Method, system, and computer program product for artificial intelligence assisted cybersecurity threat modeling tool

Abstract

Methods, systems, and computer program products are provided for artificial intelligence assisted cybersecurity threat modeling tool that may include receiving data associated with a security architecture document for a specific software environment, converting the data associated with the security architecture document from a natural language format to a threat modeling data format, generating a plurality of vector embeddings based on the threat modeling data, identifying one or more potential cybersecurity threats based on the plurality of vector embeddings, and mapping the one or more potential cybersecurity threats to one or more corresponding controls that provide a potential mitigation action for the one or more potential cybersecurity threats.

Description

METHOD, SYSTEM, AND COMPUTER PROGRAM PRODUCT FOR ARTIFICIAL INTELLIGENCE ASSISTED CYBERSECURITY THREAT MODELING TOOLCROSS REFERENCE TO RELATED APPLICATION

[0001] The present application claims the benefit of United States Provisional Patent Application No. 63 / 550,076, filed on February 6, 2024, the disclosure of which is hereby incorporated by reference in its entirety.BACKGROUND1 . Technical Field

[0002] This disclosure relates generally to cybersecurity threat modeling and, in non-limiting embodiments or aspects, to methods, systems, and computer program products for artificial intelligence assisted cybersecurity threat modeling.2. Technical Considerations

[0003] Threat modeling may refer to a process by which potential cybersecurity threats, such as structural vulnerabilities or the absence of appropriate safeguards, can be identified and enumerated and countermeasures prioritized. In some instances, the purpose of threat modeling is to provide with a systematic analysis of what security controls and / or defenses need to be included, given the nature of a computer system, a probable attacker's profile, the most likely attack vectors, and / or the assets most desired by an attacker. Threat modeling is one of the activities performed during a security review, and payment card industry (PCI) standards recommend threat modeling as a way to identify threats early in the design of a computer system.

[0004] However, many aspects of threat modeling tools are currently manual processes, and many current threat modeling tools are highly generic and do not provide information regarding the latest cybersecurity threats. Different threat modeling tools may work on similar principles, which is to enumerate through a list of threats as a default without considering the context of the application. Additionally, some threat modeling tools require users to spend a large amount of time generating diagrams that are needed to produce and use a threat model (e.g., during a reduction analysis phase).SUMMARY

[0005] Accordingly, provided are improved methods, systems, and computer program products for artificial intelligence assisted cybersecurity threat modeling.

[0006] According to non-limiting embodiments or aspects, provided is a computer- implemented method for artificial intelligence assisted cybersecurity threat modeling. In some non-limiting embodiments or aspects, the computer-implemented method may include receiving data associated with a security architecture document for a specific software environment. In some non-limiting embodiments or aspects, the computer-implemented method may include converting the data associated with the security architecture document from a natural language format to a threat modeling data format using a large language model (LLM) to provide threat modeling data. In some non-limiting embodiments or aspects, the threat modeling data format is structured according to a relationship between a subject and an object. In some nonlimiting embodiments or aspects, the subject and the object are data elements included in the data associated with the security architecture document. In some nonlimiting embodiments or aspects, the computer-implemented method may include generating a plurality of vector embeddings based on the threat modeling data using the LLM. In some non-limiting embodiments or aspects, the computer-implemented method may include identifying one or more potential cybersecurity threats based on the plurality of vector embeddings. In some non-limiting embodiments or aspects, the computer-implemented method may include mapping the one or more potential cybersecurity threats to one or more corresponding controls that provide a potential mitigation action for the one or more potential cybersecurity threats.

[0007] In some non-limiting embodiments or aspects, the computer-implemented method may further include generating a visual representation of a software architecture model using a machine learning model based on the threat modeling data based on converting the data associated with the security architecture document from a natural language format to a threat modeling data format. In some non-limiting embodiments or aspects, the computer-implemented method may further include providing the visual representation of the software architecture model to a user device. In some non-limiting embodiments or aspects, the computer-implemented method may further include receiving an indication of approval from the user device. In some non-limiting embodiments or aspects, generating the plurality of vector embeddingsmay include generating the plurality of vector embeddings based on receiving the indication of approval from the user device.

