Methods, systems, and computer program products for artificial intelligence assisted network security threat modeling tools

Abstract

Methods, systems, and computer program products for artificial intelligence-assisted cybersecurity threat modeling tools are provided. These methods, systems, and computer program products may include receiving data associated with a security architecture document for a specific software environment; converting the data associated with the security architecture document from a natural language format to a threat modeling data format; generating multiple vector embeddings based on the threat modeling data; identifying one or more potential cybersecurity threats based on the multiple vector embeddings; and mapping the one or more potential cybersecurity threats to one or more corresponding controls, the one or more corresponding controls providing potential mitigation actions to the one or more potential cybersecurity threats.

Description

Cross-references to related applications

[0001] This application claims the benefit of U.S. Provisional Patent Application No. 63 / 550,076, filed February 6, 2024, the disclosure of which is incorporated herein by reference in its entirety. Technical Field

[0002] This disclosure generally relates to cybersecurity threat modeling, and in non-limiting embodiments or aspects, to methods, systems, and computer program products for artificial intelligence-assisted cybersecurity threat modeling. Background Technology

[0003] Threat modeling can refer to the process of identifying and enumerating potential cybersecurity threats (such as structural vulnerabilities or lack of appropriate protection) and prioritizing countermeasures. In some cases, the purpose of threat modeling is to provide a system analysis of which security controls and / or defenses need to be included, based on the nature of the computer system, potential attacker profiles, most likely attack vectors, and / or the assets the attacker most desires to acquire. Threat modeling is one of the activities performed during security reviews, and the Payment Card Industry (PCI) standard recommends it as a way to identify threats early in the design of computer systems.

[0004] However, many aspects of current threat modeling tools are manual processes, and many existing threat modeling tools are highly generic and do not provide information on the latest cybersecurity threats. Different threat modeling tools may work on similar principles, namely, enumerating and iterating over a list of threats by default without considering the application context. Furthermore, some threat modeling tools require users to spend significant time generating the graphs needed to produce and use threat models (e.g., during the reduction analysis phase). Summary of the Invention

[0005] Therefore, improved methods, systems, and computer program products for AI-assisted cybersecurity threat modeling are provided.

[0006] According to non-limiting embodiments or aspects, a computer-implemented method for artificial intelligence-assisted cybersecurity threat modeling is provided. In some non-limiting embodiments or aspects, the computer-implemented method may include receiving data associated with a security architecture document for a specific software environment. In some non-limiting embodiments or aspects, the computer-implemented method may include using a Large Language Model (LLM) to convert the data associated with the security architecture document from a natural language format into a threat modeling data format to provide threat modeling data. In some non-limiting embodiments or aspects, the threat modeling data format is constructed based on subject-object relationships. In some non-limiting embodiments or aspects, the subjects and objects are data elements included in the data associated with the security architecture document. In some non-limiting embodiments or aspects, the computer-implemented method may include using the LLM to generate multiple vector embeddings based on the threat modeling data. In some non-limiting embodiments or aspects, the computer-implemented method may include identifying one or more potential cybersecurity threats based on the multiple vector embeddings. In some non-limiting embodiments or aspects, the computer-implemented method may include mapping the one or more potential cybersecurity threats to one or more corresponding controls, the one or more corresponding controls providing potential mitigation actions to the one or more potential cybersecurity threats.

[0007] In some non-limiting embodiments or aspects, the computer-implemented method may further include generating a visual representation of the software architecture model based on the threat modeling data by converting the data associated with the security architecture document from a natural language format to a threat modeling data format. In some non-limiting embodiments or aspects, the computer-implemented method may further include providing the visual representation of the software architecture model to a user device. In some non-limiting embodiments or aspects, the computer-implemented method may further include receiving an approval instruction from the user device. In some non-limiting embodiments or aspects, generating the plurality of vector embeddings may include generating the plurality of vector embeddings based on receiving the approval instruction from the user device.

[0008] In some non-limiting embodiments or aspects, the threat modeling data format may be JSON format, and the threat modeling data format may be constructed based on: the relationships between subjects and objects among multiple subjects and objects included in the security architecture document; trust boundaries, which include boundaries that distinguish different trust levels defined in the security architecture document; and the software application of the specific software environment.

[0009] In some non-limiting embodiments or aspects, the computer-implemented method may further include generating a list including the one or more potential cybersecurity threats and the one or more corresponding controls, the one or more corresponding controls providing potential mitigation actions to the one or more potential cybersecurity threats. In some non-limiting embodiments or aspects, the computer-implemented method may further include using the LLM to convert the list from a first data format to a second data format to provide natural language threat modeling data. In some non-limiting embodiments or aspects, the second data format may include a natural language format. In some non-limiting embodiments or aspects, the computer-implemented method may further include generating a comprehensive threat modeling report based on the natural language threat modeling data.

[0010] In some non-limiting embodiments or aspects, converting the data associated with the security architecture document from a natural language format to a threat modeling data format to provide threat modeling data may include performing reduction analysis via function processing calls provided to the LLM.

[0011] In some non-limiting embodiments or aspects, the threat modeling data may include data associated with each relationship category between subjects and objects in a plurality of relationship categories. In some non-limiting embodiments or aspects, converting the data associated with the security architecture document from a natural language format to a threat modeling data format to provide threat modeling data may include chunking the data associated with the security architecture document based on each relationship category between subjects and objects in the plurality of relationship categories to provide multiple chunks of threat modeling data. In some non-limiting embodiments or aspects, each of the multiple chunks of threat modeling data may be based on a specified relationship category between subjects and objects. In some non-limiting embodiments or aspects, generating the multiple vector embeddings may include using the LLM to convert each of the multiple chunks of threat modeling data into a vector string.

[0012] In some non-limiting embodiments or aspects, identifying the one or more potential cybersecurity threats may include comparing each of the plurality of vector embeddings with a known vector embedding associated with the one or more potential cybersecurity threats, and identifying the one or more potential cybersecurity threats within a threshold distance of the vector embeddings in the plurality of vector embeddings based on a measure of cosine similarity.

[0013] According to non-limiting embodiments or aspects, a system for artificial intelligence-assisted cybersecurity threat modeling is provided. In some non-limiting embodiments or aspects, the system may include at least one processor configured to receive data associated with a security architecture document for a specific software environment. In some non-limiting embodiments or aspects, the at least one processor may be configured to use a Large Language Model (LLM) to convert the data associated with the security architecture document from a natural language format into a threat modeling data format to provide threat modeling data. In some non-limiting embodiments or aspects, the threat modeling data format may be constructed based on relationships between subjects and objects. In some non-limiting embodiments or aspects, the subjects and objects may be data elements included in the data associated with the security architecture document. In some non-limiting embodiments or aspects, the at least one processor may be configured to use the LLM to generate multiple vector embeddings based on the threat modeling data. In some non-limiting embodiments or aspects, the at least one processor may be configured to identify one or more potential cybersecurity threats based on the multiple vector embeddings. In some non-limiting embodiments or aspects, the at least one processor may be configured to map the one or more potential cybersecurity threats to one or more corresponding controls, the one or more corresponding controls providing potential mitigation actions to the one or more potential cybersecurity threats.

[0014] In some non-limiting embodiments or aspects, the at least one processor may be further configured to use a machine-generated visual representation of the software architecture model based on converting the data associated with the security architecture document from natural language format to threat modeling data format, and using a machine learning model to generate a visual representation of the software architecture model based on the threat modeling data. In some non-limiting embodiments or aspects, the at least one processor may be further configured to provide the visual representation of the software architecture model to a user device. In some non-limiting embodiments or aspects, the at least one processor may be further configured to receive an approval instruction from the user device. In some non-limiting embodiments or aspects, when generating the plurality of vector embeddings, the at least one processor may be configured to generate the plurality of vector embeddings based on receiving the approval instruction from the user device.

[0015] In some non-limiting embodiments or aspects, the threat modeling data format may be JSON format, and the threat modeling data format may be constructed based on: the relationships between subjects and objects among multiple subjects and objects included in the security architecture document; trust boundaries, which include boundaries that distinguish different trust levels defined in the security architecture document; and the software application of the specific software environment.

[0016] In some non-limiting embodiments or aspects, the at least one processor may be further configured to generate a list including the one or more potential cybersecurity threats and the one or more corresponding controls, the one or more corresponding controls providing potential mitigation actions to the one or more potential cybersecurity threats. In some non-limiting embodiments or aspects, the at least one processor may be further configured to use the LLM to convert the list from a first data format to a second data format to provide natural language threat modeling data. In some non-limiting embodiments or aspects, the second data format may include a natural language format. In some non-limiting embodiments or aspects, the at least one processor may be further configured to generate a comprehensive threat modeling report based on the natural language threat modeling data.

[0017] In some non-limiting embodiments or aspects, when converting the data associated with the security architecture document from a natural language format to a threat modeling data format to provide threat modeling data, the at least one processor may be configured to perform reduction analysis via function processing calls provided to the LLM.

[0018] In some non-limiting embodiments or aspects, the threat modeling data may include data associated with each relationship category between subjects and objects in a plurality of relationship categories. In some non-limiting embodiments or aspects, when converting the data associated with the security architecture document from a natural language format to a threat modeling data format to provide the threat modeling data, the at least one processor may be configured to chunk the data associated with the security architecture document based on each relationship category between subjects and objects in the plurality of relationship categories to provide multiple chunks of threat modeling data. In some non-limiting embodiments or aspects, each of the multiple chunks of threat modeling data may be based on a specified relationship category between subjects and objects. In some non-limiting embodiments or aspects, when generating the plurality of vector embeddings, the at least one processor may be configured to use the LLM to convert each of the multiple chunks of threat modeling data into a vector string.

[0019] In some non-limiting embodiments or aspects, when identifying the one or more potential cybersecurity threats, the at least one processor may be configured to compare each of the plurality of vector embeddings with a known vector embedding associated with the one or more potential cybersecurity threats, and identify the one or more potential cybersecurity threats within a threshold distance of the vector embeddings in the plurality of vector embeddings based on a measure of cosine similarity.

[0020] According to non-limiting embodiments or aspects, a computer program product for artificial intelligence-assisted cybersecurity threat modeling is provided. In some non-limiting embodiments or aspects, the computer program product may include at least one non-transitory computer-readable medium comprising program instructions that, when executed by at least one processor, cause the at least one processor to receive data associated with a security architecture document for a specific software environment. In some non-limiting embodiments or aspects, the program instructions may further cause the at least one processor to use a Large Language Model (LLM) to convert the data associated with the security architecture document from a natural language format into a threat modeling data format to provide threat modeling data. In some non-limiting embodiments or aspects, the threat modeling data format may be constructed based on relationships between subjects and objects. In some non-limiting embodiments or aspects, the subjects and objects may be data elements included in the data associated with the security architecture document. In some non-limiting embodiments or aspects, the program instructions may further cause the at least one processor to use the LLM to generate multiple vector embeddings based on the threat modeling data. In some non-limiting embodiments or aspects, the program instructions may further cause the at least one processor to identify one or more potential cybersecurity threats based on the plurality of vector embeddings. In some non-limiting embodiments or aspects, the program instructions may further cause the at least one processor to map the one or more potential cybersecurity threats to one or more corresponding controls, the one or more corresponding controls providing potential mitigation actions to the one or more potential cybersecurity threats.

[0021] In some non-limiting embodiments or aspects, the program instructions may further cause the at least one processor to generate a visual representation of the software architecture model based on the threat modeling data, using a machine learning model, by converting the data associated with the security architecture document from a natural language format to a threat modeling data format. In some non-limiting embodiments or aspects, the program instructions may further cause the at least one processor to provide the visual representation of the software architecture model to a user device and receive an approval instruction from the user device. In some non-limiting embodiments or aspects, the instructions causing the at least one processor to generate the plurality of vector embeddings may cause the at least one processor to generate the plurality of vector embeddings based on the approval instruction received from the user device.

[0022] In some non-limiting embodiments or aspects, the threat modeling data format may be JSON format, and the threat modeling data format may be constructed based on: the relationships between subjects and objects among multiple subjects and objects included in the security architecture document; trust boundaries, which include boundaries that distinguish different trust levels defined in the security architecture document; and the software application of the specific software environment.

