Quantum Computing Machine Learning for Security Threats

Abstract

An embodiment of a method for a security model is disclosed. The method includes generating a Bloch sphere based on a system information and event management (SIEM) of a security domain and a structured threat description format (STRD)-automated indicator information exchange procedure. The method also includes generating a quantum state probability matrix based on the Bloch sphere. The method further includes training a security threat model to perform security threat classification based on the quantum state probability matrix. The method further includes performing machine learning classification of the security domain based on the quantum state probability matrix.

Description

[Technical field]

[0001] The present invention relates to security threats, and more particularly to quantum computing machine learning regarding security threats. [Background technology]

[0002] A machine learning model can be a computer coded algorithm configured to learn how to perform a particular classification. A classification can be a decision made by a machine learning model to label a particular state. For example, in the field of computer security, classification can include analyzing the state of a computer system, determining whether the system is under threat of attack, and labeling the state of the computer accordingly. In this manner, an exemplary machine learning model of security threats can classify a computer system as either safe or under threat.

[0003] Conventional computing is useful for identifying possible security threats using models that can decompose the problem of identifying security threats into a manageable level of complexity. However, conventional approaches may rely on assumptions about how malicious actors, such as hackers and malware, have behaved in the past. As a result, conventional approaches may not be suitable for identifying security threats with new or unseen behavior.

[0004] Furthermore, the increasing sophistication of computing technology has created a race between those developing security threats and those trying to thwart them. Thus, without new approaches to identifying security threats, new technologies such as artificial intelligence, game theory, and others may increase the complexity of identifying security threats beyond the ability of traditional computers to solve them. Summary of the Invention

[0005] Disclosed are embodiments of a method for a security model. The method includes generating a Bloch sphere based on a system information and event management (SIEM) of a security domain and a structured threat information expression-trusted automated exchange of indicator information. The method further includes generating a quantum state probability matrix based on the Bloch sphere. Further, the method includes training a security threat model to perform a classification of security threats based on the quantum state probability matrix. Further, the method includes performing a machine learning classification of the security domain based on the quantum state probability matrix. Advantageously, such embodiments are useful for identifying security threats more quickly than current threat solutions. In an additional advantage, such embodiments are useful for identifying artificial intelligence malicious actors.

[0006] Optionally, in some embodiments, the method further includes determining that the malicious actor will perform a particular attack category based on the previous attack categories and the quantum state probability matrix. In other optional embodiments, the method further includes determining that the malicious actor will perform a particular attack method of the particular attack category based on the particular attack category and the quantum state probability matrix. Advantageously, such embodiments are useful for identifying particular attack methods and particular attack categories more quickly than current threat solutions.

[0007] Additional embodiments of a method for a security model are disclosed. The method includes generating a Bloch sphere based on a SIEM of a security domain and STIX-TAXII. The method further includes generating a quantum state probability matrix based on the Bloch sphere. Additionally, the method includes training a security threat model to perform security threat classification based on the quantum state probability matrix. Additionally, the security threat classification infers a next attack category for the security domain based on a previous attack category. Advantageously, such embodiments are useful for identifying security threats more quickly than current threat solutions. In an additional advantage, such embodiments are useful for identifying artificial intelligence malicious actors.

[0008] Additional embodiments of a method for a security model are disclosed. The method includes generating a Bloch sphere based on the SIEM of the security domain and STIX-TAXII. The method further includes generating a quantum state probability matrix based on the Bloch sphere. The quantum state probability matrix includes a plurality of probabilities representing the likelihood of a malicious actor transitioning between all possible combinations of attack categories. Furthermore, the plurality of probabilities of the quantum state probability matrix represents the likelihood of a malicious actor using a particular attack method of all attack categories based on a previous attack category. Furthermore, the method includes training a security threat model to perform security threat classification based on the quantum state probability matrix. The security threat classification infers a next attack category for the security domain based on a previous attack category. Advantageously, such embodiments are useful for identifying security threats more quickly than current threat solutions. In an additional advantage, such embodiments are useful for identifying artificial intelligence malicious actors.

[0009] Further aspects of the invention are directed to systems and computer program products having functionality similar to that discussed above with respect to the computer-implemented methods. This Summary is not intended to represent each aspect, every implementation, or every embodiment, or combination of the invention.

[0010] The drawings included in this application are incorporated in and form a part of this specification. The drawings illustrate embodiments of the invention and, together with the description, serve to explain the principles of the invention. The drawings are merely illustrative of particular embodiments and are not intended to limit the invention. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is a block diagram of an exemplary system for quantum computing-based machine learning models, according to some embodiments of the present invention. [Diagram 2] 1 is a diagram of an exemplary Bloch sphere, according to some embodiments of the present invention. [Diagram 3] 1 is a process flow chart of a method for quantum computing machine learning models, according to some embodiments of the present invention. [Figure 4] 1 is a diagram of an exemplary Bloch sphere, according to some embodiments of the present invention. [Figure 5A] 1 is a diagram of an exemplary Bloch sphere, according to some embodiments of the present invention. [Figure 5B] 1 is a diagram of an exemplary Bloch sphere, according to some embodiments of the present invention. [Figure 6] 1 is a diagram of an exemplary Bloch sphere, according to some embodiments of the present invention. [Figure 7] FIG. 2 is a block diagram of an example security threat model manager, according to some embodiments of the present invention. [Figure 8] FIG. 1 is a diagram of a cloud computing environment, according to some embodiments of the present invention. [Figure 9]FIG. 1 is a diagram of a set of functional abstraction model layers provided by a cloud computing environment according to some embodiments of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] While the invention is susceptible to various modifications and alternative forms, specifics thereof have been shown by way of example in the drawings and will be described in detail. It should be understood, however, that the intention is not to limit the invention to the described embodiments. On the contrary, the intention is to cover all modifications, equivalents, and alternatives falling within the scope of the invention.

[0013] Machine learning is a useful method for identifying possible security threats to computer systems and networks. Many machine learning models rely on a specific framework for analyzing possible security threats. Three examples of industry frameworks include the Diamond Model of Intrusion Analysis, the Structured Threat Information eXpression-Trusted Automated eXchange of Indicator Information (STIX-TAXII) framework, and Lockheed Martin's Cyber ​​Kill Chain®. These three frameworks are useful tools for identifying how a malicious actor or adversary might attack. Interestingly, these frameworks are based on kinetic warfare models as used on the physical battlefield. As such, these traditional frameworks are referred to herein as linear (and kinetic) because on the physical battlefield, a soldier or group of soldiers may move in a straight line from one geographic location to another, or fire a weapon that moves in that way.

[0014] The Diamond Framework states that anyone (individual, company, or group) is either a victim or an adversary. An adversary can be a victim and a victim can be an adversary. This philosophy is loosely based on Sun Tzu's Art of War. A typical (kinetic / symmetric) attack shows that an adversary uses its own capabilities to reach a victim by exploiting some infrastructure. Using probabilistic models, the Diamond Framework can determine (to some extent) the probability that an adversary will access a victim via a particular attack vector.

[0015] Lockheed Martin's Cyber ​​Kill Chain® specifies a sequence of attack methods. Attack methods include reconnaissance, weaponization, delivery, exploitation, installation, command and control (C&C), and actions on objectives. Reconnaissance refers to a malicious actor monitoring a potential target for an attack. Weaponization may involve using tools on a target system to facilitate an attack. For example, a malicious actor or malware can gain entry to a computer system for malicious purposes by obtaining system credentials that provide login access to the computer system and using them to weaponize the credentials. Delivery and exploitation may include initial access to the target system. Installation refers to copying an executable version of the malware to the target system. The term "command and control" refers to a state in which a malicious actor and / or malware has complete control over a target system. "Intentional execution" attack methods may include actions that malicious actors take upon gaining access, such as stealing or exfiltrating data. Within the security domain of a potential target system, such data may include national security secrets, trade secrets, bank and credit card accounts, personal emails and photos, etc.