[0008] In some non-limiting embodiments or aspects, the threat modeling data format may be a JSON format, and the threat modeling data format may be structured according to: a relationship between a subject and an object of a plurality of subjects and objects included in a security architecture document; a trust boundary that includes a boundary that distinguishes between differing defined levels of trust in a security architecture document; and a software application of the specific software environment.

[0009] In some non-limiting embodiments or aspects, the computer-implemented method may further include generating a list that includes the one or more potential cybersecurity threats and the one or more corresponding controls that provide a potential mitigation action for the one or more potential cybersecurity threats. In some non-limiting embodiments or aspects, the computer-implemented method may further include converting the list from a first data format to a second data format to provide natural language threat modeling data using the LLM. In some non-limiting embodiments or aspects, the second data format may include a natural language format. In some non-limiting embodiments or aspects, the computer-implemented method may further include generating a comprehensive threat modeling report based on the natural language threat modeling data.

[0010] In some non-limiting embodiments or aspects, converting the data associated with the security architecture document from a natural language format to a threat modeling data format to provide threat modeling data may include performing a reduction analysis via functional processing calls provided to the LLM.

[0011] In some non-limiting embodiments or aspects, the threat modeling data may include data associated with each category of relationship between a subject and an object of a plurality of categories of relationships. In some non-limiting embodiments or aspects, converting the data associated with the security architecture document from a natural language format to a threat modeling data format to provide threat modeling data may include chunking the data associated with the security architecture document based on each category of relationship between a subject and an object of the plurality of categories of relationships to provide a plurality of chunks of threat modeling data. In some non-limiting embodiments or aspects, each chunk of the plurality of chunks of threat modeling data may be based on a specified category of arelationship between a subject and an object. In some non-limiting embodiments or aspects, generating the plurality of vector embeddings may include converting each chunk of the plurality of chunks of threat modeling data to a vector string using the LLM.

[0012] In some non-limiting embodiments or aspects, identifying the one or more potential cybersecurity threats may include comparing each of the plurality of vector embeddings to known vector embeddings associated with the one or more potential cybersecurity threats and identifying the one or more potential cybersecurity threats that are within a threshold distance of a vector embedding of the plurality of vector embeddings according to a measure of cosine similarity.

[0013] According to non-limiting embodiments or aspects, provided is a system for artificial intelligence assisted cybersecurity threat modeling. In some non-limiting embodiments or aspects, the system may include at least one processor configured to receive data associated with a security architecture document for a specific software environment. In some non-limiting embodiments or aspects, the at least one processor may be configured to convert the data associated with the security architecture document from a natural language format to a threat modeling data format using a large language model (LLM) to provide threat modeling data. In some non-limiting embodiments or aspects, the threat modeling data format may be structured according to a relationship between a subject and an object. In some non-limiting embodiments or aspects, the subject and the object may be data elements included in the data associated with the security architecture document. In some non-limiting embodiments or aspects, the at least one processor may be configured to generate a plurality of vector embeddings based on the threat modeling data using the LLM. In some nonlimiting embodiments or aspects, the at least one processor may be configured to identify one or more potential cybersecurity threats based on the plurality of vector embeddings. In some non-limiting embodiments or aspects, the at least one processor may be configured to map the one or more potential cybersecurity threats to one or more corresponding controls that provide a potential mitigation action for the one or more potential cybersecurity threats.

[0014] In some non-limiting embodiments or aspects, the at least one processor may be further configured to generate a visual representation of a software architecture model using a machine generate a visual representation of a software architecture model using a machine learning model based on the threat modeling databased on converting the data associated with the security architecture document from a natural language format to a threat modeling data format. In some non-limiting embodiments or aspects, the at least one processor may be further configured to provide the visual representation of the software architecture model to a user device. In some non-limiting embodiments or aspects, the at least one processor may be further configured to receive an indication of approval from the user device. In some non-limiting embodiments or aspects, when generating the plurality of vector embeddings, the at least one processor may be configured to generate the plurality of vector embeddings based on receiving the indication of approval from the user device.