[0023] In some non-limiting embodiments or aspects, the program instructions may further cause the at least one processor to generate a list including the one or more potential cybersecurity threats and the one or more corresponding controls, the one or more corresponding controls providing potential mitigation actions to the one or more potential cybersecurity threats. In some non-limiting embodiments or aspects, the program instructions may further cause the at least one processor to use the LLM to convert the list from a first data format to a second data format to provide natural language threat modeling data. In some non-limiting embodiments or aspects, the second data format includes a natural language format. In some non-limiting embodiments or aspects, the program instructions may further cause the at least one processor to generate a comprehensive threat modeling report based on the natural language threat modeling data.

[0024] In some non-limiting embodiments or aspects, the instruction that causes the at least one processor to convert the data associated with the security architecture document from a natural language format to a threat modeling data format to provide threat modeling data may cause the at least one processor to perform reduction analysis via function processing calls provided to the LLM.

[0025] In some non-limiting embodiments or aspects, the threat modeling data may include data associated with each relationship category between subjects and objects in a plurality of relationship categories. In some non-limiting embodiments or aspects, the instruction causing the at least one processor to convert the data associated with the security architecture document from a natural language format to a threat modeling data format to provide the threat modeling data may cause the at least one processor to chunk the data associated with the security architecture document based on each relationship category between subjects and objects in the plurality of relationship categories to provide a plurality of chunks of threat modeling data. In some non-limiting embodiments or aspects, each of the plurality of chunks of threat modeling data is based on a specified relationship category between subjects and objects. In some non-limiting embodiments or aspects, the instruction causing the at least one processor to generate the plurality of vector embeddings may cause the at least one processor to use the LLM to convert each of the plurality of chunks of threat modeling data into a vector string.

[0026] In some non-limiting embodiments or aspects, the instructions that enable the at least one processor to identify the one or more potential cybersecurity threats may cause the at least one processor to compare each of the plurality of vector embeddings with a known vector embedding associated with the one or more potential cybersecurity threats, and to identify the one or more potential cybersecurity threats within a threshold distance of the vector embeddings in the plurality of vector embeddings based on a measure of cosine similarity.

[0027] Other non-limiting embodiments or aspects will be set forth in the following numbered clauses: Clause 1: A computer-implemented method for AI-assisted cybersecurity threat modeling, the computer-implemented method comprising: receiving data associated with a security architecture document for a specific software environment using at least one processor; using at least one processor to convert the data associated with the security architecture document from a natural language format to a threat modeling data format to provide threat modeling data using a Large Language Model (LLM), wherein the threat modeling data format is constructed based on subject-object relationships, and wherein the subject and the object are data elements included in the data associated with the security architecture document; generating a plurality of vector embeddings based on the threat modeling data using the LLM using at least one processor; identifying one or more potential cybersecurity threats based on the plurality of vector embeddings using at least one processor; and mapping the one or more potential cybersecurity threats to one or more corresponding controls using at least one processor, the one or more corresponding controls providing potential mitigation actions to the one or more potential cybersecurity threats.

[0028] Clause 2: The computer-implemented method according to Clause 1 further comprises: generating a visual representation of a software architecture model based on the threat modeling data by converting the data associated with the security architecture document from a natural language format to a threat modeling data format using a machine learning model; providing the visual representation of the software architecture model to a user device; and receiving an approval instruction from the user device; wherein generating the plurality of vector embeddings comprises: generating the plurality of vector embeddings based on receiving the approval instruction from the user device.

[0029] Clause 3: The computer-implemented method according to Clause 1 or 2, wherein the threat modeling data format is JSON format and the threat modeling data format is constructed based on: the subject-object relationships among multiple subjects and objects included in the security architecture document; trust boundaries, which include boundaries that distinguish different trust levels defined in the security architecture document; and the software application of the particular software environment.

[0030] Clause 4: A computer-implemented method according to any one of Clauses 1 to 3, further comprising: generating a list including the one or more potential cybersecurity threats and the one or more corresponding controls, the one or more corresponding controls providing potential mitigation actions to the one or more potential cybersecurity threats; converting the list from a first data format to a second data format using the LLM to provide natural language threat modeling data, wherein the second data format includes a natural language format; and generating a comprehensive threat modeling report based on the natural language threat modeling data.

[0031] Clause 5: A computer-implemented method according to any one of Clauses 1 to 4, wherein converting the data associated with the security architecture document from a natural language format to a threat modeling data format to provide threat modeling data comprises: performing a reduction analysis via a function processing call provided to the LLM.

[0032] Clause 6: A computer-implemented method according to any one of Clauses 1 to 5, wherein the threat modeling data comprises data associated with each relationship category between subjects and objects in a plurality of relationship categories, and wherein converting the data associated with the security architecture document from a natural language format to a threat modeling data format to provide threat modeling data comprises: chunking the data associated with the security architecture document based on each relationship category between subjects and objects in the plurality of relationship categories to provide a plurality of chunks of threat modeling data, wherein each of the plurality of chunks of threat modeling data is based on a specified relationship category between subjects and objects; wherein generating the plurality of vector embeddings comprises: converting each of the plurality of chunks of threat modeling data into a vector string using the LLM.

[0033] Clause 7: A computer-implemented method according to any one of Clauses 1 to 6, wherein identifying the one or more potential cybersecurity threats comprises: comparing each of the plurality of vector embeddings with a known vector embedding associated with the one or more potential cybersecurity threats, and identifying the one or more potential cybersecurity threats within a threshold distance of the vector embeddings in the plurality of vector embeddings based on a measure of cosine similarity.

[0034] Clause 8: A system for AI-assisted cybersecurity threat modeling, the system comprising: at least one processor configured to receive data associated with a security architecture document for a specific software environment; converting the data associated with the security architecture document from a natural language format to a threat modeling data format using a Large Language Model (LLM) to provide threat modeling data, wherein the threat modeling data format is constructed based on subject-object relationships, and wherein the subject and the object are data elements included in the data associated with the security architecture document; generating multiple vector embeddings based on the threat modeling data using the LLM; identifying one or more potential cybersecurity threats based on the multiple vector embeddings; and mapping the one or more potential cybersecurity threats to one or more corresponding controls, the one or more corresponding controls providing potential mitigation actions to the one or more potential cybersecurity threats.

[0035] Clause 9: The system according to Clause 8, wherein the at least one processor is further configured to: generate a visual representation of the software architecture model using a machine learning model based on the threat modeling data by converting the data associated with the security architecture document from a natural language format to a threat modeling data format; provide the visual representation of the software architecture model to a user device; and receive an approval instruction from the user device; wherein, when generating the plurality of vector embeddings, the at least one processor is configured to: generate the plurality of vector embeddings based on the approval instruction received from the user device.

[0036] Clause 10: The system according to Clause 8 or 9, wherein the threat modeling data format is JSON format and the threat modeling data format is constructed based on: the relationships between subjects and objects among the multiple subjects and objects included in the security architecture document; trust boundaries, which include boundaries that distinguish different trust levels defined in the security architecture document; and the software application of the particular software environment.

[0037] Clause 11: The system according to any one of Clauses 8 to 10, wherein the at least one processor is further configured to: generate a list including the one or more potential cybersecurity threats and the one or more corresponding controls, the one or more corresponding controls providing potential mitigation actions to the one or more potential cybersecurity threats; convert the list from a first data format to a second data format using the LLM to provide natural language threat modeling data, wherein the second data format includes a natural language format; and generate a comprehensive threat modeling report based on the natural language threat modeling data.

[0038] Clause 12: A system according to any one of Clauses 8 to 11, wherein when converting the data associated with the security architecture document from a natural language format to a threat modeling data format to provide threat modeling data, the at least one processor is configured to perform reduction analysis via function processing calls provided to the LLM.

[0039] Clause 13: A system according to any one of Clauses 8 to 12, wherein the threat modeling data comprises data associated with each of a plurality of relation categories between subjects and objects, and wherein when the data associated with the security architecture document is converted from a natural language format to a threat modeling data format to provide the threat modeling data, the at least one processor is configured to: chunk the data associated with the security architecture document based on each of the plurality of relation categories between subjects and objects to provide a plurality of chunks of threat modeling data, wherein each of the plurality of chunks of threat modeling data is based on a specified relation category between subjects and objects; wherein when generating the plurality of vector embeddings, the at least one processor is configured to: convert each of the plurality of chunks of threat modeling data into a vector string using the LLM.

[0040] Clause 14: A system according to any one of Clauses 8 to 13, wherein, in identifying the one or more potential cybersecurity threats, the at least one processor is configured to: compare each of the plurality of vector embeddings with a known vector embedding associated with the one or more potential cybersecurity threats, and identify the one or more potential cybersecurity threats within a threshold distance of the vector embeddings in the plurality of vector embeddings based on a measure of cosine similarity.

[0041] Clause 15: A computer program product comprising at least one non-transitory computer-readable medium, the at least one non-transitory computer-readable medium including program instructions that, when executed by at least one processor, cause the at least one processor to: receive data associated with a security architecture document for a specific software environment; convert the data associated with the security architecture document from a natural language format to a threat modeling data format using a Large Language Model (LLM) to provide threat modeling data, wherein the threat modeling data format is constructed based on subject-object relationships, and wherein the subject and the object are data elements included in the data associated with the security architecture document; generate a plurality of vector embeddings based on the threat modeling data using the LLM; identify one or more potential cybersecurity threats based on the plurality of vector embeddings; and map the one or more potential cybersecurity threats to one or more corresponding controls, the one or more corresponding controls providing potential mitigation actions to the one or more potential cybersecurity threats.

[0042] Clause 16: A computer program product according to Clause 15, wherein the instructions further cause the at least one processor to: generate a visual representation of a software architecture model based on the threat modeling data by converting the data associated with the security architecture document from a natural language format to a threat modeling data format using a machine learning model; provide the visual representation of the software architecture model to a user device; and receive an approval instruction from the user device; wherein the instructions causing the at least one processor to generate the plurality of vector embeddings cause the at least one processor to: generate the plurality of vector embeddings based on the approval instruction received from the user device.

[0043] Clause 17: A computer program product pursuant to Clause 15 or 16, wherein the threat modeling data format is JSON and the threat modeling data format is constructed based on: the relationships between subjects and objects among multiple subjects and objects included in a security architecture document; trust boundaries, which include boundaries that distinguish different levels of trust defined in the security architecture document; and the software application of the particular software environment.

[0044] Clause 18: A computer program product pursuant to any one of Clauses 15 to 17, wherein the instructions further cause the at least one processor to: generate a list including the one or more potential cybersecurity threats and the one or more corresponding controls, the one or more corresponding controls providing potential mitigation actions to the one or more potential cybersecurity threats; convert the list from a first data format to a second data format using the LLM to provide natural language threat modeling data, wherein the second data format includes a natural language format; and generate a comprehensive threat modeling report based on the natural language threat modeling data.

[0045] Clause 19: A computer program product pursuant to any one of Clauses 15 to 18, wherein the instruction causing the at least one processor to convert the data associated with the security architecture document from a natural language format to a threat modeling data format to provide threat modeling data causes the at least one processor to perform a reduction analysis via a function processing call provided to the LLM.

[0046] Clause 20: A computer program product according to any one of Clauses 15 to 19, wherein the threat modeling data comprises data associated with each of a plurality of relation categories between subjects and objects, and wherein the instruction causing the at least one processor to convert the data associated with the security architecture document from a natural language format to a threat modeling data format to provide the threat modeling data causes the at least one processor to: chunk the data associated with the security architecture document based on each of the plurality of relation categories between subjects and objects to provide a plurality of chunks of threat modeling data, wherein each of the plurality of chunks of threat modeling data is based on a specified relation category between subjects and objects; wherein the instruction causing the at least one processor to generate the plurality of vector embeddings causes the at least one processor to: convert each of the plurality of chunks of threat modeling data into a vector string using the LLM.

[0047] Clause 21: A computer program product pursuant to any one of Clauses 15 to 20, wherein the instructions for causing the at least one processor to identify the one or more potential cybersecurity threats cause the at least one processor to: compare each of the plurality of vector embeddings with a known vector embedding associated with the one or more potential cybersecurity threats, and identify the one or more potential cybersecurity threats within a threshold distance of the vector embeddings in the plurality of vector embeddings according to a measure of cosine similarity.