[0016] Lockheed Martin's Cyber ​​Kill Chain® includes a subset of the attack methods of the STIX-TAXII framework. Additionally, the STIX-TAXII framework arranges the attack methods in a different order, or sequence. The STIX-TAXII framework can be described as kinetic in terms of attack strategy. The example STIX-TAXII framework below includes a table of attack methods arranged by category. These categories and attack methods are only a subset of the STIX-TAXII framework, which currently includes 433 attack methods but is growing.

[0017] [Table 1]

[0018] The assumption in these types of frameworks is that a malicious actor starts with initial access (A). Once access to the environment is gained, the actor can begin executing (B) some type of malware (i.e., bot, virus, worm, trojan). From there, the actor can move on to persistence (C) and so on through the entire framework. Another assumption in such frameworks is that an adversary starts with some type of exploit and progresses linearly or kinetically down the attack chain. Thus, if a malicious actor is not successful in their first initial access attack method, a drive-by compromise, they may move down the initial access column and then attempt to exploit a public-facing application (app). However, if the drive-by compromise is successful, the malicious actor may move on to the next column in the STIX-TAXII framework by executing an attack method in the execution category.

[0019] One reason these frameworks are useful is that they can determine the probability that a malicious actor may progress to the next step in the kill chain or STIX-TAXII framework. Thus, machine learning models that rely on these frameworks may make classifications based on the expectation that malicious actors are linear thinkers and therefore move consistently from step A to B to C, etc. However, malicious actors (e.g., artificial intelligence malware) may violate this expectation. As such, these frameworks may be less useful in the cyber battlefield, where malicious actors may not move in the linear fashion of a particular framework. For example, artificial intelligence adversaries such as generative adversarial networks and quantum computing-based attackers may randomly progress through the events laid out in the exemplary STIX-TAXII framework.

[0020] Conventional computing has benefited organizations and individuals around the world. However, there are challenges that conventional systems cannot solve in a reasonable time frame. More specifically, problems above a certain size and complexity run out of computational power when using conventional binary computer processors (e.g., a method of calculation that uses bits with values ​​of 0 or 1) to tackle them. One approach to attempting to solve some of these problems entails a relatively new kind of computing: universal quantum computing. A universal quantum computer can harness the quantum mechanical phenomena of superposition and entanglement to create states that grow exponentially with the number of qubits, also referred to herein as quantum mechanical systems and qubits.

[0021] Thus, embodiments of the present invention provide a quantum computing-based machine learning model for identifying possible security threats. The model may be capable of determining multiple probabilities that a malicious actor will transition from one attack category to any one of multiple attack categories. Further, the model may be capable of determining the probability that a malicious actor will transition from one attack method to any one of multiple attack methods.

[0022] For example, a quantum computing-based machine learning model can determine the probability that a malicious actor will move from initial access to execution, persistence, privilege escalation, defense evasion, and credential access after gaining access. Additionally, a quantum computing-based machine learning model can determine the probability that a malicious actor will select each potential attack method within each attack category.

[0023] 1 is a block diagram of an exemplary system 100 for quantum computing-based machine learning models, according to some embodiments of the present invention. The system 100 includes a network 102, a security domain 104, a security threat model 106, a quantum computing device 108, a trusted automated exchange of information, such as a Structured Threat Intelligence - Automated Exchange of Indicator Information (STIX-TAXII) framework 110, and a query engine 112.

[0024] The network 102 may include one or more computer communication networks. Exemplary networks 102 may include the Internet, local area networks (LANs), wide area networks (WANs), wireless networks such as wireless LANs (WLANs), and the like. The network 102 may include copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter cards or network interfaces of each computing / processing device implemented as part of the security domain 104, security threat models 106, quantum computing devices 108, STIX-TAXII framework 110, and query engine 112 may receive messages and / or instructions from and / or over the network 102, for example, and forward messages and / or instructions to respective memories or processors of the respective computing / processing devices for storage or execution (e.g.,). Although network 102 is shown in FIG. 1 as a single entity for purposes of illustration, in other examples, network 102 may include multiple private and / or public networks over which components of system 100 may communicate.

[0025] The security domain 104 can be a computer hardware and software architecture in which the security threat model 106 can identify possible security threats. This computer hardware and software architecture can include personal computing devices, mobile computing devices, desktop and laptop computers, virtual appliances, containers, or any other cloud components. The security domain 104 can include a networked system 114 and a security information and event management platform (SIEM platform 116). The networked system 114 can be one or more computer systems connected to one or more computer communication networks. For example, the networked system 114 can include a server farm. Alternatively or additionally, the networked system 114 can include any number of computer and network nodes and associated hardware and software combinations. The SIEM platform 116 can refer to software tools and / or services that combine security information and malicious attack management.

[0026] The security threat model 106 may be a machine learning model trained to identify possible attacks. The machine learning model may make a classification based on certain characteristics of a state. For example, the machine learning model may classify a digital photograph as containing either a human or an animal subject based on characteristics of the digital photograph. The characteristics of the digital photograph may include the color of each pixel and the configuration of pixels relative to each other. Using these characteristics, the machine learning model may calculate the probability that the digital photograph contains a human or an animal subject. The machine learning model may label the digital photograph with the class that has the higher probability.

[0027] In embodiments of the present invention, the security threat model 106 can learn characteristics of the networked system 114 of the security domain 104. Furthermore, the security threat model 106 can determine probabilities of several candidate attack methods based on the characteristics of the security domain 104 and the networked system 114. More specifically, the security threat model 106 can generate a quantum state probabilities (QSP) matrix 118 that represents the probability of a particular sequence of candidate attack method types that a malicious attacker may execute. In some embodiments, the security threat model 106 can generate the QSP matrix 118 to include one probability for each candidate attack method arranged in the STIX-TAXII framework 110. The security threat model 106 can use the STIX-TAXII framework 110 as a source of candidate attack methods when generating the QSP matrix 118. The following exemplary QSP matrix 1 is an example of a QSP matrix 118.

[0028] [Table 2]

[0029] In this example, row and column headings A-E represent specific states. The states may represent attack categories. Thus, A may represent initial access, B may represent reconnaissance, and so on. Additionally, the row headings of the exemplary matrix 1 may represent the current state of the malicious actor, and the column headings may represent the inferred state of the malicious actor. The inferred state may represent the state that the security threat model 106 is attempting to infer as a possible next action of the malicious actor given the initial state. Thus, each cell of the exemplary QSP matrix 1 may represent a calculated probability that the malicious actor will progress from a particular (current) attack category to another attack category. In some embodiments of the present invention, the probability may be represented as an array of binary values. The array of binary values ​​may include one value for each potential attack method within an attack category. The QSP calculator 120 may set the binary value to 0 if the particular attack method is unlikely and set the value to 1 if the particular attack method is likely. Thus, setting the binary value to 1 may indicate that the likelihood of a particular attack method being performed is greater than the likelihood that it is not. Accordingly, the QSP calculator 120 can use the results of determining the individual likelihood of each attack method in a category to determine the overall likelihood of a malicious actor executing the attack category.

[0030] In the exemplary QSP Matrix 1, the array of binary values ​​includes seven values ​​representing seven different phases of the attack. The "?" can represent an unknown quantum position, and it is also unknown whether the state behind the unknown quantum position will remain the same or not. Furthermore, the "??" means that the probability of going from A to B may be higher than the probability of going from A to C by a given threshold, because this is how linear models run on conventional computers work.

[0031] However, the array can contain more or fewer values. In some embodiments of the invention, the number of values ​​can be increased to 12 to cover the lateral areas of the MITRE ATT&CK framework and overlay those lateral areas (by vectors) on the Bloch sphere. In some embodiments using quantum states, the number of values ​​can be two or four. By expressing the likelihood of potential malicious actor actions, patterns can be made identifiable that allow the security domain 104 to determine response capabilities, target security controls to specific areas, and improve encryption methods accordingly.