[0015] In some non-limiting embodiments or aspects, the threat modeling data format may be a JSON format, and the threat modeling data format may be structured according to: a relationship between a subject and an object of a plurality of subjects and objects included in a security architecture document; a trust boundary that includes a boundary that distinguishes between differing defined levels of trust in a security architecture document; and a software application of the specific software environment.

[0016] In some non-limiting embodiments or aspects, the at least one processor may be further configured to generate a list that includes the one or more potential cybersecurity threats and the one or more corresponding controls that provide a potential mitigation action for the one or more potential cybersecurity threats. In some non-limiting embodiments or aspects, the at least one processor may be further configured to convert the list from a first data format to a second data format to provide natural language threat modeling data using the LLM. In some non-limiting embodiments or aspects, the second data format may include a natural language format. In some non-limiting embodiments or aspects, the at least one processor may be further configured to generate a comprehensive threat modeling report based on the natural language threat modeling data.

[0017] In some non-limiting embodiments or aspects, when converting the data associated with the security architecture document from a natural language format to a threat modeling data format to provide threat modeling data, the at least one processor may be configured to perform a reduction analysis via functional processing calls provided to the LLM.

[0018] In some non-limiting embodiments or aspects, the threat modeling data may include data associated with each category of relationship between a subject and anobject of a plurality of categories of relationships. In some non-limiting embodiments or aspects, when converting the data associated with the security architecture document from a natural language format to a threat modeling data format to provide the threat modeling data, the at least one processor may be configured to chunk the data associated with the security architecture document based on each category of relationship between a subject and an object of the plurality of categories of relationships to provide a plurality of chunks of threat modeling data. In some nonlimiting embodiments or aspects, each chunk of the plurality of chunks of threat modeling data may be based on a specified category of a relationship between a subject and an object. In some non-limiting embodiments or aspects, when generating the plurality of vector embeddings, the at least one processor may be configured to convert each chunk of the plurality of chunks of threat modeling data to a vector string using the LLM.

[0019] In some non-limiting embodiments or aspects, when identifying the one or more potential cybersecurity threats, the at least one processor may be configured to compare each of the plurality of vector embeddings to known vector embeddings associated with the one or more potential cybersecurity threats and identify the one or more potential cybersecurity threats that are within a threshold distance of a vector embedding of the plurality of vector embeddings according to a measure of cosine similarity.

[0020] According to non-limiting embodiments or aspects, provided is a computer program product for artificial intelligence assisted cybersecurity threat modeling. In some non-limiting embodiments or aspects, the computer program product may include at least one non-transitory computer-readable medium including program instructions that, when executed by at least one processor, cause the at least one processor to receive data associated with a security architecture document for a specific software environment. In some non-limiting embodiments or aspects, the program instructions may further cause the at least one processor to convert the data associated with the security architecture document from a natural language format to a threat modeling data format using a large language model (LLM) to provide threat modeling data. In some non-limiting embodiments or aspects, the threat modeling data format may be structured according to a relationship between a subject and an object. In some non-limiting embodiments or aspects, the subject and the object may be data elements included in the data associated with the security architecture document. Insome non-limiting embodiments or aspects, the program instructions may further cause the at least one processor to generate a plurality of vector embeddings based on the threat modeling data using the LLM. In some non-limiting embodiments or aspects, the program instructions may further cause the at least one processor to identify one or more potential cybersecurity threats based on the plurality of vector embeddings. In some non-limiting embodiments or aspects, the program instructions may further cause the at least one processor to map the one or more potential cybersecurity threats to one or more corresponding controls that provide a potential mitigation action for the one or more potential cybersecurity threats.

[0021] In some non-limiting embodiments or aspects, the program instructions may further cause the at least one processor to generate a visual representation of a software architecture model using a machine learning model based on the threat modeling data based on converting the data associated with the security architecture document from a natural language format to a threat modeling data format. In some non-limiting embodiments or aspects, the program instructions may further cause the at least one processor to provide the visual representation of the software architecture model to a user device; and receive an indication of approval from the user device. In some non-limiting embodiments or aspects, the instructions that cause the at least one processor to generate the plurality of vector embeddings, may cause the at least processor to generate the plurality of vector embeddings based on receiving the indication of approval from the user device.