[0048] The operational methods and manufacturing economics of these and other features and characteristics of this disclosure, as well as combinations of related structural elements and parts, will become more apparent when considering the following description and appended claims with reference to the accompanying drawings, all of which form part of this specification, wherein similar reference numerals denote corresponding parts in the figures. However, it should be clearly understood that the drawings are for illustrative and descriptive purposes only and are not intended to be a definition of limitation on the disclosed subject matter. Attached Figure Description

[0049] Further advantages and details are explained in more detail below with reference to the non-limiting exemplary embodiments shown in the illustrative drawings, in which: Figure 1 This is a schematic diagram of a system for AI-assisted cybersecurity threat modeling, based on some non-limiting embodiments or aspects. Figure 2 This is a flowchart of a process for artificial intelligence-assisted cybersecurity threat modeling, based on some non-limiting embodiments or aspects; Figure 3A-3I This is a schematic diagram of an exemplary implementation of a method and / or system for artificial intelligence-assisted cybersecurity threat modeling, based on some non-limiting embodiments or aspects; Figure 4 This is a diagram illustrating an exemplary implementation of an environment for AI-assisted cybersecurity threat modeling, based on some non-limiting embodiments or aspects. Figure 5A and 5B These are diagrams illustrating exemplary embodiments of methods and / or systems for artificial intelligence-assisted cybersecurity threat modeling, based on some non-limiting embodiments or aspects. Figure 6 These are diagrams illustrating exemplary environments in which the methods, systems, and / or computer program products described herein can be implemented, based on some non-limiting embodiments or aspects; and Figure 7 Based on some non-limiting embodiments or aspects Figure 1 and / or Figure 6 A schematic diagram of example components of one or more devices. Detailed Implementation

[0050] For the purposes of the following description, the terms “end,” “upper,” “lower,” “right,” “left,” “vertical,” “horizontal,” “top,” “bottom,” “lateral,” “longitudinal,” and their derivatives should be associated with the orientation of the embodiments in the accompanying drawings. However, it should be understood that embodiments may take various alternative variations and sequences of steps, except where explicitly specified as the opposite. It should also be understood that the specific apparatus and processes shown in the drawings and described in the following specification are merely exemplary embodiments or aspects of the disclosed subject matter. Therefore, specific dimensions and other physical characteristics relating to the embodiments or aspects disclosed herein should not be considered limiting.

[0051] This document describes some non-limiting embodiments or aspects in conjunction with thresholds. As used herein, satisfying a threshold can refer to a value greater than a threshold, more than a threshold, higher than a threshold, greater than or equal to a threshold, less than a threshold, less than a threshold, lower than a threshold, less than or equal to a threshold, equal to a threshold, etc.

[0052] The terms "aspect," "component," "element," "structure," "action," "step," "function," and "instruction" used herein should not be construed as critical or essential unless explicitly stated otherwise. Furthermore, as used herein, the articles "a" and "an" are intended to include one or more items and may be used interchangeably with "one or more" and "at least one." Additionally, as used herein, the term "set" is intended to include one or more items (e.g., related items, unrelated items, a combination of related and unrelated items, etc.) and may be used interchangeably with "one or more" or "at least one." Where only one item is intended, the term "a" or similar language is used. Moreover, as used herein, the terms "has," "have," and "having" are intended to be open-ended terms. Additionally, unless explicitly stated otherwise, the phrase "based on" is intended to mean "at least partially based on." Furthermore, a reference to an action based on a condition may mean that the action is "in response to" the condition. For example, in some non-limiting embodiments or aspects, the phrases “based on” and “in response to” may refer to conditions that automatically trigger an action (e.g., a specific operation of an electronic device such as a computing device, processor, etc.).

[0053] As used herein, the term "acquiring institution" can refer to an entity licensed and / or approved by a transaction service provider to initiate transactions (e.g., payment transactions) using payment devices associated with the transaction service provider. Transactions that an acquiring institution can initiate can include payment transactions (e.g., purchases, original letter of credit transactions (OCT), account treasury transactions (AFT), etc.). In some non-limiting embodiments or aspects, an acquiring institution can be a financial institution, such as a bank. As used herein, the term "acquiring system" can refer to one or more computing devices operated by or on behalf of an acquiring institution, such as a server computer executing one or more software applications.

[0054] As used herein, the term "account identifier" can include one or more primary account (PAN), tokens, or other identifiers associated with a customer account. The term "token" can refer to an identifier used as a substitute or replacement identifier for the original account identifier, such as a PAN. An account identifier can be any combination of alphanumeric or character and / or symbol. A token can be associated with a PAN or other original account identifier in one or more data structures (e.g., one or more databases, etc.) such that the token can be used to conduct transactions without directly using the original account identifier. In some instances, an original account identifier such as a PAN can be associated with multiple tokens used for different individuals or purposes.

[0055] As used herein, the term "communication" can refer to the receiving, accepting, sending, transmitting, and providing of data (e.g., information, signals, messages, instructions, commands, etc.). Communication between one unit (e.g., a device, system, component of a device or system, combination thereof, etc.) and another unit means that the first unit is able to receive information directly or indirectly from and / or transmit information to the other unit. This can refer to a direct or indirect connection that is essentially wired and / or wireless (e.g., a direct communication connection, an indirect communication connection, etc.). Furthermore, although the transmitted information may be modified, processed, relayed, and / or routed between the first and second units, the two units can also communicate with each other. For example, the first unit can communicate with the second unit even if it passively receives information and does not actively send information to the second unit. As another example, the first unit can communicate with the second unit if at least one intermediate unit processes information received from the first unit and transmits the processed information to the second unit. In some non-limiting embodiments or aspects, a message can refer to a network packet (e.g., a data packet, etc.) that includes data. It should be understood that many other arrangements are possible.

[0056] As used herein, the term "computing device" can refer to one or more electronic devices configured to process data. In some instances, a computing device may include the necessary components for receiving, processing, and outputting data, such as a processor, display, memory, input device, network interface, etc. A computing device can be a mobile device. As an example, a mobile device may include a cellular phone (e.g., a smartphone or standard cellular phone), a portable computer, a wearable device (e.g., a watch, eyeglasses, contact lenses, clothing, etc.), a personal digital assistant (PDA), and / or other similar devices. A computing device may also be a desktop computer or other form of non-mobile computer.

[0057] As used herein, the term "server" can refer to or include one or more computing devices operated by or facilitating communication and processing among multiple parties in a network environment such as the Internet, but it should be understood that communication may be facilitated through one or more public or private network environments, and various other arrangements may be possible. Furthermore, multiple computing devices (e.g., servers, point-of-sale (POS) devices, mobile devices, etc.) communicating directly or indirectly in a network environment can constitute a "system".

[0058] As used herein, the term "system" can refer to one or more computing devices or combinations of computing devices and / or components of such devices (e.g., processors, servers, client devices, software applications, etc.). As used herein, references to "device," "server," "processor," etc., can refer to a previously described device, server, or processor, different devices, servers, or processors, and / or combinations of devices, servers, and / or processors, described as performing a preceding step or function. For example, as used in the specification and claims, a first device, first server, or first processor described as performing a first step or first function can refer to the same or different devices, servers, or processors described as performing a second step or second function.

[0059] As used herein, the term "issuer institution" can refer to one or more entities, such as a bank, that provide customers with accounts for conducting transactions (e.g., payment transactions), such as initiating credit and / or debit payments. For example, an issuer institution may provide customers with an account identifier, such as a PAN, that uniquely identifies one or more accounts associated with said customer. The account identifier may be embodied in a portable financial device, such as a physical financial instrument (e.g., a payment card), and / or may be electronic and used for electronic payments. The term "issuer system" refers to one or more computer devices operated by or on behalf of an issuer institution, such as a server computer executing one or more software applications. For example, an issuer system may include one or more authorization servers for authorizing transactions.

[0060] As used herein, the term "merchant" can refer to an individual or entity that provides goods and / or services to or provides access to goods and / or services to a customer based on a transaction such as a payment transaction. The terms "merchant" or "merchant system" can also refer to one or more computer systems operated by or on behalf of a merchant, such as a server computer that executes one or more software applications.

[0061] As used herein, a “point-of-sale (POS) device” can refer to one or more devices that a merchant can use to conduct transactions (e.g., payment transactions) and / or process transactions. For example, a POS device may include one or more client devices. Additionally or alternatively, a POS device may include peripheral devices, card readers, scanning devices (e.g., barcode scanners), Bluetooth® communication receivers, near-field communication (NFC) receivers, radio frequency identification (RFID) receivers and / or other contactless transceivers or receivers, contact-based receivers, payment terminals, etc. As used herein, a “point-of-sale (POS) system” can refer to one or more client devices and / or peripheral devices that a merchant uses to conduct transactions. For example, a POS system may include one or more POS devices, and / or other similar devices that can be used to conduct payment transactions. In some non-limiting embodiments or aspects, a POS system (e.g., a merchant POS system) may include one or more server computers configured to process online payment transactions via web pages, mobile applications, etc.

[0062] As used herein, the term "transaction service provider" can refer to an entity that receives transaction authorization requests from merchants or other entities and, in some cases, provides payment guarantees through an agreement between the transaction service provider and the issuing entity. For example, a transaction service provider may include payment networks such as Visa®, or any other entity that processes transactions. The term "transaction processing system" can refer to one or more computer systems operated by or on behalf of the transaction service provider, such as a transaction processing server executing one or more software applications. A transaction processing server may include one or more processors and, in some non-limiting embodiments or aspects, may be operated by or on behalf of the transaction service provider.

[0063] Non-limiting embodiments or aspects of the disclosed subject matter relate to methods, systems, and computer program products for AI-assisted cybersecurity threat modeling tools that provide advantages over existing threat modeling systems. The disclosed subject matter provides methods for converting data associated with security architecture documents from natural language formats to threat modeling data formats, and allows for efficient analysis of additional subject-specific contextual information through machine learning models to identify threats and mitigation actions.

[0064] Furthermore, the disclosed subject matter provides for comparing multiple vector embeddings based on threat modeling data and vector embeddings based on source threats (e.g., CIS, MITRE, and OWASP), and allows machine learning models to effectively analyze contextual threat information about subjects. In some non-limiting embodiments or aspects, the disclosed subject matter provides for generating multiple vector embeddings based on receiving approval instructions from a user device. In some non-limiting embodiments or aspects, the disclosed subject matter provides for constructing a threat modeling data format based on: subject-object relationships among multiple subjects and objects included in a security architecture document; trust boundaries, which include boundaries distinguishing different trust levels defined in the security architecture document; and software applications in a specific software environment.

[0065] In some non-limiting embodiments or aspects, the disclosed subject matter provides the use of a Large Language Model (LLM) to convert a list from a first data format to a second data format to provide natural language threat modeling data, wherein the second data format includes a natural language format; and to generate a comprehensive threat modeling report based on the natural language threat modeling data. In some non-limiting embodiments or aspects, the disclosed subject matter provides performing reduction analysis via function processing calls provided to the LLM. In some non-limiting embodiments or aspects, the disclosed subject matter provides chunking data associated with a security architecture document based on each relation category between subjects and objects in a plurality of relation categories to provide multiple chunks of threat modeling data, wherein each of the multiple chunks of threat modeling data is based on a specified relation category between subjects and objects. In some non-limiting embodiments or aspects, the disclosed subject matter provides comparing each of a plurality of vector embeddings with a known vector embedding associated with one or more potential cybersecurity threats, and identifying the one or more potential cybersecurity threats within a threshold distance of the vector embeddings in the plurality of vector embeddings according to a measure of cosine similarity.

[0066] In this way, the disclosed topics can provide threat modeling tailored to computer systems, thereby eliminating inaccuracies arising from manual processes. Furthermore, the disclosed topics can provide the generation of contextual threat modeling graphs that can be used during threat modeling procedures. Moreover, the disclosed topics are unique and unconventional.

[0067] Now for reference Figure 1 The illustration shows an example system 100 for artificial intelligence-assisted cybersecurity threat modeling according to some non-limiting embodiments or aspects. For example, system 100 may include an artificial intelligence (AI) threat modeling system 102, a machine learning (ML) model management database 104, a user device 106, and / or a communication network 108.

[0068] AI threat modeling system 102 may include one or more devices capable of receiving and / or transmitting information to ML model management database 104 and / or user device 106, e.g., directly via wired or wireless communication connections, indirectly via communication network 108, etc. For example, AI threat modeling system 102 may include computing devices such as servers, server clusters, desktop computers, portable computers, mobile devices, and / or other similar devices. In some non-limiting embodiments or aspects, AI threat modeling system 102 may communicate with a data storage device (e.g., ML model management database 104), which may be local or remote to AI threat modeling system 102. In some non-limiting embodiments or aspects, AI threat modeling system 102 may be able to receive information from the data storage device (e.g., ML model management database 104), store information in the ML model management database, transmit information to the ML model management database, or search for information stored in the data storage device.