[0032] In the example QSP Matrix 1, the cell representing the probability that a malicious actor will move from a category A attack to a category B attack is <1010101> ", indicating that half of the candidate attack methods in the same category are more likely. Furthermore, the QSP calculator 120 may consider these individual possibilities as a whole to determine the likelihood of a particular attack category. Thus, if half of the individual attack methods are more likely, and if they are considered as a whole, the likelihood of the corresponding attack category may also be higher. In this manner, the QSP matrix 118 may represent the likelihood of a malicious actor transitioning from one attack category to another. Furthermore, if a malicious actor transitions to a particular attack category, the QSP matrix 118 may represent the likelihood of the malicious actor using any one of the attack methods in that category.

[0033] The cells representing the probability that a malicious actor will use an attack method of the same category are marked with " <1111111> ", indicating that all potential attack methods in the same category are likely. This may represent a scenario in which the malicious actor simply remains the same. Furthermore, the QSP calculator 120 may consider these individual possibilities as a whole and determine that if all of the individual attack methods are likely, then the corresponding attack category is also likely.

[0034] The generation of the QSP matrix 118 may include the use of a quantum computing device, such as the quantum computing device 108. The quantum computing device 108 may generally be described in comparison to conventional computing devices, which rely on the ability to store and manipulate information in individual bits. A bit is a computer storage unit that stores information as binary 0 and 1 states. In contrast to conventional computing devices, the quantum computing device 108 utilizes quantum mechanical properties to store and manipulate information. More specifically, the quantum computing device 108 uses the quantum mechanical properties of superposition, entanglement, and interference to manipulate the states of qubits. Superposition refers to a combination of states (which in conventional devices are described as independent). The concept of superposition may be similar to the field of music, where playing two notes simultaneously results in a superposition of the two notes. Entanglement is a counterintuitive quantum phenomenon that describes behavior not inherently found in the physical universe. Entanglement refers to the phenomenon of independent particles behaving together as a system.

[0035] Thus, the QSP calculator 120 can utilize the power of quantum computing to calculate multiple probabilities of multiple possible security threats as a linear complexity problem. The QSP calculator 120 can include vector equations, linear algebra tables, and other related mathematical processes to calculate each probability in the QSP matrix 118. This can include the probability that a malicious actor will execute each of a number of candidate attack categories. This probability can be based on the most recent attack category. Furthermore, the QSP calculator 120 can include such mathematical processes to determine the probability that a malicious actor will execute each of a number of candidate attack methods in a specified attack category. In this manner, the QSP calculator 120 can generate the QSP matrix 118.

[0036] In some embodiments of the present invention, the QSP calculator 120 can generate the initial quantum state probability matrix 118 based on historical data from the SIEM platform 116 to examine how malicious actors have performed attacks in the past and a mobile cyber range. A mobile cyber range refers to a simulation of a security domain connected to a simulated Internet environment. The mobile cyber range can provide a safe and lawful environment for security testing. By generating the QSP matrix 118 in this manner, the initial quantum state probability matrix 118 can include an initial table of probabilities, which are based on past events, that can be used to determine the probability that a malicious actor will perform a particular attack category and a corresponding attack method.

[0037] The STIX-TAXII framework 110 can include a STIX database 122 and a TAXII server 124. The term STIX refers to a standardized language for describing information about security threats. Thus, STIX can describe the motivation, capabilities, functions, and responses regarding security threats. STIX can be shared via TAXII or other similar tools. Additionally, the STIX database 122 can include several STIX files describing various security threats. In some embodiments, data from the STIX-TAXII framework 110 can be preloaded into a SIEM engine or machine learning platform and used as the basis for threat intelligence data. With artificial intelligence and machine learning, this can be used as training data. However, without artificial intelligence and machine learning, this can be used as a data set on which a rules engine can be built. So, in the event of an attack by a malicious actor, the data from that actor or hack is compared to the preloaded rule set. With respect to quantum state probabilities, data from the STIX-TAXII framework 110 can be used to set initial vector positions within the Bloch sphere or serve as a data set against which quantum models or devices can be tested.

[0038] The TAXII server 124 can be a tool that defines how information about security threats can be shared through online services and message exchanges. The TAXII server 124 can provide access to the STIX database 122 by providing RESTful API services (not shown) that are compatible with common sharing models. For example, the TAXII server 124 can define four services that can be selected, implemented, and combined into different sharing models.

[0039] The query engine 112 may represent a computer hardware and / or software architecture that may query the security threat model 106 to identify possible candidate attacks. In this manner, embodiments may be able to predict or infer future attacks. Querying the security threat model 106 may identify the likelihood that 1) the attack fits a pattern and therefore is coming from a known malicious actor, 2) the attack fits a pattern based on past similar attacks, or 3) the attack will be followed, or a combination of these.

[0040] FIG. 2 is a diagram of an exemplary Bloch sphere 200, according to some embodiments of the present invention. In quantum mechanics, the Bloch sphere is a geometric representation of the pure state space of a two-level qubit. In this example, the Bloch sphere 200 can represent a universe of potential attack methods by a single malicious actor. Within the Bloch sphere 200, each attack method is represented by a point in three-dimensional space. The exemplary Bloch sphere 200 includes an origin 202 at the center of the Bloch sphere 200. Additionally, the exemplary Bloch sphere 200 includes axes 204 that define the three spatial dimensions.

[0041] The axes 204 represent the three-dimensional space occupied by the Bloch sphere 200. As a tool, the axes 204 provide a multi-dimensional space where the distance between two points on the surface of the sphere corresponds to the likelihood that a malicious actor will perform an attack method of one category and then proceed to perform an attack method of another category. Additionally, the axes define a multi-dimensional space where the distance from the origin 202 to a particular point along a vector representing an attack category corresponds to the likelihood that a malicious actor who has selected a particular category will perform the attack method corresponding to the particular point. Although the exemplary Bloch sphere 200 occupies a three-dimensional space, embodiments of the present invention may use Bloch spheres with more than two dimensions.

[0042] While the number and definitions of the axes may vary, for purposes of this example, the axes represent three dimensions including a time (Z) axis 204-1, a horizontal (X) axis 204-2, and a vertical (Y) axis 204-3. The time axis 204-1 may represent a time at which the attack method occurs. The time at which the attack method occurs may be determined from a source such as the SIEM platform 116. The time axis 204-1, the horizontal axis 204-2, and the vertical axis 204-3 may represent a conventional three-dimensional (x, y, z) space that the QSP calculator 120 may use in combination with location points to represent the attack method within the above three-dimensional space.

[0043] Advantageously, using a sphere instead of a linear model makes it easier to visualize the potential randomness of malicious attacks. For example, Bloch sphere 200 includes vectors 206 that start at origin 202 and end at a point on the surface of Bloch sphere 200. Each vector 206 represents a different attack method category, and in this example includes vectors 206 in the categories of initial access 206-1, privilege escalation 206-2, and exfiltration 206-3. QSP calculator 120 can generate vectors 206 in the Bloch sphere such that the relative position of each vector 206 with respect to the other vectors represents the probability of a malicious actor moving from one attack category to another. Furthermore, in embodiments of the present invention, each attack method can represent a point along the vector. Thus, the distance of each point from origin 202 can represent the probability that a malicious attacker will use a particular attack method if the malicious attacker selects a particular attack category.

[0044] In this manner, the QSP calculator 120 can use the points on the surface of the Bloch sphere 200 to determine the probability 208 that a malicious actor may transition from one attack method category to another. Thus, the probability that a malicious actor may transition from initial access to privilege escalation is represented by the distance, denoted by probability 208, from one point to another in the Bloch sphere 200 between the surface points of the vectors 206 of the initial access 206-1 and privilege escalation 206-2.