[0022] In some non-limiting embodiments or aspects, the threat modeling data format may be a JSON format, and the threat modeling data format may be structured according to: a relationship between a subject and an object of a plurality of subjects and objects included in a security architecture document; a trust boundary that includes a boundary that distinguishes between differing defined levels of trust in a security architecture document; and a software application of the specific software environment.

[0023] In some non-limiting embodiments or aspects, the program instructions may further cause the at least one processor to generate a list that includes the one or more potential cybersecurity threats and the one or more corresponding controls that provide a potential mitigation action for the one or more potential cybersecurity threats. In some non-limiting embodiments or aspects, the program instructions may further cause the at least one processor to convert the list from a first data format to a seconddata format to provide natural language threat modeling data using the LLM. In some non-limiting embodiments or aspects, the second data format includes a natural language format. In some non-limiting embodiments or aspects, the program instructions may further cause the at least one processor to generate a comprehensive threat modeling report based on the natural language threat modeling data.

[0024] In some non-limiting embodiments or aspects, the instructions that cause the at least one processor to convert the data associated with the security architecture document from a natural language format to a threat modeling data format to provide threat modeling data, may cause the at least one processor to perform a reduction analysis via functional processing calls provided to the LLM.

[0025] In some non-limiting embodiments or aspects, the threat modeling data may include data associated with each category of relationship between a subject and an object of a plurality of categories of relationships. In some non-limiting embodiments or aspects, the instructions that cause the at least one processor to convert the data associated with the security architecture document from a natural language format to a threat modeling data format to provide the threat modeling data, may cause the at least one processor to chunk the data associated with the security architecture document based on each category of relationship between a subject and an object of the plurality of categories of relationships to provide a plurality of chunks of threat modeling data. In some non-limiting embodiments or aspects, each chunk of the plurality of chunks of threat modeling data is based on a specified category of a relationship between a subject and an object. In some non-limiting embodiments or aspects, the instructions that cause the at least one processor to generate the plurality of vector embeddings, cause the at least one processor to convert each chunk of the plurality of chunks of threat modeling data to a vector string using the LLM.

[0026] In some non-limiting embodiments or aspects, the instructions that cause the at least one processor to identify the one or more potential cybersecurity threats, may cause the at least one processor to compare each of the plurality of vector embeddings to known vector embeddings associated with the one or more potential cybersecurity threats and identify the one or more potential cybersecurity threats that are within a threshold distance of a vector embedding of the plurality of vector embeddings according to a measure of cosine similarity.

[0027] Further non-limiting embodiments or aspects will be set forth in the following numbered clauses:

[0028] Clause 1 : A computer-implemented method for artificial intelligence assisted cybersecurity threat modeling, comprising: receiving, with at least one processor, data associated with a security architecture document for a specific software environment; converting, with at least one processor, the data associated with the security architecture document from a natural language format to a threat modeling data format using a large language model (LLM) to provide threat modeling data, wherein the threat modeling data format is structured according to a relationship between a subject and an object, and wherein the subject and the object are data elements included in the data associated with the security architecture document; generating, with at least one processor, a plurality of vector embeddings based on the threat modeling data using the LLM; identifying, with at least one processor, one or more potential cybersecurity threats based on the plurality of vector embeddings; and mapping, with at least one processor, the one or more potential cybersecurity threats to one or more corresponding controls that provide a potential mitigation action for the one or more potential cybersecurity threats.

[0029] Clause 2: The computer-implemented method of clause 1 , further comprising: generating a visual representation of a software architecture model using a machine learning model based on the threat modeling data based on converting the data associated with the security architecture document from a natural language format to a threat modeling data format; providing the visual representation of the software architecture model to a user device; receiving an indication of approval from the user device; wherein generating the plurality of vector embeddings comprises: generating the plurality of vector embeddings based on receiving the indication of approval from the user device.

[0030] Clause 3: The computer-implemented method of clause 1 or 2, wherein the threat modeling data format is a JSON format, and the threat modeling data format is structured according to: a relationship between a subject and an object of a plurality of subjects and objects included in a security architecture document; a trust boundary that includes a boundary that distinguishes between differing defined levels of trust in a security architecture document; and a software application of the specific software environment.