[0069] The ML model management database 104 may include one or more devices capable of receiving and / or transmitting information to the AI ​​threat modeling system 102 and / or user device 106, for example, directly via a wired or wireless communication connection, indirectly via a communication network 108, etc. For example, the ML model management database 104 may include computing devices such as servers, server clusters, desktop computers, portable computers, mobile devices, and / or other similar devices. In some non-limiting embodiments or aspects, the ML model management database 104 may include a data storage device. In some non-limiting embodiments or aspects, the ML model management database 104 may be capable of receiving information from the data storage device, storing information in the data storage device, transmitting information to the data storage device, or searching for information stored in the data storage device. In some non-limiting embodiments or aspects, the ML model management database 104 may be part of the AI ​​threat modeling system 102 and / or part of a system identical to the AI ​​threat modeling system 102.

[0070] User device 106 may include one or more means capable of receiving and / or transmitting information to the AI ​​threat modeling system 102 and / or the ML model management database 104, for example, directly via a wired or wireless communication connection, or indirectly via a communication network 108. For example, user device 106 may include computing devices such as mobile devices, portable computers, desktop computers, and / or other similar devices. Additionally or alternatively, each user device 106 may include means capable of receiving and / or transmitting information to other user devices 106, for example, directly via a wired or wireless communication connection, or indirectly via a communication network 108. In some non-limiting embodiments or aspects, user device 106 may be part of the AI ​​threat modeling system 102 and / or part of the same system as the AI ​​threat modeling system 102. For example, the AI ​​threat modeling system 102, the ML model management database 104, and user device 106 may all be a single system and / or a single computing device (and / or part of a single system and / or a single computing device).

[0071] The communication network 108 may include one or more wired and / or wireless networks. For example, the communication network 108 may include cellular networks (e.g., Long Term Evolution (LTE®) networks, third-generation (3G) networks, fourth-generation (4G) networks, fifth-generation (5G) networks, code division multiple access (CDMA) networks, etc.), public land mobile networks (PLMN), local area networks (LAN), wide area networks (WAN), metropolitan area networks (MAN), telephone networks (e.g., public switched telephone network (PSTN)), private networks (e.g., private networks associated with transaction service providers), self-organizing networks, intranets, the Internet, fiber-optic networks, cloud computing networks, etc., and / or combinations of these or other types of networks.

[0072] Figure 1 The number and arrangement of systems and devices shown are provided as an example. Figure 1 Compared to the systems and / or devices shown, there may be additional systems and / or devices, fewer systems and / or devices, different systems and / or devices, and / or systems and / or devices arranged in a different manner. Furthermore, implementation may be within a single system or device. Figure 1 The two or more systems or devices shown, or Figure 1 The single system or device shown may be implemented as multiple distributed systems or devices. Additionally or alternatively, a group of systems (e.g., one or more systems) and / or a group of devices (e.g., one or more devices) of system 100 may perform one or more functions described as being performed by another group of systems or another group of devices of system 100.

[0073] Now for reference Figure 2 It shows a flowchart of a process 200 for threat modeling according to some non-limiting embodiments or aspects. Figure 2 The steps shown are for illustrative purposes only. It will be understood that additional, fewer, different, and / or different orders of steps may be used in non-limiting embodiments or aspects. In some non-limiting embodiments or aspects, steps may be performed automatically in response to the execution and / or completion of previous steps. In some non-limiting embodiments or aspects, one or more steps of process 200 may be performed by the AI ​​threat modeling system 102 (e.g., at least one computing device of the AI ​​threat modeling system 102) (e.g., fully, partially, etc.). In some non-limiting embodiments or aspects, one or more steps of process 200 may be performed by another system, another device, another group of systems, or another group of devices (e.g., ML model management database 104, user device 106, etc.) that is separate from or includes the AI ​​threat modeling system 102 (e.g., fully, partially, etc.).

[0074] like Figure 2 As shown, at step 202, process 200 may include receiving data associated with a security architecture specific to a particular software environment. For example, AI threat modeling system 102 may receive data associated with a security architecture specific to a particular software environment. In some non-limiting embodiments or aspects, a user may input data associated with a security architecture specific to a particular software environment into user device 106. In some non-limiting embodiments or aspects, user device 106 may transmit data associated with a security architecture specific to a particular software environment to AI threat modeling system 102.

[0075] like Figure 2 As shown, at step 204, process 200 may include converting data associated with the security architecture from a natural language format to a threat modeling data format. For example, AI threat modeling system 102 may convert data associated with the security architecture from a natural language format to a threat modeling data format. In some non-limiting embodiments or aspects, AI threat modeling system 102 may convert data associated with the security architecture from a natural language format to a threat modeling data format in response to receiving data associated with the architecture of a particular software environment from user device 106.

[0076] In some non-limiting embodiments or aspects, the threat modeling data format may be JSON format. In some non-limiting embodiments or aspects, the threat modeling data format may be constructed based on relationships between subjects and objects. In some non-limiting embodiments or aspects, the subjects and objects may be data elements included in the data associated with the security architecture document. In some non-limiting embodiments or aspects, the threat modeling data format may be constructed based on relationships between subjects and objects among multiple subjects and objects included in the security architecture document. In some non-limiting embodiments or aspects, the threat modeling data may contain data associated with each relationship category between subjects and objects in multiple relationship categories. In some non-limiting embodiments or aspects, the threat modeling data format may be constructed based on trust boundaries, which include boundaries distinguishing different defined trust levels in the security architecture document. In some non-limiting embodiments or aspects, the threat modeling data format may be constructed based on a software application of the specific software environment.

[0077] In some non-limiting embodiments or aspects, converting the data associated with the security architecture document from a natural language format to a threat modeling data format to provide threat modeling data may include performing reduction analysis via function processing calls provided to a Large Language Model (LLM). The AI ​​threat modeling system 102 may include an LLM. In some non-limiting embodiments or aspects, the LLM may be used to convert user input into the necessary computer-understandable output for interaction with different components or data. In some non-limiting embodiments or aspects, the LLM may be used to convert computer-understandable input into natural language format output. In some non-limiting embodiments or aspects, converting the data associated with the security architecture document from a natural language format to a threat modeling data format to provide threat modeling data may include chunking the data associated with the security architecture document based on each of the plurality of relation categories between subjects and objects to provide multiple chunks of threat modeling data. In some non-limiting embodiments or aspects, each of the multiple chunks of threat modeling data may be based on a specific relation category between subjects and objects.

[0078] AI threat modeling system 102 can generate a visual representation of a software architecture model based on the threat modeling data by converting the data associated with the security architecture document from natural language format to threat modeling data format, using a machine learning model. In some non-limiting embodiments or aspects, AI threat modeling system 102 can provide the visual representation of the software architecture model to user device 106. In some non-limiting embodiments or aspects, user device 106 can display the visual representation of the software architecture model for user viewing. In some non-limiting embodiments or aspects, AI threat modeling system 102 can provide user device 106 with a request for approval of the software architecture model. In some non-limiting embodiments or aspects, user device 106 can approve the software architecture model on user device 106. In some non-limiting embodiments or aspects, user device 106 can transmit an approval instruction for the software architecture model to AI threat modeling system 102. In some non-limiting embodiments or aspects, the ML model management database 104 can provide design or hints for the AI ​​threat modeling system 102 to generate a visual representation of the software architecture.

[0079] like Figure 2 As shown, at step 206, process 200 may include generating multiple vector embeddings. For example, AI threat modeling system 102 may generate multiple vector embeddings. In some non-limiting embodiments or aspects, AI threat modeling system 102 may generate multiple vector embeddings based on receiving an approval instruction from user device 106. In some non-limiting embodiments or aspects, AI threat modeling system 102 may use the LLM to generate multiple vector strings based on the threat modeling data. In some non-limiting embodiments or aspects, AI threat modeling system 102 may generate the multiple vector embeddings by using the LLM to convert each of a plurality of blocks of the threat modeling data into a vector string. In some non-limiting embodiments or aspects, AI threat modeling system 102 may transmit the multiple vector embeddings to ML model management database 104. In some non-limiting embodiments or aspects, ML model management database 104 may store the multiple vector embeddings.

[0080] like Figure 2As shown, at step 208, process 200 may include identifying potential security threats. For example, AI threat modeling system 102 may identify potential security threats. In some non-limiting embodiments or aspects, AI threat modeling system 102 may identify one or more potential cybersecurity threats based on the plurality of vector embeddings. In some non-limiting embodiments or aspects, AI threat modeling system 102 may identify one or more potential cybersecurity threats by comparing each of the plurality of vectors with a known vector embedding associated with the one or more potential cybersecurity threats. In some non-limiting embodiments or aspects, the known vector embeddings associated with the one or more potential cybersecurity threats may be stored in ML model management database 104. In some non-limiting embodiments or aspects, ML model management database 104 may include a vector database with multiple vector embeddings. In some non-limiting embodiments or aspects, the vector database may include open-source threats such as CIS, MITRE, and OWASP. Identifying the one or more potential cybersecurity threats may include identifying the one or more potential cybersecurity threats within a threshold distance of the vector embeddings in the plurality of vector embeddings based on a measure of cosine similarity. In some non-limiting embodiments or aspects, the one or more potential threats may be associated with one or more subject-object relationships among a plurality of subjects and objects included in a security architecture document. In some non-limiting embodiments or aspects, the AI ​​threat modeling system 102 may receive known vector embeddings associated with the one or more potential cybersecurity threats from the ML model management database 104. In some non-limiting embodiments or aspects, the AI ​​threat modeling system 102 may identify potential security threats in response to receiving known vector embeddings associated with the one or more potential cybersecurity threats from the ML model management database 104.

[0081] like Figure 2 As shown, at step 210, process 200 may include mapping potential cybersecurity threats to corresponding controls that provide potential mitigation actions. For example, AI threat modeling system 102 may map potential cybersecurity threats to corresponding controls that provide potential mitigation actions. In some non-limiting embodiments or aspects, AI threat modeling system 102 may map the one or more potential cybersecurity threats to one or more corresponding controls that provide potential mitigation actions to the one or more potential cybersecurity threats.

[0082] In some non-limiting embodiments or aspects, the AI ​​threat modeling system 102 can generate a list including one or more potential cybersecurity threats and one or more corresponding controls, the one or more corresponding controls providing potential mitigation actions to the one or more potential cybersecurity threats. In some non-limiting embodiments or aspects, the AI ​​threat modeling system 102 can convert the list from a first data format to a second data format to provide natural language threat modeling data. In some non-limiting embodiments or aspects, the LLM of the AI ​​threat modeling system 102 can convert the list from a first data format to a second data format to provide natural language threat modeling data. The second data format may include a natural language format. In some non-limiting embodiments or aspects, the AI ​​threat modeling system 102 can generate a comprehensive threat modeling report based on the natural language threat modeling data. In some non-limiting embodiments or aspects, the AI ​​threat modeling system 102 can transmit the comprehensive threat modeling report to user device 106.

[0083] Now for reference Figure 3A-3I It illustrates a schematic diagram of an exemplary implementation of a process 300 for AI-assisted cybersecurity threat modeling, based on some non-limiting embodiments or aspects.

[0084] like Figure 3A As shown by reference numeral 302 in the accompanying drawings, the AI ​​threat modeling system 102 can generate known vector embeddings. For example, the AI ​​threat modeling system 102 can generate Figure 326 based on multiple known open-source cybersecurity threats (such as Internet Security Center (CIS) threats, MITRE adversarial tactics, Technology and Common Knowledge Base (ATT&CK) threats, OWSAP threats, etc.), including known vector embeddings 324. In some non-limiting embodiments or aspects, the AI ​​threat modeling system 102 can store the known vector embeddings 324 in the memory of the AI ​​threat modeling system 102, the ML model management database 104, and / or the user device 106.

[0085] like Figure 3B As shown by reference numeral 304 in the accompanying drawings, the AI ​​threat modeling system 102 can receive data associated with a security architecture document. For example, the AI ​​threat modeling system 102 can receive data associated with a security architecture document input by a user from a user device 106. In some non-limiting embodiments or aspects, the data associated with the security architecture document may include multiple data elements. The security architecture document may be used in a specific software environment. The data may be formatted according to a natural language data format.