[0045] Assume that during an attack, the attack method of the initial access 206-1 involves the malicious actor cracking a password. Rather than trying to identify future attack methods based on kinetic transitions (lateral thinking), the QSP calculator 120 can generate a quantum state probability matrix 118 based on several candidates in the attack chain. Thus, the Bloch sphere 200 provides a way to visualize a sequence of attack methods using a spherical shape. Thus, rather than being limited to a sequence of specific attack methods that occur as a linear two-dimensional line as in the STIX-TAXII framework 110, the Bloch sphere 200 can help visualize unexpected sequences of attack methods. For example, a malicious actor may succeed in performing an initial access attack. However, rather than performing a then execution attack as per the STIX-TAXII framework, the malicious actor may then attempt an exfiltration attack. Thus, the exemplary Bloch sphere 200 provides possible paths from the initial access 206-1 to the exfiltration 206-3, the distance of which represents the mathematical probability of that scenario. As such, QSP calculator 120 can use a Bloch sphere, such as Bloch sphere 200, to input probabilities for QSP matrix 118. In this manner, by determining the distance between each vector 206 representing an attack category, QSP calculator 120 can determine the probability that a malicious actor will transition from one attack category to another. Additionally, once a malicious actor selects a new attack category, QSP calculator 120 can determine the probability that the malicious actor will attempt each attack method in that category by calculating the distance from the origin to the corresponding point along the associated vector 206.

[0046] In this example, Bloch sphere 200 includes three attack categories that represent a typical sequence of attack methods that may include cracking a password to access a system, increasing a malicious actor's access privileges on the attacked system, and exfiltration of data. This sequence may represent a scenario in which a malicious actor may not scan a system's files before exfiltration because they know where the target information is located.

[0047] For clarity, the exemplary Bloch sphere 200 includes three attack categories. However, some embodiments of the present invention may include more than two attack categories. For example, the Bloch sphere 200 may include seven attack categories: reconnaissance, weaponization, delivery, privilege escalation, discovery, command and control, and exfiltration. Thus, if a malicious actor does not follow a traditional linear attack sequence, it may be possible to determine the probability that the malicious actor will, for example, perform a delivery attack method and then perform discovery, or go from privilege escalation back to weaponization, etc. Additionally, historical data may allow the attack sequence trends of a particular malicious actor to be identified. For example, historical data may indicate whether a malicious actor starts with a binary padding or credential dumping attack method, and whether the malicious actor tends to use a lateral movement or credential access attack method.

[0048] 3 is a process flow diagram of a method 300 for a quantum computing machine learning model according to some embodiments of the present invention. A QSP calculator and a security threat model (e.g., QSP calculator 120 and security threat model 106) can perform the method 300.

[0049] In operation 302, the QSP calculator 120 may generate a Bloch sphere based on the SIEM and STIX-TAXII frameworks. The Bloch sphere may be, for example, the Bloch sphere 200. Furthermore, the SIEM and STIX-TAXII frameworks may be the SIEM platform 116 and the STIX-TAXII framework 110, respectively, described with respect to FIG.

[0050] In operation 304, the QSP calculator 120 can generate a QSP matrix for the Bloch sphere 200 using a quantum state device. The QSP matrix can be, for example, the QSP matrix 118. Additionally, the quantum state device can be the quantum computing device 108. In some embodiments, the QSP calculator 120 can simultaneously populate all cells of the QSP matrix using the properties of the quantum computing device 108 described above. With respect to the QSP matrix 118, as previously described, each cell of the QSP matrix 118 can include an array of values ​​that, in combination, represent the probability that a second type of security event will occur after a first type of security event. Additionally, each value in the array can indicate whether or not a particular security event is more likely to occur, assuming that a second type of security event has occurred.

[0051] In operation 306, the security threat model 106 may train a classifier of the security threat model 106 to perform classification of security threats based on the QSP matrix 118. Training the classifier may include generating training data that describes features of possible security threats with labels indicating whether the features represent a security threat or not. The features may include data describing a particular state of the security domain 104, such as Internet Protocol (IP) addresses of possible attackers, actions performed by possible attackers, etc. In some embodiments, the security threat model 106 may select the features of the training data from the SIEM platform 116 and may manually label each training data transaction. In this manner, the classifier of the security threat model 106 may learn to identify possible security threats.

[0052] In operation 308, the security threat model 106 can use the trained classifier to infer security threat events for the security domain 104. Inference refers to the classification process. Thus, the security threat model 106 makes an inference when its classifier determines likely attack categories and attack methods as described above. Thus, the query engine 112 can ask the security threat model 106 to determine candidate attack categories and attack methods that a malicious actor will attempt next. In response, the security threat model 106 can use the quantum state probability matrix 118 to determine which attack categories and methods are relatively more likely than others.

[0053] 4 is a diagram of an example Bloch sphere 400, according to some embodiments of the present invention. The example Bloch sphere 400 may be similar to the example Bloch sphere 200 described with respect to FIG. 2. Accordingly, the example Bloch sphere 400 includes an origin 402, an axis 404, an attack method category 406, and a probability 408. Further, in the example Bloch sphere 400, the attack method 406 includes reconnaissance 406-1, weaponization 406-2, initial access 406-3, privilege escalation 406-4, exploration 406-5, command and control 406-6, and exfiltration 406-7.

[0054] In some embodiments of the present invention, the security threat model 106 can determine the probability that a malicious actor transitions from one attack method 406 to another. For example, the security threat model 106 can determine the probability 408-1 that a malicious actor transitions from reconnaissance 406-1 to weaponization 406-2. Similarly, the security threat model can determine the probability 408-2 that a malicious actor transitions from privilege escalation 406-4 to exploration 406-5. However, such a sequence may reflect the assumption that a single actor is executing a threat and is systematically and rationally moving clockwise around a sphere. This is similar to kinetic warfare. However, the malicious actor may move in random directions and / or try different ways to attack a target.

[0055] For this reason, it is useful to know two things: 1) if an attacker starts with a particular category of attack method, e.g., reconnaissance 406-1 attack method, what is the next likely attack method category, and 2) what is the next likely specific attack method? To determine the next likely category, the security threat model 106 can analyze the QSP matrix 118, which has the probability that the malicious actor will move from reconnaissance 406-1 to, e.g., weaponization 406-2, initial access 406-3, privilege escalation 406-4, exploration 406-5, command and control 406-6, and exfiltration 406-7. To determine the next likely attack method, the security threat model 106 can analyze the probability of each candidate attack method within the next likely category in the QSP matrix 118.

[0056] In some embodiments, the security threat model 106 may use a Markov chain to determine these probabilities. Exemplary Probability Table 1 shows an example of the probability that a malicious actor will transition between different attack methods.

[0057] [Table 3]

[0058] Exemplary Probability Table 1 shows the probability that a malicious actor will transition from each attack method to the other. For example, the probability that a malicious actor will transition from reconnaissance to initial access is at least 0.50 (e.g., 50%), and the probability that a malicious actor will transition from reconnaissance to weaponization is 0.10. This probability is relatively small because the malicious actor has not yet gained access to the environment. Furthermore, the probability that a malicious actor will transition from initial access back to reconnaissance is 0.20. Furthermore, the probability that a malicious actor will transition from initial access to weaponization is at least the same as the malicious actor remaining in initial access. Also, the probability that a malicious actor will remain in weaponization is 0.90 (highly likely) compared to the probability that a malicious actor will suddenly change his mind and step back one step to initial access (0.05) or two steps to reconnaissance (0.05).

[0059] Markov chains can be useful when applied to the past behavior of malicious actors (data about which the security threat model 106 can retrieve with behavioral analytics tools). Additionally, pattern recognition (which we also have data from) is useful for looking at past data, as Markov events require information about the previous event (event 1) to know what will happen next (event 2).

[0060] 5A is a diagram of an exemplary Bloch sphere 500A, according to some embodiments of the present invention. The exemplary Bloch sphere 500A may be similar to the Bloch sphere 400 described with respect to FIG. 4. Accordingly, the exemplary Bloch sphere 500A includes an origin 502, an axis 504, an attack method category 506, and a probability 508, which may be similar to the origin 402, the axis 404, the attack method 406, and the probability 408, respectively, described with respect to FIG. 4. Further, the attack method 506 includes reconnaissance 506-1, weaponization 506-2, initial access 506-3, privilege escalation 506-4, exploration 506-5, command and control 506-6, and exfiltration 506-7.

[0061] Embodiments of the present invention may be useful in identifying two or more attackers collaborating in an attack against a target. Collaboration may include cooperation, collusion, or defecting during an attack, or a combination thereof. Defecting refers to one (or both) of the malicious actors stopping what they are doing and withdrawing from the attack. Defecting only occurs when the malicious actor is human. Defecting cannot occur when the malicious actor is software, a bot, an algorithm, or artificial intelligence.

