g., a vector) of the input applied during a specific pass. Classifier 1150 may include a multi-class classifier containing one or more neural network layers that project the decoded representation (e.g., vector) onto corresponding dimensions (e.g., one dimension for each supported word or token in the output vocabulary) and a softmax operation that converts logits into probabilities. Thus, generation mechanism 1155 can select or sample words or tokens based on their corresponding predicted probabilities (e.g., selecting the word with the highest predicted probability) and append them to the output of the previous pass, thereby generating each word or token sequentially. Generation mechanism 1155 can repeat this process, triggering successive decoder inputs and corresponding predictions until a symbol or token representing the end of the response is selected or sampled. At this point, generation mechanism 1155 can output the generated response.

[0129] Figure 11C This is a block diagram of an example implementation where the generative LM 1130 includes a decoder-only converter architecture. For example, Figure 11C The operation of decoder 1160 in the middle and Figure 11B The decoder in the middle is similar to the 1145, the difference is that Figure 11C Each decoder 1160 in the implementation omits the encoder-decoder self-attention layer (because there is no encoder in this implementation). Therefore, decoders 1160 can form a decoder stack, where each decoder contains a self-attention layer and a feedforward network. Furthermore, instead of encoding the input sequence, symbols or tags indicating the end of the input sequence (or the beginning of the output sequence) can be appended to the input sequence, and the resulting sequence (e.g., a corresponding embedding with positional encoding) can be applied to decoder 1160. Figure 11B Similar to decoder 1145, each tag (e.g., a word) can flow through a separate path in decoder 1160, and decoder 1160, classifier 1165, and generation mechanism 1170 can use an autoregressive algorithm to generate one tag at a time sequentially until a symbol or tag indicating the end of the response is predicted. Classifier 1165 and generation mechanism 1170 operate in a manner similar to... Figure 11B Similar to classifier 1150 and generation mechanism 1155, generation mechanism 1170 selects or samples each consecutive output label based on the corresponding predicted probability and appends it to the output of the previous pass, generating each label sequentially until a symbol or label representing the end of the response is selected or sampled. The architectures described herein, as well as others, are merely examples, and other suitable architectures may be implemented within the scope of this disclosure.

[0130] Other variations are within the spirit of this disclosure. Therefore, although the disclosed technology is readily adaptable to various modifications and alternative constructions, certain embodiments thereof are illustrated in the accompanying drawings and have been described in detail above. However, it should be understood that the disclosure is not intended to be limited to one or more specific forms disclosed, but rather, it is intended to cover all modifications, alternative constructions, and equivalents falling within the spirit and scope of this disclosure as defined in the appended claims.

[0131] Unless otherwise stated or obviously contradicted by the context, the terms “a,” “an,” and “the,” and similar references, used in the context of describing the disclosed embodiments (particularly in the context of the appended claims), should be interpreted as encompassing both singular and plural forms, rather than as definitions of the terms. Unless otherwise stated, the terms “comprising,” “having,” “including,” and “containing” should be interpreted as open-ended terms (meaning “including, but not limited to”). The term “connection” (referring to a physical connection when unmodified) should be interpreted as partially or wholly contained, attached to, or joined together, even with some intervention. Unless otherwise indicated herein, references to numerical ranges herein are intended only as a way of abbreviating each individual value falling within that range, and each individual value is incorporated into the specification as if it were separately described herein. In at least one embodiment, unless otherwise indicated or contradicted by the context, the use of the terms “set” (e.g., “item set”) or “subset” should be interpreted as a non-empty set comprising one or more members. Furthermore, unless otherwise indicated or contradicted by the context, the term “subset” of the corresponding set does not necessarily mean an appropriate subset of the corresponding set, but rather that the subset and the corresponding set can be equal.

[0132] Unless otherwise explicitly stated or clearly contradicted by the context, connective phrases such as “at least one of A, B, and C” or “at least one of A, B, and C” are understood in the context to generally refer to items, terms, etc., which can be A or B or C, or any non-empty subset of the set A, B, and C. For example, in an illustrative example of a set with three members, the connective phrases “at least one of A, B, and C” and “at least one of A, B, and C” refer to any of the following sets: {A}, {B}, {C}, {A, B}, {A, C}, {B, C}, {A, B, C}. Therefore, such connective language is generally not intended to imply that some embodiments require the presence of at least one of A, at least one of B, and at least one of C. Additionally, unless otherwise stated or contradicted by the context, the term “multiple” indicates a plural state (e.g., “multiple items” means multiple items). In at least one embodiment, the number of items in the multiple items is at least two, but may be more if explicitly indicated or indicated by the context. Furthermore, unless otherwise stated or clearly understood from the context, the phrase “based on” means “at least partially based on” rather than “based on only”.