[0086] In some non-limiting embodiments or aspects, the AI ​​threat modeling system 102 may include one or more machine learning models. For example, the AI ​​threat modeling system 102 may include LLM 318 (… Figure 3C and 3E (As shown). The AI ​​threat modeling system 102 can generate (e.g., train, retrain, and / or implement) one or more machine learning models. For example, the AI ​​threat modeling system 102 can generate (e.g., train, retrain, and / or implement) an LLM 318. In some non-limiting embodiments or aspects, the AI ​​threat modeling system 102 can train the LLM 318 to perform a task.

[0087] like Figure 3C As shown by reference numeral 306 in the accompanying drawings, the AI ​​threat modeling system 102 can convert data associated with a security architecture from a natural language format into a threat modeling data format. For example, LLM 318 can convert data associated with a security architecture from a natural language format into a threat modeling data format to provide threat modeling data 316. Threat modeling data 316 can be formatted according to the threat modeling data format. In some non-limiting embodiments or aspects, the threat modeling data format may be constructed based on a subject-object relationship, wherein the subject and the object may include one or more data elements from a plurality of data elements included in the data associated with the security architecture document.

[0088] In some non-limiting embodiments or aspects, the LLM 318 may be trained based on data received that is associated with multiple security architecture documents for multiple specific software environments. For example, the AI ​​threat modeling system 102 may train the LLM 318 based on security architecture-associated data in natural language format received from the AI ​​threat modeling system 102 as input to provide threat modeling data 316 as output.

[0089] In some non-limiting embodiments or aspects, LLM 318 may receive function processing calls (e.g., from AI threat modeling system 102). In some non-limiting embodiments or aspects, LLM 318 may perform reduction analysis via function processing calls when converting data associated with a security architecture document from natural language format to threat modeling data format to provide threat modeling data 316. In some non-limiting embodiments or aspects, function processing calls may include structured requests for performing function-like actions (e.g., calling external APIs, retrieving data, transforming data, and / or performing structured processing). In some non-limiting embodiments or aspects, structured requests may include requests for LLM 318 to process input in natural language format (e.g., data associated with a security architecture document) and return threat modeling data format. In some non-limiting embodiments or aspects, LLM 318 may use logical reasoning, mathematical calculations, and / or code execution to process requests.

[0090] In some non-limiting embodiments or aspects, the threat modeling data format may include a JSON format. In some non-limiting embodiments or aspects, the threat modeling data format may be constructed based on: the relationships between subjects and objects among multiple subjects and objects included in a security architecture document; trust boundaries, which include boundaries distinguishing different trust levels defined in the security architecture document; software applications for a specific software environment; and / or any combination thereof.

[0091] In some non-limiting embodiments or aspects, threat modeling data 316 may include data associated with each relationship category between subjects and objects in a plurality of relationship categories.

[0092] In some non-limiting embodiments or aspects, the AI ​​threat modeling system 102 can generate a visual representation of a software architecture model (e.g., a context, container, component code (C4) model) using a machine learning model (not shown) based on threat modeling data 316 and / or C4 design data retrieved from a database (e.g., ML model management database 104). In some non-limiting embodiments or aspects, the machine learning model may include supervised machine learning models and / or unsupervised machine learning models. In some non-limiting embodiments or aspects, the machine learning model may include classification models, neural network models, clustering models, deep learning models, decision tree models, linear regression models, logistic regression models, reinforcement learning models, etc.

[0093] In some non-limiting embodiments or aspects, the AI ​​threat modeling system 102 may provide a visual representation of a software architecture model (e.g., a C4 model) and / or threat modeling data 316 to a user device (e.g., user device 106). The user device 106 may display the visual representation of the software architecture model (e.g., a C4 model) and / or threat modeling data 316 via a display of the user device 106.

[0094] In some non-limiting embodiments or aspects, user device 106 may display data associated with user selections via a graphical user interface (GUI) displayed on a monitor. In some non-limiting embodiments or aspects, user selections may include selectable options, including approval and / or rejection. In some non-limiting embodiments or aspects, user device 106 may receive selections of selectable options indicating approval and / or rejection of the visual representation of the software architecture model (e.g., the C4 model) and / or threat modeling data 316. In some non-limiting embodiments or aspects, AI threat modeling system 102 may receive approval and / or rejection instructions from user device 106 based on user selections.

[0095] like Figure 3D As shown, when converting data associated with a security architecture document from natural language format to threat modeling data format to provide threat modeling data 316, the AI ​​threat modeling system 102 can chunk the data associated with the security architecture document based on each relationship category between subjects and objects in multiple relationship categories to provide multiple blocks 320 of threat modeling data 316. Each block of the multiple blocks 320 of threat modeling data 316 can be based on a specified relationship category between subjects and objects.

[0096] like Figure 3E As shown by reference numeral 308 in the accompanying drawings, the AI ​​threat modeling system 102 can generate multiple vector embeddings. For example, the AI ​​threat modeling system 102 can use an LLM 318 to generate vector embeddings 322 based on threat modeling data 316. In some non-limiting embodiments or aspects, the LLM 318 can generate vector embeddings 322 based on approval instructions received from the user device 106 regarding a visual representation of a software architecture model (e.g., a C4 model) and / or threat modeling data 316.

[0097] In some non-limiting embodiments or aspects, LLM 318 may receive threat modeling data 316 as input. LLM 318 may provide vector embedding 322 as output based on the received threat modeling data 316 as input.

[0098] In some non-limiting embodiments or aspects, when generating vector embeddings 322, LLM 318 may convert each of the multiple blocks 320 of threat modeling data 316 into a vector string.

[0099] like Figure 3F As shown by reference numeral 310 in the accompanying drawings, the AI ​​threat modeling system 102 can identify potential cybersecurity threats. For example, the AI ​​threat modeling system 102 can identify one or more potential cybersecurity threats based on vector embedding 322 by comparing each of a plurality of vector embeddings with a known vector embedding 324 associated with one or more potential cybersecurity threats.

[0100] In some non-limiting embodiments or aspects, the AI ​​threat modeling system 102 can identify one or more potential cybersecurity threats within a threshold distance of vector embeddings in a plurality of vector embeddings based on a measure of cosine similarity (e.g., a measure of the cosine of the angle between two vectors to measure the similarity between the two vectors).

[0101] like Figure 3G As shown, the AI ​​threat modeling system 102 can generate Figures 326, 328, and 330. Figures 326, 328, and 330 may include multiple vector embeddings 324, 334, 336, 338, and 340.

[0102] In some non-limiting embodiments or aspects, FIG326 may be generated based on known vector embedding 324.

[0103] In some non-limiting embodiments or aspects, Figure 328 can be generated based on a known vector embedding 324 and input from a user. Vector 334 can be associated with an incorrect classifier, vector 336 can be associated with a correct classifier, and vector 338 can be associated with input from a user. The AI ​​threat modeling system 102 can generate vector 338 based on received input from a user. In some non-limiting embodiments or aspects, the AI ​​threat modeling system 102 (e.g., LLM 318) can retrieve data based on received user input vectors. In cases where the user input includes unnecessary data (e.g., noise), the AI ​​threat modeling system 102 can return an incorrect classifier vector (e.g., vector 334) instead of a correct classifier vector (e.g., vector 336) because the incorrect classifier vector (e.g., vector 334) points in the same direction as the user input vector (e.g., vector 338).

[0104] In some non-limiting embodiments or aspects, Figure 330 may be generated based on known vector embeddings 324 and input from the user. Figure 330 may include post-function processing vectors (e.g., vector 340). In some non-limiting embodiments or aspects, the AI ​​threat modeling system 102 may provide function processing calls to the LLM 318 to reduce noise in the data associated with the user input. In response to receiving a function processing call, the LLM 318 may search for parameters mapped back to the threat modeling data structure. Because the known vector embeddings 324 are based on similar data structures and parameters, highly accurate information fragments (e.g., vector 340) are retrieved when the LLM 318 performs cosine similarity analysis.

[0105] like Figure 3H As shown by reference numeral 312 in the accompanying drawings, the AI ​​threat modeling system 102 can generate a list including one or more potential cybersecurity threats and one or more corresponding controls, which provide potential mitigation actions to the one or more potential cybersecurity threats. For example, the AI ​​threat modeling system 102 can generate the list based on the identification of potential cybersecurity threats. In some non-limiting embodiments or aspects, the list can be formatted according to a first data format. In some non-limiting embodiments or aspects, the first data format may include a threat modeling data format. In some non-limiting embodiments or aspects, the AI ​​threat modeling system 102 can use an LLM 318 to convert the list from the first data format (e.g., threat modeling data format) to a second data format (e.g., natural language format) to provide natural language threat modeling data.

[0106] like Figure 3I As shown by reference numeral 314 in the accompanying drawings, the AI ​​threat modeling system 102 can map potential cybersecurity threats to corresponding controls, which in turn provide potential mitigation actions to the potential cybersecurity threats.

[0107] In some non-limiting embodiments or aspects, the AI ​​threat modeling system 102 can generate a comprehensive threat modeling report based on the natural language threat modeling data. In some non-limiting embodiments or aspects, the AI ​​threat modeling system 102 can send the report to the user device 106.

[0108] Now for reference Figure 4 It illustrates a diagram of an exemplary implementation of an environment 400 for AI-assisted cybersecurity threat modeling, based on some non-limiting embodiments or aspects.

[0109] like Figure 4As shown, environment 400 may include a front-end portal 402, an AI engine 404, and / or a vector knowledge system 406. In some non-limiting embodiments or aspects, the AI ​​engine 404 may transmit data to the front-end portal 402 and / or the vector knowledge system 406 and / or receive data from the front-end portal and / or the vector knowledge system.

[0110] In some non-limiting embodiments or aspects, the front-end portal 402 may be identical, similar, and / or a part of the user device 106. The front-end portal 402 may include a UML / application design parsing system 408 and / or a threat modeling creator system 410. In some non-limiting embodiments or aspects, the UML / application design parsing system 408 may obtain multiple application design specifications from multiple document sources. Application design specifications may include data associated with a security architecture document for a specific software environment. The UML / application design parsing system 408 may output threat modeling data.

[0111] In some non-limiting embodiments or aspects, AI engine 404 may include LLM 412, imaging module 414, threat detection module 416, control output module 418, and / or base AI model 420. In some non-limiting embodiments or aspects, AI engine 404 may be identical, similar, and / or a part of AI threat modeling system 102. In some non-limiting embodiments or aspects, LLM 412 may be identical, similar, and or a part of LLM 318.

[0112] In some non-limiting embodiments or aspects, the vector knowledge system 406 may store data and / or C4 data associated with multiple known cybersecurity threats. The vector knowledge system 406 may include a C4 design database 422 that can store C4 data, a threat model database 424 that can store threat modeling data, and / or an open-source threat database 426 that can store data associated with known open-source threats.

[0113] In some non-limiting embodiments or aspects, the UML / application design parsing system 408 and / or threat model creator system 410 may input data into the AI ​​engine 404. For example, the UML / application design parsing system 408 and / or threat model creator system 410 may input data associated with a security architecture document for a specific software environment (e.g., a business requirements document (BRD), diagrams, and / or original user input describing the application) into the LLM 412.

[0114] In some non-limiting embodiments or aspects, LLM 412 may include a function call model trained to perform reduction analysis to convert data from a first data format (e.g., natural language format) to a second data format (e.g., threat modeling data format). In some non-limiting embodiments or aspects, LLM 412 may perform reduction analysis via function processing calls provided to LLM 412 and convert data associated with a security architecture document from natural language format to threat modeling data format to provide threat modeling data. In some non-limiting embodiments or aspects, LLM 412 may send threat modeling data to imaging module 414.

[0115] In some non-limiting embodiments or aspects, the imaging module 414 may convert threat modeling data from a second data format (e.g., threat modeling data itself) to a third data format (e.g., context, container, component code (C4) format) to provide a visual representation of the C4 model of the data by mapping the threat modeling data to data retrieved from the C4 design database 422. In some non-limiting embodiments or aspects, the imaging module 414 may send a message to a front-end portal 402, the message including threat modeling data and a visual representation of the C4 model of the threat modeling data, for verification by the front-end portal 402 (e.g., approval or rejection). In some non-limiting embodiments or aspects, a user may select an option displayed via a display on the front-end portal 402 to approve or reject a message including threat modeling data and a graphical representation of the C4 model of the threat modeling data.