[0062] Working together, such as through cooperation and collusion, is called game theory. Even though multiple malicious actors may perform attacks together, they may not be working in the same attack category at the same time. For example, one actor may be performing reconnaissance 506-1 while another actor performs privilege escalation 506-4 in the security domain 104 where the malicious actor found credentials.

[0063] Thus, in some embodiments of the present invention, the QSP calculator 120 may generate multiple QSP matrices 118, with each QSP matrix 118 representing a potential action for a respective malicious actor. Additionally, the security threat model 106 may compare the QSP matrices 118 for overlaps. Identified overlaps may indicate multiple malicious actors working together. For example, probability 508-1 may represent the likelihood that a first malicious actor who performed reconnaissance 506-1 will subsequently perform weaponization 506-2. Additionally, probability 508-2 may represent the likelihood that a second malicious actor who performed privilege escalation 506-4 will subsequently perform exploration 506-5. In embodiments of the present invention, the QSP matrices 118 representing the likely attack methods of each of the malicious actors may overlap. The following exemplary game theory table 1 illustrates overlapping probabilities that may indicate a game theory attack by two actors when successful in their goal of installing ransomware.

[0064] [Table 4]

[0065] In a game theory attack, the probability of two different malicious actors using the same attack method may be roughly equal until one of them arrives at a method of weaponization. If one of the malicious actors is caught, the other may be more likely to continue installing ransomware.

[0066] 5B is a diagram of an exemplary Bloch sphere 500B, according to some embodiments of the present invention. The exemplary Bloch sphere 500B may be similar to the Bloch sphere 500A described with respect to FIG. 5A.

[0067] The exemplary Bloch sphere 500B may represent a scenario in which a third malicious actor is collaborating with the first two malicious actors described with respect to FIG. 5A. Thus, in some embodiments of the present invention, the QSP calculator 120 may generate three QSP matrices 118, each representing a potential action for a respective malicious actor. In this manner, the security threat model 106 may determine whether there is an overlap between the three malicious actors. Thus, in addition to the probabilities 508-1, 508-2, the probability 508-3 may represent the likelihood that the third malicious actor who performed the weaponization 506-2 will subsequently perform the initial access 506-3. The security threat model 106 may identify an overlap between the third malicious actor and one or both of the other malicious actors.

[0068] An example of a three-way game theory attack is an insider threat. During an attack involving an insider threat, a third malicious actor provides information useful to access the security domain. Such information may include security credentials in the form of badges, fobs, or sensitive information from current or former employees of the company that uses the security domain 104. The dark web may also be a source of sensitive information such as server names, server locations, root administrator credentials, etc. Alternatively, the third malicious actor may be malware, such as scripts or pre-prepared code.

[0069] Exemplary game theory Table 2 shows the overlapping probability of a three-actor attack succeeding in its goal of installing ransomware.

[0070] [Table 5]

[0071] Exemplary game theory Table 3 shows the overlapping probabilities of another attack by three actors if the objective of installing ransomware fails.

[0072] [Table 6]

[0073] In the example game theory table 3, even during reconnaissance, the probabilities are not evenly distributed. Instead, the probability that malicious actor A monitors social media is 0.50. However, the probability that malicious actors B and C capture external and internal traffic, respectively, may depend on how successful malicious actor A is. With respect to initial access, the analysis may be the same. With respect to weaponization, if malicious actor A is captured without being able to provide any value, and malicious actor B, who has valid credentials to provide, retreats, determining that the risk of being hacked is too high, malicious actor C is likely to fail to install the ransomware.

[0074] Figure 6 is a diagram of an exemplary Bloch sphere 600, in accordance with some embodiments of the present invention. Accordingly, the exemplary Bloch sphere 600 includes an origin 602, an axis 604, an attack method category 606, and a probability 608, which may be similar to the origin 402, the axis 404, the attack method 406, and the probability 408, respectively, described with respect to Figure 4. Additionally, the attack method 606 includes exploit 606-1, reconnaissance 606-2, weaponization 606-3, initial access 606-4, execution 606-5, privilege escalation 606-6, exploration 606-7, command and control 606-8, collection 606-9, exfiltration 606-10, and persistence 606-11.

[0075] The exemplary Bloch sphere 600 may represent an attack by an artificial intelligence malicious actor. An artificial intelligence malicious actor is different from a bot. A bot may be a computer program configured to execute a predefined attack methodology. In contrast, an artificial intelligence malicious actor may be trained to determine a variety of different types of attack methods based on a large number of potential scenarios. The time it takes an artificial intelligence malicious actor to proceed through an attack methodology 606 may be less than 30 seconds depending on the computational power behind the artificial intelligence malicious actor. In some scenarios, an artificial intelligence malicious actor may be trained to find the most relatively effective attack methodology in a shorter time through algorithms and machine learning. In this way, an artificial intelligence malicious actor may not function like a human malicious actor. Because of this, an artificial intelligence malicious actor may proceed around the sphere (i.e., execute the attack methodology categories 606 represented by the exemplary Bloch sphere 600 relatively faster than a human malicious actor). An artificial intelligence malicious actor may also select a different attack methodology 606 to enter than a human actor. Because of this, the entry point of the attack may not include an exploit 606-1, but instead may be a vulnerability, software bug, or malware.

[0076] Thus, in some embodiments of the present invention, the quantum state probability calculator 120 may generate a quantum state probability matrix 118 of the probability of each transition between attack methods 606. For example, an artificial intelligence malicious actor may transition at a faster rate than a human malicious actor. Thus, if an artificial intelligence malicious actor moves relatively quickly through Exploit 606-1, Reconnaissance 606-2, Weaponization 606-3, Initial Access 606-4, Execution 606-5, Privilege Escalation 606-6, Exploration 606-7, Exfiltration 606-10, and Persistence 606-11, the security threat model 106 may identify the malicious actor by comparing the probabilities 608-1 through 608-7.

[0077] In some embodiments, the security threat model 106 can determine what type of actor is attacking the system, i.e., whether the malicious actor is a human or an artificial intelligence system. Additionally, the security threat model 106 can identify malicious actors with advanced skill sets and generate a probability that a particular malicious actor is a particular person within a pool of suspects.

[0078] Additionally, a malicious actor may take advantage of scenarios where a sequence of attack methods may result in an exploit to an entirely different system. For example, an artificial intelligence malicious actor may use exploit 606-1 to infiltrate a security domain (e.g., security domain 104). Once the artificial intelligence malicious actor has a useful set of credentials (e.g., hard-coded usernames and passwords), the credentials may be used to move to other networked systems. In some embodiments of the present invention, the security threat model 106 may generate a Bloch sphere for each networked system 114 of the security domain 104. Additionally, the quantum state probability calculator 120 may generate a quantum state probability matrix 118 that represents the probability that a malicious actor will move from a first networked system to a second networked system as part of an attack.

[0079] 7 is a block diagram of an exemplary security threat model manager 700 according to some embodiments of the present invention. In various embodiments, the security threat model manager 700 is similar to the incident modeler 96 and can perform the method described in FIG. 3 and / or the functions discussed in FIGS. 1, 2, 5, and 6. In some embodiments, the security threat model manager 700 provides instructions for the aforementioned method and / or functions to a client machine, and the client machine performs the method or portions of the method based on the instructions provided by the security threat model manager 700. In some embodiments, the security threat model manager 700 includes software executing on hardware embedded in multiple devices.

[0080] The security threat model manager 700 includes memory 725, storage 730, an interconnect (e.g., a bus) 720, one or more CPUs 705 (also referred to herein as processors 705), an I / O device interface 710, an I / O device 712, and a network interface 715.