[0133] Unless otherwise indicated herein or clearly contradicted by the context, the operations of the processes described herein may be performed in any suitable order. In at least one embodiment, processes such as those described herein (or variations thereof and / or combinations thereof) are executed under the control of one or more computer systems configured with executable instructions and are implemented as code (e.g., executable instructions, one or more computer programs, or one or more application programs) that is executed jointly on one or more processors via hardware or a combination thereof. In at least one embodiment, the code is stored on a computer-readable storage medium, for example, in the form of a computer program comprising a plurality of instructions executable by one or more processors. In at least one embodiment, the computer-readable storage medium is a non-transitory computer-readable storage medium that excludes transient signals (e.g., propagating transient electrical or electromagnetic transmissions) but includes non-transitory data storage circuitry (e.g., buffers, caches, and queues) within transient signal transceivers. In at least one embodiment, code (e.g., executable code or source code) is stored on one or more non-transitory computer-readable storage media (or other memory for storing executable instructions) on which executable instructions are stored, which, when executed by one or more processors of a computer system (i.e., as a result of execution), cause the computer system to perform the operations described herein. In at least one embodiment, the set of non-transitory computer-readable storage media comprises multiple non-transitory computer-readable storage media, and one or more of the individual non-transitory storage media lack all the code, but the multiple non-transitory computer-readable storage media collectively store all the code. In at least one embodiment, the executable instructions are executed such that different instructions are executed by different processors; for example, the non-transitory computer-readable storage media store the instructions, and the main central processing unit (“CPU”) executes some instructions while the graphics processing unit (“GPU”) executes other instructions. In at least one embodiment, different components of the computer system have separate processors, and the different processors execute different subsets of the instructions.

[0134] Therefore, in at least one embodiment, the computer system is configured to implement one or more services that perform the operations of the processes described herein, either individually or collectively, and such a computer system is configured with suitable hardware and / or software to enable the implementation of the operations. Furthermore, the computer system implementing at least one embodiment of this disclosure is a single device, and in another embodiment it is a distributed computer system comprising multiple devices operating in different ways, such that the distributed computer system performs the operations described herein, and that a single device does not perform all the operations.

[0135] The use of any and all examples or exemplary language (e.g., “such as”) provided herein is intended only to better illustrate embodiments of this disclosure and does not constitute a limitation on the scope of the disclosure unless otherwise required. No language in the specification should be construed as indicating that any unclaimed element is essential to the practice of the disclosure.

[0136] All references cited in this article, including publications, patent applications and patents, are incorporated herein by reference as if each reference were individually and specifically indicated to be incorporated herein by reference and the entire contents of which are described herein.

[0137] The terms “coupled” and “connected”, and their derivatives, may be used in the specification and claims. It should be understood that these terms may not be intended to be synonyms with each other. Rather, in certain examples, “connected” or “coupled” may be used to indicate that two or more elements are in direct or indirect physical or electrical contact with each other. “Coupled” may also mean that two or more elements are not in direct contact with each other, but still cooperate or interact with each other.

[0138] Unless otherwise expressly stated, it will be understood that throughout this specification, terms such as “processing,” “computing,” “determining,” etc., refer to the actions and / or processes of a computer or computing system or similar electronic computing device that process and / or convert data represented as physical quantities (e.g., electrons) in the registers and / or memory of the computing system into other data represented as physical quantities in the memory, registers, or other such information storage, transmission, or display devices of the computing system.

[0139] Similarly, the term "processor" can refer to any device or part of a device that processes electronic data from registers and / or memory and converts that electronic data into other electronic data that can be stored in registers and / or memory. As a non-limiting example, a "processor" can be a CPU or a GPU. A "computing platform" can include one or more processors. As used herein, a "software" process can include, for example, software and / or hardware entities that perform work over time, such as tasks, threads, and intelligent agents. Likewise, each process can refer to multiple processes that execute instructions sequentially or intermittently, sequentially, or in parallel. In at least one embodiment, the terms "system" and "method" are used interchangeably herein, provided that a system can embody one or more methods, and a method can be considered a system.