[0031] Clause 4: The computer-implemented method of any of clauses 1 -3, further comprising: generating a list that includes the one or more potential cybersecurity threats and the one or more corresponding controls that provide a potential mitigationaction for the one or more potential cybersecurity threats; converting the list from a first data format to a second data format to provide natural language threat modeling data using the LLM, wherein the second data format includes a natural language format; and generating a comprehensive threat modeling report based on the natural language threat modeling data.

[0032] Clause 5: The computer-implemented method of any of clauses 1 -4, wherein converting the data associated with the security architecture document from a natural language format to a threat modeling data format to provide threat modeling data comprises: performing a reduction analysis via functional processing calls provided to the LLM.

[0033] Clause 6: The computer-implemented method of any of clauses 1 -5, wherein the threat modeling data comprises data associated with each category of relationship between a subject and an object of a plurality of categories of relationships, and wherein converting the data associated with the security architecture document from a natural language format to a threat modeling data format to provide threat modeling data comprises: chunking the data associated with the security architecture document based on each category of relationship between a subject and an object of the plurality of categories of relationships to provide a plurality of chunks of threat modeling data, wherein each chunk of the plurality of chunks of threat modeling data is based on a specified category of a relationship between a subject and an object; wherein generating the plurality of vector embeddings comprises: converting each chunk of the plurality of chunks of threat modeling data to a vector string using the LLM.

[0034] Clause 7: The computer-implemented method of any of clauses 1 -6, wherein identifying the one or more potential cybersecurity threats comprises: comparing each of the plurality of vector embeddings to known vector embeddings associated with the one or more potential cybersecurity threats; and identifying the one or more potential cybersecurity threats that are within a threshold distance of a vector embedding of the plurality of vector embeddings according to a measure of cosine similarity.

[0035] Clause 8: A system for artificial intelligence assisted cybersecurity threat modeling comprising: at least one processor configured to: receive data associated with a security architecture document for a specific software environment; convert the data associated with the security architecture document from a natural languageformat to a threat modeling data format using a large language model (LLM) to provide threat modeling data, wherein the threat modeling data format is structured according to a relationship between a subject and an object, and wherein the subject and the object are data elements included in the data associated with the security architecture document; generate a plurality of vector embeddings based on the threat modeling data using the LLM; identify one or more potential cybersecurity threats based on the plurality of vector embeddings; and map the one or more potential cybersecurity threats to one or more corresponding controls that provide a potential mitigation action for the one or more potential cybersecurity threats.

[0036] Clause 9: The system of clause 8, wherein the at least one processor is further configured to: generate a visual representation of a software architecture model using a machine generate a visual representation of a software architecture model using a machine learning model based on the threat modeling data based on converting the data associated with the security architecture document from a natural language format to a threat modeling data format; provide the visual representation of the software architecture model to a user device; and receive an indication of approval from the user device; wherein, when generating the plurality of vector embeddings, the at least one processor is configured to: generate the plurality of vector embeddings based on receiving the indication of approval from the user device.

[0037] Clause 10: The system of clause 8 or 9, wherein the threat modeling data format is a JSON format, and the threat modeling data format is structured according to: a relationship between a subject and an object of a plurality of subjects and objects included in a security architecture document; a trust boundary that includes a boundary that distinguishes between differing defined levels of trust in a security architecture document; and a software application of the specific software environment.

[0038] Clause 1 1 : The system of any of clauses 8-10, wherein the at least one processor is further configured to: generate a list that includes the one or more potential cybersecurity threats and the one or more corresponding controls that provide a potential mitigation action for the one or more potential cybersecurity threats; convert the list from a first data format to a second data format to provide natural language threat modeling data using the LLM, wherein the second data format includes a natural language format; and generate a comprehensive threat modeling report based on the natural language threat modeling data.

[0039] Clause 12: The system of any of clauses 8-1 1 , wherein, when converting the data associated with the security architecture document from a natural language format to a threat modeling data format to provide threat modeling data, the at least one processor is configured to: perform a reduction analysis via functional processing calls provided to the LLM.