[0081] Each CPU 705 retrieves and executes programming instructions stored in memory 725 or storage 730. Interconnect 720 is used to move data, such as programming instructions, between CPU 705, I / O device interface 710, storage 730, network interface 715, and memory 725. Interconnect 720 may be implemented using one or more buses. CPU 705 may be a single CPU, multiple CPUs, or a single CPU with multiple processing cores, in various embodiments. In some embodiments, CPU 705 may be a digital signal processor (DSP). In some embodiments, CPU 705 includes one or more 3D integrated circuits (3DICs) (e.g., 3D wafer level packaging (3DWLP), 3D interposer-based integration, 3D stacked IC (3D-SIC), monolithic 3D IC, 3D heterogeneous integration, 3D system-in-package (3DSiP), or package-on-package (PoP) CPU configurations, or combinations thereof). Memory 725 is included generally to represent random access memory (e.g., static random access memory (SRAM), dynamic random access memory (DRAM), or flash). Storage 730 is included generally to represent non-volatile memory, such as a hard disk drive, a solid state device (SSD), a removable memory card, optical storage, or a flash memory device, or a combination thereof. Additionally, storage 730 may include a storage area network (SAN) device, cloud, or other device connected to security threat model manager 700 via I / O device interface 710 or to network 750 via network interface 715.

[0082] In some embodiments, memory 725 stores instructions 760. However, in various embodiments, instructions 760 are stored partially in memory 725 and partially in storage 730, or entirely in memory 725, or entirely in storage 730, or accessed over network 750 via network interface 715.

[0083] The instructions 760 may be processor-executable instructions for performing any portion or all of the method described in FIG. 3 and / or the functions discussed in FIGS. 1, 2, 5, and 6.

[0084] In various embodiments, I / O device 712 includes an interface capable of presenting information and receiving input. For example, I / O device 712 can present information to, and receive input from, a listener that interacts with security threat model manager 700.

[0085] The security threat model manager 700 is connected to a network 750 via a network interface 715. The network 750 may include physical, wireless, cellular, or different networks.

[0086] In some embodiments, security threat model manager 700 may be a multi-user mainframe computer system, a single-user system, or a server computer or similar device that has little or no direct user interface but receives requests from other computer systems (clients). Further, in some embodiments, security threat model manager 700 may be implemented as a desktop computer, a portable computer, a laptop or notebook computer, a tablet computer, a pocket computer, a telephone, a smart phone, a network switch or router, or any other suitable type of electronic device.

[0087] It should be noted that Figure 7 is intended to depict representative major components of an example security threat model manager 700. However, in some embodiments, the individual components may have greater or lesser complexity than those depicted in Figure 7, there may be other or additional components than those depicted in Figure 7, and the number, type, and configuration of such components may vary.

[0088] Although this disclosure includes detailed descriptions of cloud computing, implementation of the teachings recited herein is not limited to a cloud computing environment. Rather, embodiments of the invention may be implemented in conjunction with any other type of computing environment now known or later developed.

[0089] Cloud computing is a model of service delivery for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal administrative effort or interaction with a service provider. The cloud model can include at least five characteristics, at least three service models, and at least four deployment models.

[0090] Its features are as follows.

[0091] On-Demand Self-Service: Cloud consumers can unilaterally provision computing capacity, such as server time and network storage, automatically as needed, without the need for human interaction with the provider of the service.

[0092] Broad Network Access: Capabilities are available over the network and are accessed through standard mechanisms that facilitate use by heterogeneous thin or thick client platforms (e.g., cell phones, laptops, and PDAs).

[0093] Resource Pooling: Pooling provider computing resources to serve multiple consumers using a multi-tenant model where various physical and virtual resources are dynamically allocated and reallocated according to demand. Consumers generally have no control over or knowledge of the exact location of the resources provided to them, although there is a sense of location independence in that the location may be identifiable at a higher level of abstraction (e.g., country, state, or data center).

[0094] Rapid Elasticity: Capacity can be rapidly and elastically provisioned, sometimes automatically, to quickly scale out and rapidly release to quickly scale in. To the consumer, provisionable capacity often appears to be unlimited and can be purchased in any quantity at any time.

[0095] Metered Services: Cloud systems leverage metering capabilities at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts) to automatically control and optimize resource usage. Resource usage can be monitored, managed, and reported to provide transparency to both providers and consumers of the services utilized.

[0096] The service model is as follows:

[0097] Software as a Service (SaaS): The capability offered to the consumer is to use the provider's applications running on a cloud infrastructure. The applications are accessible from a variety of client devices through thin-client interfaces such as web browsers (e.g., web-based email). The consumer has no management or control over the underlying cloud infrastructure, including networks, servers, operating systems, storage, or even individual application features, with the possible exception of limited user-specific application configuration settings.

[0098] Platform as a Service (PaaS): The capability offered to a consumer is to deploy applications that the consumer creates or acquires, written using programming languages ​​and tools supported by the provider, onto a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but does control the deployed applications and possibly the application hosting environment configuration.

[0099] Infrastructure as a Service (IaaS): The ability offered to consumers is to provision processing, storage, network, and other basic computing resources onto which the consumer can deploy and run any software, which may include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but does control the operating systems, storage, deployed applications, and possibly limited control over selected networking components (e.g., host firewalls).

[0100] The deployment model is as follows:

[0101] Private Cloud: The cloud infrastructure is operated exclusively for an organization. It can be managed by the organization or a third party and can be on-premise or off-premise.

[0102] Community Cloud: The cloud infrastructure is shared by several organizations to support a specific community with common concerns (e.g., mission, security requirements, policies, and compliance considerations). It can be managed by the organization or a third party and can exist on-premise or off-premise.

[0103] Public Cloud: The cloud infrastructure is made available to the general public or large industry organizations and is owned by an organization that sells cloud services.

[0104] Hybrid Cloud: A cloud infrastructure is a composite of two or more clouds (private, community, or public) that remain unique entities but are joined by standardized or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0105] Cloud computing environments are service-oriented with an emphasis on statelessness, low coupling, modularity, and semantic interoperability. At the core of cloud computing is an infrastructure that includes a network of interconnected nodes.

[0106] FIG. 8 is a cloud computing environment 810 according to some embodiments of the present invention. As shown, the cloud computing environment 810 includes one or more cloud computing nodes 800. The cloud computing nodes 800 may perform the method described in FIG. 3 and / or the functions discussed in FIG. 1, FIG. 2, FIG. 5, and FIG. 6. Additionally, the cloud computing nodes 800 may communicate with local computing devices used by cloud consumers, such as, for example, a personal digital assistant (PDA) or mobile phone 800A, a desktop computer 800B, a laptop computer 800C, or an automobile computer system 800N, or combinations thereof. Additionally, the cloud computing nodes 800 may communicate with each other. The cloud computing nodes 800 may also be physically or virtually grouped together in one or more networks, such as, for example, a private, community, public, or hybrid cloud, or combinations thereof, as described above (not shown). This enables the cloud computing environment 810 to provide infrastructure-as-a-service, platform-as-a-service, and / or software-as-a-service services without the need for cloud consumers to maintain resources on local computing devices. It should be understood that the types of computing devices 800A-N illustrated in FIG. 8 are intended to be exemplary only, and that the computing nodes 800 and cloud computing environment 810 can communicate with any type of computerized device over any type of network and / or network addressable connections (e.g., using a web browser).

[0107] Figure 9 is a set of functional abstraction model layers provided by cloud computing environment 810 (Figure 8) according to some embodiments of the present invention. It should be understood in advance that the components, layers, and functions shown in Figure 9 are intended to be exemplary only, and embodiments of the present invention are not limited thereto. As shown below, the following layers and corresponding functions are provided:

[0108] The hardware and software layer 900 includes hardware and software components. Examples of hardware components include a mainframe 902, a RISC (reduced instruction set computing) architecture based server 904, a server 906, a blade server 908, a storage device 910, and a network and networking component 912. In some embodiments, the software components include network application server software 914 and database software 916.

[0109] The virtualization layer 920 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual servers 922, virtual storage 924, virtual networks including virtual private networks 926, virtual applications and operating systems 928, and virtual clients 930.