[0140] In this document, reference may be made to obtaining, acquiring, receiving, or inputting analog or digital data into a subsystem, computer system, or computer-implemented machine. In at least one embodiment, the process of obtaining, acquiring, receiving, or inputting analog and digital data can be accomplished in various ways, such as by receiving data as a parameter to a function call or a call to an application programming interface. In at least one embodiment, the process of obtaining, acquiring, receiving, or inputting analog or digital data can be accomplished by transmitting data via a serial or parallel interface. In at least one embodiment, the process of obtaining, acquiring, receiving, or inputting analog or digital data can be accomplished by transmitting data from a providing entity to an acquiring entity via a computer network. In at least one embodiment, reference may also be made to providing, outputting, transmitting, sending, or presenting analog or digital data. In various examples, the process of providing, outputting, transmitting, sending, or presenting analog or digital data can be implemented by transmitting data as an input or output parameter to a function call, an application programming interface, or an inter-process communication mechanism.

[0141] While the description herein illustrates exemplary embodiments of the described technologies, other architectures may be used to implement the described functionality and are intended to fall within the scope of this disclosure. Furthermore, although specific assignments of responsibilities have been defined above for descriptive purposes, various functions and responsibilities may be assigned and divided in different ways depending on the circumstances.

[0142] Furthermore, although the subject matter has been described in language specific to structural features and / or methodological actions, it should be understood that the subject matter claimed in the appended claims is not necessarily limited to the specific features or actions described. Rather, specific features and actions are disclosed as exemplary forms for implementing the claims.

Claims

1. A system comprising: Memory; as well as One or more processors coupled to the memory are used for: Provide a first subset of multiple content items related to the target system architecture as input to the graph resolver to obtain the graph resolver output; The graph resolver output and a second subset of the plurality of content items related to the target system architecture are provided as input to a first artificial intelligence (AI) embedding model to obtain a first AI embedding model output, the first AI embedding model output including the graph resolver output and the encoded representation of the second subset of the plurality of content items related to the target system architecture; as well as The graph parser output and at least a first portion of the encoded representation of the second subset of the plurality of content items associated with the target system architecture are provided as input to a first generative artificial intelligence (AI) model to obtain a plurality of potential threats associated with the target system architecture.

2. The system as claimed in claim 1, wherein, The plurality of content items related to the target system architecture include at least one of the following: A visual representation of the target system architecture; A textual description of the target system architecture; Design documents related to the target system; or Data flow diagram.

3. The system as described in claim 1, wherein, The one or more processors are also used for: Provide one or more mitigation measures as input to a second AI embedding model to obtain a second AI embedding model output including the encoded representation of the one or more mitigation measures; and At least a portion of the encoded representation of the one or more mitigation items and at least a first potential threat from among the plurality of potential threats related to the target system architecture are provided as input to a second generative artificial intelligence (AI) model to obtain one or more mitigation measures related to the first potential threat from among the plurality of potential threats.

4. The system as described in claim 3, wherein, The one or more mitigation measures include at least one of the following: Documentation of known response measures; Organize specific strategy documents; or Standardized control documents.

5. The system as described in claim 3, wherein, The one or more processors are also used for: At least a first mitigation measure among the one or more mitigation measures associated with the first potential threat among the plurality of potential threats, and at least a second portion of the encoded representation of the graph resolver output and the second subset of the plurality of content items associated with the target system architecture, are provided as input to a third generative artificial intelligence (AI) model to obtain one or more mitigation recommendations associated with the first potential threat among the plurality of potential threats.

6. The system of claim 5, wherein, The one or more processors are further configured to generate a first risk score based at least on a first mitigation recommendation among the one or more mitigation recommendations associated with the first potential threat among the plurality of potential threats.

7. The system of claim 6, wherein, In order to generate the first risk score, the one or more processors are further configured to: Provide one or more risk terms as input to a third artificial intelligence (AI) embedding model to obtain an output of the third AI embedding model that includes the encoded representation of the one or more risk terms; and At least a portion of the encoded representation of the one or more risk items and at least a first mitigation suggestion from the one or more mitigation suggestions associated with the first potential threat among the plurality of potential threats are provided as input to a fourth generative artificial intelligence (AI) model to obtain a first risk score, wherein the first risk score is associated with the first potential threat associated with the first mitigation suggestion.