[0116] In some non-limiting embodiments or aspects, in response to a user-selected approval message, LLM 412 may divide the threat modeling data into multiple blocks based on relationships defined by the threat modeling data (e.g., relationships between subjects and objects in multiple relationship categories) to provide multiple blocks of threat modeling data. LLM 412 may convert each of the multiple blocks into a vector string. LLM 412 may then generate multiple vector embeddings based on the vector strings. In some non-limiting embodiments or aspects, LLM 412 may send the multiple vector embeddings to threat detection module 416.

[0117] In some non-limiting embodiments or aspects, upon receiving the plurality of vector embeddings, the threat detection module 416 can identify potential cybersecurity threats based on the plurality of vector embeddings. The threat detection module 416 can compare each of the plurality of vector embeddings with a known vector embedding associated with one or more potential cybersecurity threats, and identify the one or more potential cybersecurity threats within a threshold distance of the vector embeddings in the plurality of vector embeddings based on a measure of cosine similarity. Known vector embeddings may include embeddings generated based on one or more open-source threats (e.g., CIS threats, MITRE ATT&CK threats, OWSAP threats, etc.).

[0118] In some non-limiting embodiments or aspects, the threat detection module 416 may send data to and / or receive data from the control output module 418. For example, the threat detection module 416 may send one or more potential cybersecurity threats to the control output module 418. In some non-limiting embodiments or aspects, the control output module 418 may map the one or more potential cybersecurity threats to one or more corresponding controls, which provide potential mitigation actions to the one or more potential cybersecurity threats. The control output module 418 may generate a list including the one or more potential cybersecurity threats and the one or more corresponding controls, which provide potential mitigation actions to the one or more potential cybersecurity threats. The control output module 418 may include a vector database comprising vector embeddings associated with vectors traversing an embedding model (not shown). The control output module 418 may map specific threats (e.g., threats identified in cloud computing services such as Amazon Web Services (AWS)) to specific controls (e.g., specific controls of cloud computing services).

[0119] In some non-limiting embodiments or aspects, the control output module 418 may send a list to the LLM 412, the list including the one or more potential cybersecurity threats and the one or more corresponding controls, the one or more corresponding controls providing potential mitigation actions to the one or more potential cybersecurity threats. In response to receiving the list, the LLM 412 may convert the list from a first format to a second format (e.g., natural language format).

[0120] In some non-limiting embodiments or aspects, LLM 412 may send a list in natural language format to front-end portal 402. Front-end portal 402 may display the list in natural language format via a display. In some non-limiting embodiments or aspects, the base AI model 420 may include one or more embedded models (e.g., an Ada model or a DaVinci model).

[0121] Now for reference Figure 5A and 5B This illustrates a schematic diagram of an exemplary implementation of a method and / or system for a process 500 for AI-assisted cybersecurity threat modeling, based on some non-limiting embodiments or aspects. (See also...) Figure 5A and 5B As shown, process 500 may include user device 506, web portal 508, LLM 510, imaging module 512, threat detection module 514, and / or control output module 516. In some non-limiting embodiments or aspects, LLM 510, imaging module 512, threat detection module 514, and / or control output module 516 may be the same as, similar to, and / or a part thereof with AI threat modeling system 102, AI engine 404, and / or vector knowledge system 406. In some non-limiting embodiments or aspects, LLM 510 may be the same as, similar to, and / or a part thereof with LLM 318 and / or LLM 412. In some non-limiting embodiments or aspects, imaging module 512 may be the same as, similar to, and / or a part thereof with imaging module 414. In some non-limiting embodiments or aspects, threat detection module 514 may be the same as, similar to, and / or a part thereof with threat detection module 416. In some non-limiting embodiments or aspects, control output module 516 may be the same as, similar to, and / or a part of control output module 418. In some non-limiting embodiments or aspects, user device 506 may be the same as, similar to, and / or a part of user device 106 and / or front-end portal 402.

[0122] like Figure 5A As shown, at step 520, in response to receiving data as input from the user, user device 506 may send the data to web portal 508. The data may include data associated with a security architecture document for a specific software environment (e.g., a business requirements document (BRD), diagrams, and / or raw user input describing the application).

[0123] like Figure 5A As shown, at step 522, web portal 508 can send data to LLM 510. In some non-limiting embodiments or aspects, LLM 510 may include a function call model trained to perform reduction analysis to convert data from a first data format (e.g., natural language format) to a second data format (e.g., threat modeling data format).

[0124] like Figure 5AAs shown, at step 524, in response to receiving data from web portal 508, LLM 510 can perform reduction analysis via function processing calls provided to LLM and convert the data associated with the security architecture document from natural language format to threat modeling data format to provide threat modeling data.

[0125] like Figure 5A As shown, at step 526, LLM 510 can send threat modeling data to imaging module 512.

[0126] like Figure 5A As shown, at step 528, the imaging module 512 can convert the threat modeling data from a second data format (e.g., threat modeling data) to a third data format (e.g., context, container, component code (C4) format) to provide a visual representation of the C4 model of the data by mapping the threat modeling data to data from a database (e.g., C4 design cues) storing C4 data (e.g., C4 design cues).

[0127] like Figure 5A As shown, at step 530, the imaging module 512 sends a message to the user device 506, the message including threat modeling data and a visual representation of the C4 model of the threat modeling data, for the user device 506 to verify (e.g., approve or reject).

[0128] like Figure 5A As shown, at step 532, the user can select from the options presented on the user device 506 to approve or reject the message (including threat modeling data and a graphical representation of the C4 model of the threat modeling data), and can send the approval to the web portal 508.

[0129] like Figure 5A As shown, at step 534, web portal 508 sends threat model data to LLM 510.

[0130] like Figure 5A As shown, at step 536, upon receiving threat model data from web portal 508, LLM 510 divides the threat model data into multiple blocks based on relationships defined by the threat model data (e.g., relationships between subjects and objects in multiple relationship categories) to provide multiple blocks of threat modeling data. LLM 510 can convert each of the multiple blocks into a vector string. Then, LLM 510 can generate multiple vector embeddings based on the vector strings.

[0131] like Figure 5B As shown, at step 538, LLM 510 sends the plurality of vector embeddings to threat detection module 514. Figure 5BAs further shown, at step 540, after receiving the plurality of vector embeddings, the threat detection module 514 can identify potential cybersecurity threats based on the plurality of vector embeddings. The threat detection module 514 can compare each of the plurality of vector embeddings with a known vector embedding associated with one or more potential cybersecurity threats, and identify the one or more potential cybersecurity threats within a threshold distance of the vector embeddings in the plurality of vector embeddings based on a measure of cosine similarity. The known vector embeddings may include embeddings generated based on one or more open-source threats (e.g., CIS threats, MITRE ATT&CK threats, OWSAP threats, etc.).

[0132] like Figure 5B As further shown, at step 542, the threat detection module 514 can send the one or more potential cybersecurity threats to the control output module 516. Figure 5B Further, at step 544, the control output module 516 can map the one or more potential cybersecurity threats to one or more corresponding controls, which provide potential mitigation actions to the one or more potential cybersecurity threats. The control output module 516 may include a vector database comprising vector embeddings associated with vectors passing through an embedding model (e.g., the underlying AI model 420). The control output module 516 can map specific threats (e.g., threats identified in cloud computing services) to specific controls (e.g., specific controls within cloud computing service controls). The control output module 516 can generate a list including the one or more potential cybersecurity threats and the one or more corresponding controls, which provide potential mitigation actions to the one or more potential cybersecurity threats.

[0133] like Figure 5B Further, at step 546, the control output module 516 can send a list to the LLM 510, the list including the one or more potential cybersecurity threats and the one or more corresponding controls, the one or more corresponding controls providing potential mitigation actions to the one or more potential cybersecurity threats. In some non-limiting embodiments or aspects, the LLM 510 can convert the list from a first format to a second format (e.g., natural language format). Figure 5B As further shown, at step 548, LLM 510 can send the list in natural language format to user device 506. User device 506 can display the list in natural language format via its display. Figure 5B As further shown, at step 550, user device 506 may send verification and / or messages (including requests for further probes) to LLM 510.

[0134] Now for reference Figure 6 This diagram depicts an exemplary environment 600 in which the methods, systems, and / or computer program products described herein may be implemented according to some non-limiting embodiments or aspects. In some non-limiting embodiments or aspects, environment 600 may be used in conjunction with the systems, methods, and / or computer program products described herein, and / or the systems, methods, and / or computer program products described herein may be implemented in environment 600. In some non-limiting embodiments or aspects, environment 600 may be an example payment processing network. Figure 6 As shown, environment 600 may include transaction processing system 602, payment gateway system 612, merchant system 608, issuer system 604, acquirer system 610, and / or customer device 606. In some non-limiting embodiments or aspects, Figure 1 Each of the AI ​​threat modeling system 102, the ML model management database 104, and / or the user device 106 can be implemented by the transaction processing system 602 (e.g., a portion thereof). In some non-limiting embodiments or aspects, Figure 1 At least one of the AI ​​threat modeling system 102, the ML model management database 104, and / or the user device 106 may be implemented by another system, another device, another group of systems, or another group of devices (e.g., a portion thereof) that is separate from or includes the transaction processing system 602 (such as merchant system 608, issuer system 604, acquirer system 610, customer device 606, etc.). For example, the AI ​​threat modeling system 102 may be implemented by at least one of the payment gateway system 612, merchant system 608, issuer system 604, acquirer system 610, and / or customer device 606 (e.g., a portion thereof). Figure 6 The system and / or device can communicate via a communication network 614, which may include one or more wired and / or wireless communication networks.

[0135] Transaction processing system 602 may include one or more devices capable of receiving and / or transmitting information to payment gateway system 612, merchant system 608, issuer system 604, acquirer system 610, customer device 606, etc. (e.g., directly, indirectly, via public and / or private communication networks). Figure 6As shown, transaction processing system 602 can communicate with one or more issuer systems (e.g., issuer system 604), one or more acquirer systems (e.g., acquirer system 610), and / or one or more payment gateway systems (e.g., payment gateway system 612). Although only a single issuer system 604, a single acquirer system 610, and a single payment gateway system 612 are shown, it should be understood that transaction processing system 602 can communicate with multiple issuer systems, multiple acquirer systems, and / or multiple payment gateway systems. In some non-limiting embodiments or aspects, transaction processing system 602 may include computing devices such as servers (e.g., transaction processing servers), server clusters, and / or other similar devices. In some non-limiting embodiments or aspects, transaction processing system 602 can communicate with data storage devices, which may be local or remote to transaction processing system 602. In some non-limiting embodiments or aspects, transaction processing system 602 may be able to receive information from data storage devices, store information in data storage devices, transmit information to data storage devices, or search for information stored in data storage devices. In some non-limiting embodiments or aspects, transaction processing system 602 may be associated with a transaction service provider as described herein. In some non-limiting embodiments or aspects, transaction processing system 602 may also operate as an issuer system, such that transaction processing system 602 and issuer system 604 are both a single system and / or controlled by a single entity.

[0136] The payment gateway system 612 may include one or more devices capable of receiving and / or transmitting information to (e.g., directly, indirectly, or via public and / or private communication networks) transaction processing system 602, merchant system 608, issuer system 604, acquirer system 610, customer device 606, etc. For example, such as Figure 6 As shown, the payment gateway system 612 can communicate with one or more merchant systems (e.g., merchant system 608), one or more acquiring systems (e.g., acquiring system 610), and / or one or more transaction processing systems (e.g., transaction processing system 602). Although only a single merchant system 608, a single acquiring system 610, and a single transaction processing system 602 are shown, it should be understood that the payment gateway system 612 can communicate with multiple merchant systems, multiple acquiring systems, and / or multiple transaction processing systems. In some non-limiting embodiments or aspects, the payment gateway system 612 may include computing devices, such as servers, server groups, and / or other similar devices. In some non-limiting embodiments or aspects, the payment gateway system 612 may be associated with a payment gateway as described herein.