[0110] In one example, the management layer 940 can provide the following functions: Resource provisioning 942 provides dynamic procurement of computing and other resources utilized to execute tasks within the cloud computing environment. Metering and pricing 944 provides cost tracking as resources are utilized within the cloud computing environment and billing or invoicing for the consumption of these resources. In one example, these resources can include application software licenses. Security provides identity verification of cloud consumers and tasks as well as protection for data and other resources. User portal 946 provides consumers and system administrators with access to the cloud computing environment. Service level management 948 provides allocation and management of cloud computing resources such that requested service levels are met. Service level management 948 can allocate adequate processing power and memory to process static sensor data. Service level agreement (SLA) planning and fulfillment 950 provides pre-arrangement and procurement of cloud computing resources anticipated to be required in the future according to SLAs.

[0111] The workload layer 960 provides examples of functionality that can utilize a cloud computing environment. Examples of workloads and functions that can be provided from this layer include mapping and navigation 962, software development and lifecycle management 964, virtual classroom instructional delivery 966, data analytics processing 968, transaction processing 970, and a security threat model manager 972.

[0112] The present invention may be a system, method, or computer program product, or combination thereof, at any possible level of technical detail integration. The computer program product may include a computer-readable storage medium (or media) having computer-readable program instructions thereon for causing a processor to carry out aspects of the present invention.

[0113] A computer readable storage medium may be any tangible device capable of holding and storing instructions for use by an instruction execution device. A computer readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. A non-exhaustive list of more specific examples of computer readable storage media includes portable computer diskettes, hard disks, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanically encoded devices such as punch cards or groove ridge structures having instructions recorded thereon, and any suitable combination thereof. A computer-readable storage medium, as used herein, should not be construed to be a transitory signal per se, such as, for example, radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through a fiber optic cable), or electrical signals transmitted over wires.

[0114] The computer readable program instructions described herein may be downloaded from a computer readable storage medium to the respective computing / processing device or to an external computer or storage device over a network, such as, for example, the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may include copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface of each computing / processing device receives the computer readable program instructions from the network and transfers the computer readable program instructions for storage in a computer readable storage medium within the respective computing / processing device.

[0115] The computer readable program instructions for carrying out the operations of the present invention may be either assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state setting data, configuration data for an integrated circuit, or source or object code written in any combination of one or more programming languages, including object oriented programming languages ​​such as Smalltalk®, C++, and procedural programming languages ​​such as the “C” programming language or similar programming languages. The computer readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or wide area network (WAN), or a connection may be made to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be personalized by utilizing state information of the computer readable program instructions to execute the computer readable program instructions to perform aspects of the present invention.

[0116] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer readable program instructions.

[0117] These computer readable program instructions may be provided to a processor of a computer or other programmable data processing apparatus to produce a machine such that the instructions, executed by the processor of the computer or other programmable data processing apparatus, generate means for implementing the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams. These computer readable program instructions may also be stored on a computer readable storage medium such that the computer readable storage medium on which the instructions are stored constitutes an article of manufacture including instructions that implement aspects of the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams, and can direct a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular manner.

[0118] Furthermore, the computer-readable program instructions may be loaded into a computer, other programmable data processing apparatus, or other device to generate a computer-implemented process and cause the computer, other programmable apparatus, or other device to perform a series of operational steps, such that the instructions, which execute on the computer, other programmable apparatus, or other device, implement the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams.

[0119] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, vector, or part of an instruction, including one or more executable instructions for implementing the specified logical functions. In some alternative implementations, the functions described in the blocks may occur out of the order shown. For example, depending on the functionality involved, two blocks shown in succession may in fact be realized as one step, may be executed simultaneously, substantially simultaneously, partially or completely overlapping in time, or the blocks may be executed in reverse order, if necessary. It will also be noted that each block in the block diagrams and / or flowchart illustrations, and combinations of blocks in the block diagrams and / or flowchart illustrations, may be implemented by a dedicated hardware-based system that performs the specified functions or operations or executes a combination of dedicated hardware and computer instructions.

[0120] To illustrate some aspects of the present invention, a list of non-limiting examples is provided below. Example 1 is a computer-implemented method for a security model. The method includes generating a Bloch sphere based on a system information and event management (SIEM) of a security domain and a Structured Threat Information Description Format-Automated Exchange of Indicator Information (STIX-TAXII), generating a quantum state probability matrix based on the Bloch sphere, training a security threat model to perform a classification of security threats based on the quantum state probability matrix, and performing a machine learning classification of the security domain based on the quantum state probability matrix.

[0121] Example 2 includes the method of Example 1, with or without optional features. In this example, the method includes determining that the malicious actor will perform a particular attack category based on the previous attack categories and the quantum state probability matrix. Optionally, the method includes determining that the malicious actor will perform a particular attack method of the particular attack category based on the particular attack category and the quantum state probability matrix.

[0122] Example 3 includes the method of any one of Examples 1-2, including or excluding optional features. In this example, the method includes determining that a plurality of malicious actors are performing game theory attacks. Optionally, determining that the malicious actors are performing game theory attacks includes generating a plurality of quantum state probability matrices for transitions between a plurality of pairs of attack categories and determining that a plurality of probabilities overlap between two or more of the plurality of quantum state probability matrices.

[0123] Example 4 includes the method of any one of Examples 1-3, including or excluding optional features. In this example, the quantum state probability matrix includes a plurality of probabilities, the plurality of probabilities representing the likelihood of a malicious actor transitioning between all possible combinations of attack categories and the likelihood of the malicious actor using a particular attack method of all attack categories based on a previous attack category. Optionally, the likelihood of the malicious actor transitioning between combinations of attack categories includes a plurality of likelihoods of the malicious actor performing a plurality of particular attack methods of a particular attack category.

[0124] Example 5 includes the method of any one of Examples 1-4, with or without optional features. In this example, the Bloch sphere includes an origin and three axes representing three-dimensional space, one of the three axes representing time over which the attack method is performed.

[0125] Example 6 is a computer program product including program instructions stored on a computer-readable storage medium that directs a processor to generate a Bloch sphere based on a System Information and Event Management (SIEM) and a Structured Threat Intelligence - Automated Exchange of Indicator Information (STIX-TAXII) of a security domain, generate a quantum state probability matrix based on the Bloch sphere, train a security threat model to perform a classification of security threats based on the quantum state probability matrix, and perform a machine learning classification of the security domain based on the quantum state probability matrix.

[0126] Example 7 includes the computer-readable medium of Example 6, including or excluding optional features. In this example, the computer-readable medium includes determining that the malicious actor will perform a particular attack category based on the previous attack categories and the quantum state probability matrix. Optionally, the computer-readable medium includes determining that the malicious actor will perform a particular attack methodology of the particular attack category based on the particular attack categories and the quantum state probability matrix.

[0127] Example 8 includes the computer-readable medium of any one of Examples 6-7, including or excluding optional features. In this example, the computer-readable medium includes determining that a plurality of malicious actors are performing game theory attacks. Optionally, determining that the malicious actors are performing game theory attacks includes generating a plurality of quantum state probability matrices for transitions between a plurality of pairs of attack categories and determining that a plurality of probabilities overlap between two or more of the plurality of quantum state probability matrices.

[0128] Example 9 includes the computer-readable medium of any one of Examples 6-8, including or excluding optional features. In this example, the quantum state probability matrix includes a plurality of probabilities, the plurality of probabilities representing the likelihood of a malicious actor transitioning between all possible combinations of attack categories and the likelihood of the malicious actor using a particular attack method of all attack categories based on a previous attack category. Optionally, the likelihood of a malicious actor transitioning between combinations of attack categories includes a plurality of possibilities of a malicious actor performing a plurality of particular attack methods of a particular attack category.

[0129] Example 10 includes the computer-readable medium of any one of Examples 6-9, including or excluding optional features. In this example, the Bloch sphere includes an origin and three axes representing a three-dimensional space, one of the three axes representing a time over which the attack method is performed.