8. The system of claim 7, wherein, The one or more risk items include at least one of the following: Historical threat model; Standard guidelines; The attacker tried to estimate; or Threat impact assessment.

9. The system of claim 6, wherein, The one or more processors are also used for: Multiple risk scores are provided to users associated with the target system architecture, wherein the multiple risk scores include a first risk score associated with the potential threat associated with the first mitigation recommendation, and one or more additional risk scores associated with other potential threats associated with the target system architecture.

10. The system of claim 1, wherein, The memory includes embedded data storage, and wherein the one or more processors are further configured to store the output of the first artificial intelligence (AI) embedded model in the embedded data storage of the memory.

11. The system of claim 1, wherein, The graph parser is an artificial intelligence (AI) vision model.

12. A method, the method comprising: Provide a first subset of multiple content items related to the target system architecture as input to the graph resolver to obtain the graph resolver output; The graph resolver output and a second subset of the plurality of content items related to the target system architecture are provided as input to a first artificial intelligence (AI) embedding model to obtain a first AI embedding model output, the first AI embedding model output including the graph resolver output and the encoded representation of the second subset of the plurality of content items related to the target system architecture; as well as The graph parser output and at least a first portion of the encoded representation of the second subset of the plurality of content items associated with the target system architecture are provided as input to a first generative artificial intelligence (AI) model to obtain a plurality of potential threats associated with the target system architecture.

13. The method of claim 12, wherein, The plurality of content items related to the target system architecture include at least one of the following: A visual representation of the target system architecture; A textual description of the target system architecture; Design documents related to the target system; or Data flow diagram.

14. The method of claim 12, further comprising: Provide one or more mitigation measures as input to a second AI embedding model to obtain a second AI embedding model output including the encoded representation of the one or more mitigation measures; and At least a portion of the encoded representation of the one or more mitigation items and at least a first potential threat from among the plurality of potential threats related to the target system architecture are provided as input to a second generative artificial intelligence (AI) model to obtain one or more mitigation measures related to the first potential threat from among the plurality of potential threats.

15. The method of claim 14, wherein, The one or more mitigation measures include at least one of the following: Documentation of known response measures; Organize specific strategy documents; or Standardized control documents.

16. The method of claim 14, further comprising: At least a first mitigation measure among the one or more mitigation measures associated with the first potential threat among the plurality of potential threats, and at least a second portion of the encoded representation of the graph resolver output and the second subset of the plurality of content items associated with the target system architecture, are provided as input to a third generative artificial intelligence (AI) model to obtain one or more mitigation recommendations associated with the first potential threat among the plurality of potential threats.

17. The method of claim 16, further comprising: A first risk score is generated based at least on a first mitigation recommendation among one or more mitigation recommendations related to the first potential threat among the plurality of potential threats.

18. The method of claim 17, wherein, Generating the first risk score based at least on the first mitigation recommendation includes: Provide one or more risk terms as input to a third artificial intelligence (AI) embedding model to obtain an output of the third AI embedding model that includes the encoded representation of the one or more risk terms; and At least a portion of the encoded representation of the one or more risk items and at least a first mitigation suggestion from the one or more mitigation suggestions associated with the first potential threat among the plurality of potential threats are provided as input to a fourth generative artificial intelligence (AI) model to obtain a first risk score, wherein the first risk score is associated with the first potential threat associated with the first mitigation suggestion.

19. The method of claim 17, further comprising: Multiple risk scores are provided to users associated with the target system architecture, wherein the multiple risk scores include a first risk score associated with the potential threat associated with the first mitigation recommendation, and one or more additional risk scores associated with other potential threats associated with the target system architecture.

20. A non-transitory computer-readable storage medium comprising instructions that, when executed by one or more processors, cause the one or more processors to perform an operation, the operation comprising: Provide a first subset of multiple content items related to the target system architecture as input to the graph resolver to obtain the graph resolver output; The graph resolver output and a second subset of the plurality of content items related to the target system architecture are provided as input to a first artificial intelligence (AI) embedding model to obtain a first AI embedding model output, the first AI embedding model output including the graph resolver output and the encoded representation of the second subset of the plurality of content items related to the target system architecture; as well as The graph parser output and at least a first portion of the encoded representation of the second subset of the plurality of content items associated with the target system architecture are provided as input to a first generative artificial intelligence (AI) model to obtain a plurality of potential threats associated with the target system architecture.

Images