[0040] Clause 13: The system of any of clauses 8-12, wherein the threat modeling data comprises data associated with each category of relationship between a subject and an object of a plurality of categories of relationships, and wherein, when converting the data associated with the security architecture document from a natural language format to a threat modeling data format to provide the threat modeling data, the at least one processor is configured to: chunk the data associated with the security architecture document based on each category of relationship between a subject and an object of the plurality of categories of relationships to provide a plurality of chunks of threat modeling data, wherein each chunk of the plurality of chunks of threat modeling data is based on a specified category of a relationship between a subject and an object; wherein, when generating the plurality of vector embeddings, the at least one processor is configured to: convert each chunk of the plurality of chunks of threat modeling data to a vector string using the LLM.

[0041] Clause 14: The system of any of clauses 8-13, wherein, when identifying the one or more potential cybersecurity threats, the at least one processor is configured to: compare each of the plurality of vector embeddings to known vector embeddings associated with the one or more potential cybersecurity threats; and identify the one or more potential cybersecurity threats that are within a threshold distance of a vector embedding of the plurality of vector embeddings according to a measure of cosine similarity.

[0042] Clause 15: A computer program product, comprising at least one non- transitory computer-readable medium including program instructions that, when executed by at least one processor, cause the at least one processor to: receive data associated with a security architecture document for a specific software environment; convert the data associated with the security architecture document from a natural language format to a threat modeling data format using a large language model (LLM) to provide threat modeling data, wherein the threat modeling data format is structured according to a relationship between a subject and an object, and wherein the subject and the object are data elements included in the data associated with the securityarchitecture document; generate a plurality of vector embeddings based on the threat modeling data using the LLM; identify one or more potential cybersecurity threats based on the plurality of vector embeddings; and map the one or more potential cybersecurity threats to one or more corresponding controls that provide a potential mitigation action for the one or more potential cybersecurity threats.

[0043] Clause 16: The computer program product of clause 15, wherein the instructions further cause the at least one processor to: generate a visual representation of a software architecture model using a machine learning model based on the threat modeling data based on converting the data associated with the security architecture document from a natural language format to a threat modeling data format; provide the visual representation of the software architecture model to a user device; and receive an indication of approval from the user device; wherein, the instructions that cause the at least one processor to generate the plurality of vector embeddings, cause the at least processor to: generate the plurality of vector embeddings based on receiving the indication of approval from the user device.

[0044] Clause 17: The computer program product of clause 15 or 16, wherein the threat modeling data format is a JSON format, and the threat modeling data format is structured according to: a relationship between a subject and an object of a plurality of subjects and objects included in a security architecture document; a trust boundary that includes a boundary that distinguishes between differing defined levels of trust in a security architecture document; and a software application of the specific software environment.

[0045] Clause 18: The computer program product of any of clauses 15-17, wherein the instructions further cause the at least one processor to: generate a list that includes the one or more potential cybersecurity threats and the one or more corresponding controls that provide a potential mitigation action for the one or more potential cybersecurity threats; convert the list from a first data format to a second data format to provide natural language threat modeling data using the LLM, wherein the second data format includes a natural language format; and generate a comprehensive threat modeling report based on the natural language threat modeling data.

[0046] Clause 19: The computer program product of any of clauses 15-18, wherein, the instructions that cause the at least one processor to convert the data associated with the security architecture document from a natural language format to a threatmodeling data format to provide threat modeling data, cause the at least one processor to: perform a reduction analysis via functional processing calls provided to the LLM.

[0047] Clause 20: The computer program product of any of clauses 15-19, wherein the threat modeling data comprises data associated with each category of relationship between a subject and an object of a plurality of categories of relationships, and wherein, the instructions that cause the at least one processor to convert the data associated with the security architecture document from a natural language format to a threat modeling data format to provide the threat modeling data, cause the at least one processor to: chunk the data associated with the security architecture document based on each category of relationship between a subject and an object of the plurality of categories of relationships to provide a plurality of chunks of threat modeling data, wherein each chunk of the plurality of chunks of threat modeling data is based on a specified category of a relationship between a subject and an object; wherein, the instructions that cause the at least one processor to generate the plurality of vector embeddings, cause the at least one processor to: convert each chunk of the plurality of chunks of threat modeling data to a vector string using the LLM.