[0130] Example 11 is a system including a computer processing circuit and a computer readable storage medium storing instructions configured, when executed by the computer processing circuit, to cause the computer processing circuit to perform a method, the method including generating a Bloch sphere based on a System Information and Event Management (SIEM) of a security domain and a Structured Threat Intelligence Description Format-Automated Exchange of Indicator Information (STIX-TAXII) of a security domain, generating a quantum state probability matrix based on the Bloch sphere, training a security threat model to perform a classification of security threats based on the quantum state probability matrix, and performing a machine learning classification of the security domain based on the quantum state probability matrix.

[0131] Example 12 includes the system of Example 11, including or excluding optional features. In this example, the system includes determining that a malicious actor will perform a particular attack category based on the previous attack categories and the quantum state probability matrix, and determining that a malicious actor will perform a particular attack method of the particular attack category based on the particular attack category and the quantum state probability matrix.

[0132] Example 13 includes the system of any one of Examples 11-12, including or excluding optional features. In this example, the system includes determining that a plurality of malicious actors are performing game theory attacks, where determining that the malicious actors are performing game theory attacks includes generating a plurality of quantum state probability matrices for transitions between a plurality of pairs of attack categories and determining that a plurality of probabilities overlap between two or more of the plurality of quantum state probability matrices.

[0133] Example 14 includes the system of any one of Examples 11-13, including or excluding optional features. In this example, the quantum state probability matrix includes a plurality of probabilities, the plurality of probabilities representing the likelihood of a malicious actor transitioning between all possible combinations of attack categories and the likelihood of the malicious actor using a particular attack method of all attack categories based on a previous attack category. Optionally, the likelihood of a malicious actor transitioning between combinations of attack categories includes a plurality of possibilities of a malicious actor performing a plurality of particular attack methods of a particular attack category.

[0134] Example 15 includes the system of any one of Examples 11-14, including or excluding optional features. In this example, the Bloch sphere includes an origin and three axes representing a three-dimensional space, one of the three axes representing a time over which the attack method is performed.

[0135] Example 16 is a computer-implemented method for a security model, the method including instructions to direct a processor to generate a Bloch sphere based on a system information and event management (SIEM) and a Structured Threat Information Description Format-Automated Exchange of Indicator Information (STIX-TAXII) for a security domain, generate a quantum state probability matrix based on the Bloch sphere, and train a security threat model to perform a security threat classification based on the quantum state probability matrix, where the security threat classification infers a next attack category for the security domain based on a previous attack category.

[0136] Example 17 includes the method of example 16, with or without the optional feature. In this example, the method includes performing machine learning classification of the security domain based on the quantum state probability matrix.

[0137] Example 18 is a computer-implemented method for a security model, the method including instructions to direct a processor to generate a Bloch sphere based on a system information and event management (SIEM) and a Structured Threat Information Description Format-Automated Exchange of Indicator Information (STIX-TAXII) for a security domain, generate a quantum state probability matrix based on the Bloch sphere, the quantum state probability matrix including a plurality of probabilities representing a likelihood of a malicious actor transitioning between all possible combinations of attack categories and a likelihood of the malicious actor using a particular attack method among all attack categories based on a previous attack category, and train a security threat model to perform a security threat classification based on the quantum state probability matrix, the security threat classification inferring a next attack category for the security domain based on the previous attack category.

[0138] In a preferred embodiment of the present invention as described above, a computer-implemented method for a security model is provided, the computer-implemented method comprising: generating a Bloch sphere based on a system information and event management (SIEM) and a Structured Threat Information Description Format-Automatic Exchange of Indicator Information (STIX-TAXII) of a security domain; generating a quantum state probability matrix based on the Bloch sphere; and training a security threat model to perform a security threat classification based on the quantum state probability matrix, the security threat classification inferring a next attack category for the security domain based on a previous attack category. Preferably, the method further comprises performing a security threat classification of the security domain based on the quantum state probability matrix. In a preferred embodiment of the present invention as described above, a computer-implemented method is provided for a security model, the computer-implemented method including: generating a Bloch sphere based on a System Information and Event Management (SIEM) of a security domain and a Structured Threat Information Description Format-Automated Exchange of Indicator Information (STIX-TAXII) of the security domain; generating a quantum state probability matrix based on the Bloch sphere, the quantum state probability matrix including a plurality of probabilities representing a likelihood of a malicious actor transitioning between all possible combinations of attack categories and a likelihood of the malicious actor using a particular attack method among all attack categories based on a previous attack category; and training a security threat model to perform security threat classification based on the quantum state probability matrix, the security threat classification inferring a next attack category for the security domain based on the previous attack category.

Claims

1. 1. A computer-implemented method for a security model, comprising: Based on a system information and event management (SIEM) of a security domain and a Structured Threat Intelligence Description Format-Automatic Exchange of Indicator Information (STIX-TAXII), generating a Bloch sphere by expressing the attack methods obtained from the STIX-TAXII as points in a multi-dimensional space including a time axis using the time at which the attack methods occur, which is determined from the SIEM; generating a quantum state probability matrix based on the Bloch sphere; training a security threat model to perform a security threat classification based on the quantum state probability matrix; performing a machine learning classification of the security domain based on the quantum state probability matrix; 4. A computer-implemented method comprising:

2. Performing the machine learning classification comprises: determining, based on a first attack category of a plurality of attack categories obtained from the STIX-TAXII and the quantum state probability matrix, that a malicious actor performs a second attack category of the plurality of attack categories; and the point representing the attack method is a point along a vector that extends from an origin of the multi-dimensional space to a point on a surface of the Bloch sphere and represents an attack category in which the attack method falls.

3. Performing the machine learning classification comprises: determining, based on the second attack category and the quantum state probability matrix, that the malicious actor will perform a particular attack methodology included in the second attack category; The method of claim 2 , comprising:

4. Performing the machine learning classification comprises: Determining that multiple malicious actors are conducting game theory attacks The method of claim 1 , comprising:

5. Determining that the malicious actor is conducting the game theory attack includes: determining that a plurality of quantum state probability matrices for transitions between a plurality of pairs of attack categories obtained from the STIX-TAXII are generated in generating the quantum state probability matrices, and that a plurality of probabilities overlap between two or more of the plurality of quantum state probability matrices; The method of claim 4 , comprising:

6. The quantum state probability matrix includes a plurality of probabilities, the plurality of probabilities being: The likelihood that a malicious actor will transition between all possible combinations of attack categories derived from the STIX-TAX II; and a likelihood that the malicious actor will use a particular attack method included in a second attack category among all of the attack categories based on a first attack category among all of the attack categories; The method of claim 1 , wherein

7. 7. The method of claim 6, wherein the likelihood that the malicious actor will transition between combinations of the attack categories includes multiple likelihoods that the malicious actor will execute multiple specific attack methods included in the second attack category.

8. The Bloch sphere is The origin and Three axes representing a three-dimensional space, one of the three axes being a time axis representing a time when the attack method is executed; The method of claim 1 , comprising:

9. The processor: Based on a system information and event management (SIEM) of a security domain and a Structured Threat Intelligence Description Format-Automatic Exchange of Indicator Information (STIX-TAXII), generating a Bloch sphere by expressing the attack methods obtained from the STIX-TAXII as points in a multi-dimensional space including a time axis using the time at which the attack methods occur, which is determined from the SIEM; generating a quantum state probability matrix based on the Bloch sphere; training a security threat model to perform a security threat classification based on the quantum state probability matrix; performing a machine learning classification of the security domain based on the quantum state probability matrix; A computer program for executing the above.

10. 1. A system comprising: A computer processing circuit; and a computer-readable storage medium storing instructions configured, when executed by the computer processing circuit, to cause the computer processing circuit to perform a method, the method comprising: Based on a system information and event management (SIEM) of a security domain and a Structured Threat Intelligence Description Format-Automatic Exchange of Indicator Information (STIX-TAXII), generating a Bloch sphere by expressing the attack methods obtained from the STIX-TAXII as points in a multi-dimensional space including a time axis using the time at which the attack methods occur, which is determined from the SIEM; generating a quantum state probability matrix based on the Bloch sphere; training a security threat model to perform a security threat classification based on the quantum state probability matrix; performing a machine learning classification of the security domain based on the quantum state probability matrix; Including, the system.

Images