[0137] Merchant system 608 may include one or more devices capable of receiving and / or transmitting information to transaction processing system 602, payment gateway system 612, issuer system 604, acquirer system 610, customer device 606, etc., (e.g., directly, indirectly, via public and / or private communication networks). For example, such as Figure 6 As shown, merchant system 608 can communicate with one or more payment gateway systems (e.g., payment gateway system 612), one or more acquiring systems (e.g., acquiring system 610), and / or one or more consumer devices (e.g., customer device 606). Although only a single payment gateway system 612, a single acquiring system 610, and a single customer device 606 are shown, it should be understood that merchant system 608 can communicate with multiple payment gateway systems, multiple acquiring systems, and / or multiple consumer devices. In some non-limiting embodiments or aspects, merchant system 608 may include computing devices such as servers, server groups, client devices, client device groups, POS devices, POS systems, computers, computer systems, peripheral devices, and / or other similar devices. In some non-limiting embodiments or aspects, merchant system 608 may be associated with a merchant as described herein. In some non-limiting embodiments or aspects, merchant system 608 may include means capable of receiving information from and / or transmitting information to client device 606 via a short-range communication connection (e.g., NFC, RFID, Bluetooth®, Zigbee®, etc.). In some non-limiting embodiments or aspects, merchant system 608 may include one or more client devices. For example, merchant system 608 may include client devices that allow merchants (e.g., via at least one of acquiring system 610 and / or payment gateway system 612) to transmit information to transaction processing system 602. In some non-limiting embodiments or aspects, merchant system 608 (e.g., its client devices, its POS devices, etc.) may also operate as a payment gateway system, such that merchant system 608 and payment gateway system 612 are a single system and / or controlled by a single entity.

[0138] The issuing system 604 may include one or more devices capable of receiving and / or transmitting information to (e.g., directly, indirectly, or via public and / or private communication networks) the transaction processing system 602, payment gateway system 612, merchant system 608, acquiring system 610, and customer device 606. For example, such as... Figure 6As shown, the issuer system 604 can communicate with one or more transaction processing systems (e.g., transaction processing system 602) and / or one or more consumer devices (e.g., client device 606). Although only a single transaction processing system 602 and a single client device 606 are shown, it should be understood that the issuer system 604 can communicate with multiple transaction processing systems and / or multiple client devices 606. In some non-limiting embodiments or aspects, the issuer system 604 may include computing devices such as servers, server groups, and / or other similar devices. In some non-limiting embodiments or aspects, the issuer system 604 may be associated with an issuer institution as described herein. For example, the issuer system 604 may be associated with an issuer institution that issues credit accounts, debit accounts, credit cards, debit cards, payment devices, etc., to users associated with client device 606.

[0139] The acquiring system 610 may include one or more devices capable of receiving and / or transmitting information to (e.g., directly, indirectly, or via public and / or private communication networks) transaction processing system 602, payment gateway system 612, merchant system 608, issuer system 604, customer device 606, etc. For example, such as Figure 6 As shown, the acquiring system 610 can communicate with one or more transaction processing systems (e.g., transaction processing system 602), one or more payment gateway systems (e.g., payment gateway system 612), and / or one or more merchant systems (e.g., merchant system 608). Although only a single transaction processing system 602, a single payment gateway system 612, and a single merchant system 608 are shown, it should be understood that the acquiring system 610 can communicate with multiple transaction processing systems, multiple payment gateway systems, and / or multiple merchant systems. In some non-limiting embodiments or aspects, the acquiring system 610 may include computing devices such as servers, server clusters, and / or other similar devices. In some non-limiting embodiments or aspects, the acquiring system 610 may be associated with an acquiring institution as described herein.

[0140] Client device 606 may include one or more devices capable of receiving and / or transmitting information to transaction processing system 602, payment gateway system 612, merchant system 608, issuer system 604, acquirer system 610, etc., (e.g., directly, indirectly, via public and / or private communication networks). For example, such as Figure 6As shown, client device 606 can communicate with one or more merchant systems (e.g., merchant system 608) and / or one or more issuer systems (e.g., issuer system 604). Although only a single merchant system 608 and a single issuer system 604 are shown, it should be understood that client device 606 can communicate with multiple merchant systems and / or multiple issuer systems. In some non-limiting embodiments or aspects, client device 606 can be associated with a user to whom a credit account, debit account, credit card, debit card, payment device, etc., has been issued. In some non-limiting embodiments or aspects, client device 606 may include computing devices such as computers, portable computers, laptop computers, tablet computers, mobile devices, cellular phones, smartphones, wearable devices (e.g., watches, glasses, lenses, clothing, etc.), PDAs, client devices, and / or other similar devices. In some non-limiting embodiments or aspects, client device 606 may include payment devices as described herein. In some non-limiting embodiments or aspects, client device 606 may include means capable of receiving and / or transmitting information to other client devices 606 (e.g., directly, indirectly, via public and / or private communication network connections, short-range communication connections, etc.). In some non-limiting embodiments or aspects, client device 606 may include means capable of receiving and / or transmitting information to merchant system 608 via a short-range communication connection (e.g., NFC communication connection, RFID communication connection, Bluetooth® communication connection, Zigbee® communication connection, etc.). In some non-limiting embodiments or aspects, client device 606 may include client-side devices.

[0141] In some non-limiting embodiments or aspects, the transaction processing system 602 can communicate directly with the merchant system 608 (e.g., via a public and / or private communication network connection, etc.). Alternatively or additionally, the transaction processing system 602 can communicate with the merchant system 608 via a payment gateway system 612 and / or an acquiring system 610. In some non-limiting embodiments or aspects, the acquiring system 610 associated with the merchant system 608 can operate as a payment gateway system 612 to transmit transaction messages (e.g., authorization requests) from the merchant system 608 to the transaction processing system 602. In some non-limiting embodiments or aspects, the merchant system 608 can communicate directly with the payment gateway system 612 (e.g., via a public and / or private communication network connection, etc.). For example, the merchant system 608, which includes a physical POS device, can communicate with the payment gateway system 612 via a public or private network to conduct card transactions. As another example, a merchant system 608, which includes a server (e.g., a web server), can communicate with a payment gateway system 612 via a public or private network, such as the Internet, to conduct cardless transactions.

[0142] For illustrative purposes, processing a transaction (e.g., a payment transaction) may include generating a transaction message (e.g., an authorization request, etc.) based on the account identifier of a customer (e.g., an account holder associated with a customer device 606, etc.) and / or transaction data associated with the transaction. For example, a merchant system 608 (e.g., a client device of merchant system 608, a POS device of merchant system 608, etc.) may initiate a transaction, for example, by generating an authorization request (e.g., in response to receiving an account identifier from a customer's payment device and / or portable financial device, etc.). Merchant system 608 may transmit the authorization request to payment gateway system 612 and / or acquiring system 610. In some non-limiting embodiments or aspects, payment gateway system 612 may transmit the authorization request to acquiring system 610 and / or transaction processing system 602. Alternatively or additionally, acquiring system 610 (and / or payment gateway system 612) may transmit the authorization request to transaction processing system 602. After receiving an authorization request from merchant system 608 that identifies a customer's account identifier (e.g., the account holder and / or account identifier associated with customer device 606), transaction processing system 602 may transmit the authorization request to issuer system 604 (e.g., the issuer system that issues the payment device and / or account identifier). Issuer system 604 may determine an authorization decision (e.g., approval, rejection, etc.) based on the authorization request, and / or issuer system 604 may generate an authorization response based on the authorization decision and / or authorization request. Issuer system 604 may transmit the authorization response to transaction processing system 602. Transaction processing system 602 may transmit the authorization response to acquiring system 610 and / or payment gateway system 612. In some non-limiting embodiments or aspects, acquiring system 610 may transmit the authorization response to payment gateway system 612 and / or merchant system 608. Additionally or alternatively, payment gateway system 612 (and / or acquiring system 610) may transmit the authorization response to merchant system 608.

[0143] In some non-limiting embodiments or aspects, transaction processing system 602 and / or issuer system 604 may include at least one machine learning model (e.g., at least one of a fraud detection model, risk detection model, transaction authorization model, credit approval model, product recommendation model, classifier model, anomaly detection model, authentication model, any combination thereof, etc.). For example, as described herein, the machine learning model may be trained based on generated synthetic data. Transaction processing system 602 and / or issuer system 604 may perform at least one task (e.g., generating a prediction and / or generating an embedding) based on the authorization request and the machine learning model. For example, performing the task may include generating at least one prediction associated with fraud detection, risk detection, transaction authorization, credit approval, product recommendation, classification, anomaly detection, authentication, any combination thereof, etc. In some non-limiting embodiments or aspects, transaction processing system 602 may transmit at least one message (e.g., together with an authorization request) to issuer system 604 based on performing the task (e.g., generating a prediction and / or generating an embedding). In some non-limiting embodiments or aspects, the issuer system 604 may determine an authorization decision (e.g., approval, rejection, etc.) based on the authorization request and the execution of the task (e.g., predicted generation and / or embedded generation).

[0144] For illustrative purposes, transaction clearing and / or settlement may include generating messages (e.g., clearing messages, etc.) based on a customer's (e.g., associated with customer device 606, etc.) account identifier and / or transaction data associated with the transaction. For example, merchant system 608 may generate at least one clearing message (e.g., multiple clearing messages, a batch of clearing messages, etc.). Merchant system 608 may transmit the clearing message to acquiring system 610 (and / or payment gateway system 612, which may also transmit the clearing message to acquiring system 610). Acquiring system 610 may transmit the clearing message to transaction processing system 602. Transaction processing system 602 may transmit the clearing message to issuing system 604. Issuing system 604 may generate at least one settlement message based on the clearing message. In some non-limiting embodiments or aspects, the issuer system 604 may transmit settlement messages and / or funds to the transaction processing system 602 (and / or the settlement bank system associated with the transaction processing system 602), and the transaction processing system 602 (and / or the settlement bank system) may transmit settlement messages and / or funds to the acquiring system 610. Alternatively or additionally, the issuer system 604 may transmit settlement messages and / or funds to the acquiring system 610. In some non-limiting embodiments or aspects, the acquiring system 610 may transmit settlement messages and / or funds to the merchant system 608 (and / or the account associated with the merchant system 608).

[0145] Communication network 614 may include one or more wired and / or wireless networks. For example, communication network 614 may include cellular networks (e.g., Long Term Evolution (LTE) networks, third-generation (3G) networks, fourth-generation (4G) networks, fifth-generation (5G) networks, Code Division Multiple Access (CDMA) networks, etc.), Public Land Mobile Network (PLMN), Local Area Network (LAN), Wide Area Network (WAN), Metropolitan Area Network (MAN), Telephone Network (e.g., Public Switched Telephone Network (PSTN)), Private Network (e.g., a private network associated with a transaction service provider), Self-organizing Network, Intranet, Internet, Fiber-based Network, Cloud Computing Network, etc., and / or combinations of these or other types of networks.

[0146] Figure 6 The number and arrangement of systems, devices, and / or networks shown are provided as an example. Additional systems, devices, and / or networks, fewer systems, devices, and / or networks, different systems, devices, and / or networks, and / or networks may exist, and / or may be combined with... Figure 6 The systems, devices, and / or networks shown are arranged in different ways. Furthermore, implementation can be carried out within a single system or device. Figure 6 The two or more systems or devices shown, or Figure 6 The single system or device shown can be implemented as multiple distributed systems or devices. Additionally or alternatively, a group of systems (e.g., one or more systems) or a group of devices (e.g., one or more devices) of environment 600 can perform one or more functions described as being performed by another group of systems or devices of environment 600.

[0147] Now for reference Figure 7 The diagram illustrates example components of device 700 according to a non-limiting embodiment or aspect. As an example, device 700 may correspond to... Figure 1 At least one of the following: AI threat modeling system 102, ML model management database 104, and / or user device 106 Figure 6 At least one of the following: transaction processing system 602, issuer system 604, client device 606, merchant system 608, and / or acquirer system 610. In some non-limiting embodiments or aspects, Figure 1 or Figure 6 Such systems or devices may include at least one device 700 and / or at least one component of device 700. Figure 7 The number and arrangement of components shown are provided as an example. In some non-limiting embodiments or aspects, with Figure 7Compared to those shown, device 700 may include additional components, fewer components, different components, or components arranged in a different manner. Additionally or alternatively, a set of components of device 700 (e.g., one or more components) may perform one or more functions described as being performed by another set of components of device 700.