[0048] Clause 21 : The computer program product of any of clauses 15-20, wherein, the instructions that cause the at least one processor to identify the one or more potential cybersecurity threats, cause the at least one processor to: compare each of the plurality of vector embeddings to known vector embeddings associated with the one or more potential cybersecurity threats; and identify the one or more potential cybersecurity threats that are within a threshold distance of a vector embedding of the plurality of vector embeddings according to a measure of cosine similarity.

[0049] These and other features and characteristics of the present disclosure, as well as the methods of operation and functions of the related elements of structures and the combination of parts and economies of manufacture, will become more apparent upon consideration of the following description and the appended claims with reference to the accompanying drawings, all of which form a part of this specification, wherein like reference numerals designate corresponding parts in the various figures. It is to be expressly understood, however, that the drawings are for the purpose of illustration and description only and are not intended as a definition of the limits of the disclosed subject matter.BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Additional advantages and details are explained in greater detail below with reference to the non-limiting, exemplary embodiments that are illustrated in the accompanying schematic figures, in which:

[0051] FIG. 1 is a schematic diagram of a system for artificial intelligence assisted cybersecurity threat modeling, according to some non-limiting embodiments or aspects;

[0052] FIG. 2 is a flow diagram for a process for artificial intelligence assisted cybersecurity threat modeling, according to some non-limiting embodiments or aspects;

[0053] FIGS. 3A-3I are schematic diagrams of exemplary implementations of a method and / or system of a process for artificial intelligence assisted cybersecurity threat modeling, according to some non-limiting embodiments or aspects;

[0054] FIG. 4 is a diagram of an exemplary implementation of an environment for artificial intelligence assisted cybersecurity threat modeling, according to some nonlimiting embodiments or aspects;

[0055] FIGS. 5A and 5B are diagrams of an exemplary implementation of a method and / or system of a process for artificial intelligence assisted cybersecurity threat modeling, according to some non-limiting embodiments or aspects;

[0056] FIG. 6 is a diagram of an exemplary environment in which methods, systems, and / or computer program products, described herein, may be implemented, according to some non-limiting embodiments or aspects; and

[0057] FIG. 7 is a schematic diagram of example components of one or more devices of FIG. 1 and / or FIG. 6, according to some non-limiting embodiments or aspects.DETAILED DESCRIPTION

[0058] For purposes of the description hereinafter, the terms “end,” “upper,” “lower,” “right,” “left,” “vertical,” “horizontal,” “top,” “bottom,” “lateral,” “longitudinal,” and derivatives thereof shall relate to the embodiments as they are oriented in the drawing figures. However, it is to be understood that the embodiments may assume various alternative variations and step sequences, except where expressly specified to the contrary. It is also to be understood that the specific devices and processes illustrated in the attached drawings, and described in the following specification, are simplyexemplary embodiments or aspects of the disclosed subject matter. Hence, specific dimensions and other physical characteristics related to the embodiments or aspects disclosed herein are not to be considered as limiting.

[0059] Some non-limiting embodiments or aspects are described herein in connection with thresholds. As used herein, satisfying a threshold may refer to a value being greater than the threshold, more than the threshold, higher than the threshold, greater than or equal to the threshold, less than the threshold, fewer than the threshold, lower than the threshold, less than or equal to the threshold, equal to the threshold, etc.

[0060] No aspect, component, element, structure, act, step, function, instruction, and / or the like used herein should be construed as critical or essential unless explicitly described as such. Also, as used herein, the articles “a” and “an” are intended to include one or more items and may be used interchangeably with “one or more” and “at least one.” Furthermore, as used herein, the term “set” is intended to include one or more items (e.g., related items, unrelated items, a combination of related and unrelated items, and / or the like) and may be used interchangeably with “one or more” or “at least one.” Where only one item is intended, the term “one” or similar language is used. Also, as used herein, the terms “has,” “have,” “having,” or the like are intended to be open-ended terms. Further, the phrase “based on” is intended to mean “based at least partially on” unless explicitly stated otherwise. In addition, reference to an action being “based on” a condition may refer to the action being “in response to” the condition. For example, the phrases “based on” and “in response to” may, in some non-limiting embodiments or aspects, refer to a condition for automatically triggering an action (e.g., a specific operation of an electronic device, such as a computing device, a processor, and / or the like).