[0148] like Figure 7 As shown, device 700 may include bus 702, processor 704, memory 706, storage component 708, input component 710, output component 712, and communication interface 714. Bus 702 may include components that allow communication between components of device 700. In some non-limiting embodiments or aspects, processor 704 may be implemented in hardware, firmware, or a combination of hardware and software. For example, processor 704 may include a processor (e.g., a central processing unit (CPU), graphics processing unit (GPU), accelerated processing unit (APU), etc.), microprocessor, digital signal processor (DSP), and / or any processing component that can be programmed to perform functions (e.g., a field-programmable gate array (FPGA), application-specific integrated circuit (ASIC), etc.). Memory 706 may include random access memory (RAM), read-only memory (ROM), and / or another type of dynamic or static storage device (e.g., flash memory, magnetic memory, optical memory, etc.) that stores information and / or instructions for use by processor 704.

[0149] Continue to refer to Figure 7Storage component 708 may store information and / or software related to the operation and use of device 700. For example, storage component 708 may include a hard disk (e.g., magnetic disk, optical disk, magneto-optical disk, solid-state disk, etc.) and / or another type of computer-readable medium. Input component 710 may include components that allow device 700 to receive information, for example, through user input (e.g., touch screen display, keyboard, keypad, mouse, buttons, switches, microphone, etc.). Alternatively or additionally, input component 710 may include sensors for sensing information (e.g., Global Positioning System (GPS) component, accelerometer, gyroscope, actuator, etc.). Output component 712 may include components that provide output information from device 700 (e.g., display, speaker, one or more light-emitting diodes (LEDs), etc.). Communication interface 714 may include transceiver-like components (e.g., transceiver, separate receiver and transmitter, etc.) that enable device 700 to communicate with other devices, for example, via wired connection, wireless connection, or a combination of wired and wireless connection. The communication interface 714 allows device 700 to receive information from another device and / or provide information to another device. For example, the communication interface 714 may include an Ethernet interface, an optical interface, a coaxial interface, an infrared interface, a radio frequency (RF) interface, a universal serial bus (USB) interface, a Wi-Fi® interface, a cellular network interface, etc.

[0150] Apparatus 700 can perform one or more processes described herein. Apparatus 700 can perform these processes based on processor 704 executing software instructions stored in a computer-readable medium such as memory 706 and / or storage component 708. The computer-readable medium can include any non-transitory memory device. Memory devices include memory space located within a single physical storage device or memory space distributed across multiple physical storage devices. Software instructions can be read into memory 706 and / or storage component 708 via communication interface 714 from another computer-readable medium or from another device. When executed, the software instructions stored in memory 706 and / or storage component 708 can cause processor 704 to perform one or more processes described herein. Additionally or alternatively, hard-wired circuitry can be used in place of or in conjunction with the software instructions to perform one or more processes described herein. Therefore, the embodiments described herein are not limited to any particular combination of hardware circuitry and software. As used herein, the term “configured to” can refer to an arrangement of software, apparatus, and / or hardware for performing and / or implementing one or more functions (e.g., actions, processes, steps of processes, etc.). For example, "a processor configured to..." can refer to a processor that executes software instructions (e.g., program code) that cause the processor to perform one or more functions.

[0151] Although embodiments have been described in detail for illustrative purposes, it should be understood that such details are for the purposes described only, and this disclosure is not limited to the disclosed embodiments or aspects, but rather is intended to cover modifications and equivalent arrangements that fall within the spirit and scope of the appended claims. For example, it should be understood that this disclosure contemplates that, where possible, one or more features of any embodiment or aspect may be combined with one or more features of any other embodiment or aspect.

Claims

1. A computer-implemented method comprising: Utilize at least one processor to receive data associated with a security architecture document for a specific software environment; Using at least one processor, a large language model (LLM) is used to convert the data associated with the security architecture document from a natural language format to a threat modeling data format to provide threat modeling data, wherein the threat modeling data format is constructed based on the relationship between subjects and objects, and wherein the subjects and objects are data elements included in the data associated with the security architecture document; Using at least one processor, the LLM generates multiple vector embeddings based on the threat modeling data; Using at least one processor, one or more potential cybersecurity threats are identified based on the plurality of vector embeddings; as well as The one or more potential cybersecurity threats are mapped to one or more corresponding controls using at least one processor, and the one or more corresponding controls provide potential mitigation actions to the one or more potential cybersecurity threats.

2. The computer-implemented method according to claim 1, further comprising: Based on the data associated with the security architecture document, which is converted from natural language format to threat modeling data format, a machine learning model is used to generate a visual representation of the software architecture model based on the threat modeling data; Provide the visual representation of the software architecture model to the user device; as well as Receive approval instruction from the user device; The generation of the plurality of vector embeddings includes: The plurality of vector embeddings are generated based on the approval instruction received from the user device.

3. The computer-implemented method of claim 1, wherein the threat modeling data format is JSON format, and the threat modeling data format is constructed according to the following: The relationships between subjects and objects included in the security architecture document; Trust boundaries, including boundaries that distinguish different trust levels defined in the security architecture document; and Software applications for the specific software environment.

4. The computer-implemented method according to claim 1, further comprising: Generate a list, which includes the one or more potential cybersecurity threats and the one or more corresponding controls, wherein the one or more corresponding controls provide potential mitigation actions to the one or more potential cybersecurity threats; The LLM is used to convert the list from a first data format to a second data format to provide natural language threat modeling data, wherein the second data format includes a natural language format; as well as A comprehensive threat modeling report is generated based on the natural language threat modeling data.

5. The computer-implemented method of claim 1, wherein converting the data associated with the security architecture document from a natural language format to a threat modeling data format to provide threat modeling data comprises: Reduction analysis is performed via function calls provided to the LLM.

6. The computer-implemented method of claim 1, wherein the threat modeling data comprises data associated with each relationship category between subjects and objects in a plurality of relationship categories, and wherein converting the data associated with the security architecture document from a natural language format to a threat modeling data format to provide the threat modeling data comprises: The data associated with the security architecture document is chunked based on each of the multiple relation categories between subjects and objects to provide multiple chunks of threat modeling data, wherein each of the multiple chunks of threat modeling data is based on a specified relation category between subjects and objects; The generation of the plurality of vector embeddings includes: The LLM is used to convert each of the multiple blocks of the threat modeling data into a vector string.

7. The computer-implemented method of claim 1, wherein identifying the one or more potential cybersecurity threats comprises: Each of the plurality of vector embeddings is compared with a known vector embedding associated with the one or more potential cybersecurity threats; and Identify one or more potential cybersecurity threats within a threshold distance of the vector embeddings in the plurality of vector embeddings based on a measure of cosine similarity.

8. A system comprising: At least one processor, said at least one processor being configured to: Receive data associated with a security architecture document for a specific software environment; The data associated with the security architecture document is converted from a natural language format to a threat modeling data format using a Large Language Model (LLM) to provide threat modeling data, wherein the threat modeling data format is constructed based on the relationship between subjects and objects, and wherein the subjects and objects are data elements included in the data associated with the security architecture document. The LLM is used to generate multiple vector embeddings based on the threat modeling data; Based on the aforementioned multiple vector embeddings, one or more potential cybersecurity threats can be identified; and The one or more potential cybersecurity threats are mapped to one or more corresponding controls, which provide potential mitigation actions to the one or more potential cybersecurity threats.

9. The system of claim 8, wherein the at least one processor is further configured to: Based on the data associated with the security architecture document, which is converted from natural language format to threat modeling data format, a machine learning model is used to generate a visual representation of the software architecture model based on the threat modeling data; Provide the visual representation of the software architecture model to the user device; and Receive approval instruction from the user device; When generating the plurality of vector embeddings, the at least one processor is configured to: The plurality of vector embeddings are generated based on the approval instruction received from the user device.

10. The system of claim 8, wherein the threat modeling data format is JSON format, and the threat modeling data format is constructed according to the following: The relationships between subjects and objects included in the security architecture document; Trust boundaries, including boundaries that distinguish different trust levels defined in the security architecture document; and Software applications for the specific software environment.

11. The system of claim 8, wherein the at least one processor is further configured to: Generate a list, which includes the one or more potential cybersecurity threats and the one or more corresponding controls, wherein the one or more corresponding controls provide potential mitigation actions to the one or more potential cybersecurity threats; The LLM is used to convert the list from a first data format to a second data format to provide natural language threat modeling data, wherein the second data format includes a natural language format; and A comprehensive threat modeling report is generated based on the natural language threat modeling data.

12. The system of claim 8, wherein when converting the data associated with the security architecture document from a natural language format to a threat modeling data format to provide threat modeling data, the at least one processor is configured to: Reduction analysis is performed via function calls provided to the LLM.

13. The system of claim 8, wherein the threat modeling data comprises data associated with each of a plurality of relation categories between subjects and objects, and wherein, when converting the data associated with the security architecture document from a natural language format to a threat modeling data format to provide the threat modeling data, the at least one processor is configured to: The data associated with the security architecture document is chunked based on each of the multiple relation categories between subjects and objects to provide multiple chunks of threat modeling data, wherein each of the multiple chunks of threat modeling data is based on a specified relation category between subjects and objects; When generating the plurality of vector embeddings, the at least one processor is configured to: The LLM is used to convert each of the multiple blocks of the threat modeling data into a vector string.

14. The system of claim 8, wherein, when identifying the one or more potential cybersecurity threats, the at least one processor is configured to: Each of the plurality of vector embeddings is compared with a known vector embedding associated with the one or more potential cybersecurity threats; and Identify one or more potential cybersecurity threats within a threshold distance of the vector embeddings in the plurality of vector embeddings based on a measure of cosine similarity.

15. A computer program product comprising at least one non-transitory computer-readable medium, said at least one non-transitory computer-readable medium including program instructions that, when executed by at least one processor, cause the at least one processor to: Receive data associated with a security architecture document for a specific software environment; The data associated with the security architecture document is converted from a natural language format to a threat modeling data format using a Large Language Model (LLM) to provide threat modeling data, wherein the threat modeling data format is constructed based on the relationship between subjects and objects, and wherein the subjects and objects are data elements included in the data associated with the security architecture document. The LLM is used to generate multiple vector embeddings based on the threat modeling data; Based on the aforementioned multiple vector embeddings, one or more potential cybersecurity threats can be identified; and The one or more potential cybersecurity threats are mapped to one or more corresponding controls, which provide potential mitigation actions to the one or more potential cybersecurity threats.

16. The computer program product of claim 15, wherein the instructions further cause the at least one processor to: Based on the data associated with the security architecture document, which is converted from natural language format to threat modeling data format, a machine learning model is used to generate a visual representation of the software architecture model based on the threat modeling data; Provide the visual representation of the software architecture model to the user device; and Receive approval instruction from the user device; The instructions that cause the at least one processor to generate the plurality of vector embeddings cause the at least one processor to: The plurality of vector embeddings are generated based on the approval instruction received from the user device.

17. The computer program product of claim 15, wherein the threat modeling data format is JSON format, and the threat modeling data format is constructed according to the following: The relationships between subjects and objects included in the security architecture document; Trust boundaries, including boundaries that distinguish different trust levels defined in the security architecture document; and Software applications for the specific software environment.

18. The computer program product of claim 15, wherein the instructions further cause the at least one processor to: Generate a list, which includes the one or more potential cybersecurity threats and the one or more corresponding controls, wherein the one or more corresponding controls provide potential mitigation actions to the one or more potential cybersecurity threats; The LLM is used to convert the list from a first data format to a second data format to provide natural language threat modeling data, wherein the second data format includes a natural language format; and A comprehensive threat modeling report is generated based on the natural language threat modeling data.

19. The computer program product of claim 15, wherein the instruction causing the at least one processor to convert the data associated with the security architecture document from a natural language format to a threat modeling data format to provide threat modeling data causes the at least one processor to: Reduction analysis is performed via function calls provided to the LLM.

20. The computer program product of claim 15, wherein the threat modeling data comprises data associated with each of a plurality of relation categories between subjects and objects, and wherein the instruction causing the at least one processor to convert the data associated with the security architecture document from a natural language format to a threat modeling data format to provide the threat modeling data causes the at least one processor to: The data associated with the security architecture document is chunked based on each of the multiple relation categories between subjects and objects to provide multiple chunks of threat modeling data, wherein each of the multiple chunks of threat modeling data is based on a specified relation category between subjects and objects; One or more instructions that cause the at least one processor to generate the plurality of vector embeddings cause the at least one processor to: The LLM is used to convert each of the multiple blocks of the threat modeling data into a vector string.

Images