[0061] As used herein, the term “acquirer institution” may refer to an entity licensed and / or approved by a transaction service provider to originate transactions (e.g., payment transactions) using a payment device associated with the transaction service provider. The transactions the acquirer institution may originate may include payment transactions (e.g., purchases, original credit transactions (OCTs), account funding transactions (AFTs), and / or the like). In some non-limiting embodiments or aspects, an acquirer institution may be a financial institution, such as a bank. As used herein, the term “acquirer system” may refer to one or more computing devices operated byor on behalf of an acquirer institution, such as a server computer executing one or more software applications.

[0062] As used herein, the term “account identifier” may include one or more primary account numbers (PANs), tokens, or other identifiers associated with a customer account. The term “token” may refer to an identifier that is used as a substitute or replacement identifier for an original account identifier, such as a PAN. Account identifiers may be alphanumeric or any combination of characters and / or symbols. Tokens may be associated with a PAN or other original account identifier in one or more data structures (e.g., one or more databases, and / or the like) such that they may be used to conduct a transaction without directly using the original account identifier. In some examples, an original account identifier, such as a PAN, may be associated with a plurality of tokens for different individuals or purposes.

[0063] As used herein, the term “communication” may refer to the reception, receipt, transmission, transfer, provision, and / or the like of data (e.g., information, signals, messages, instructions, commands, and / or the like). For one unit (e.g., a device, a system, a component of a device or system, combinations thereof, and / or the like) to be in communication with another unit means that the one unit is able to directly or indirectly receive information from and / or transmit information to the other unit. This may refer to a direct or indirect connection (e.g., a direct communication connection, an indirect communication connection, and / or the like) that is wired and / or wireless in nature. Additionally, two units may be in communication with each other even though the information transmitted may be modified, processed, relayed, and / or routed between the first and second unit. For example, a first unit may be in communication with a second unit even though the first unit passively receives information and does not actively transmit information to the second unit. As another example, a first unit may be in communication with a second unit if at least one intermediary unit processes information received from the first unit and communicates the processed information to the second unit. In some non-limiting embodiments or aspects, a message may refer to a network packet (e.g., a data packet and / or the like) that includes data. It will be appreciated that numerous other arrangements are possible.

[0064] As used herein, the term “computing device” may refer to one or more electronic devices configured to process data. A computing device may, in some examples, include the necessary components to receive, process, and output data,such as a processor, a display, a memory, an input device, a network interface, and / or the like. A computing device may be a mobile device. As an example, a mobile device may include a cellular phone (e.g., a smartphone or standard cellular phone), a portable computer, a wearable device (e.g., watches, glasses, lenses, clothing, and / or the like), a personal digital assistant (PDA), and / or other like devices. A computing device may also be a desktop computer or other form of non-mobile computer.

[0065] As used herein, the term “server” may refer to or include one or more computing devices that are operated by or facilitate communication and processing for multiple parties in a network environment, such as the Internet, although it will be appreciated that communication may be facilitated over one or more public or private network environments and that various other arrangements are possible. Further, multiple computing devices (e.g., servers, point-of-sale (POS) devices, mobile devices, etc.) directly or indirectly communicating in the network environment may constitute a “system.”

[0066] As used herein, the term “system” may refer to one or more computing devices or combinations of computing devices and / or components of such (e.g., processors, servers, client devices, software applications, and / or the like). Reference to “a device,” “a server,” “a processor,” and / or the like, as used herein, may refer to a previously-recited device, server, or processor that is recited as performing a previous step or function, a different device, server, or processor, and / or a combination of devices, servers, and / or processors. For example, as used in the specification and the claims, a first device, a first server, or a first processor that is recited as performing a first step or a first function may refer to the same or different device, server, or processor recited as performing a second step or a second function.

[0067] As used herein, the term “issuer institution” may refer to one or more entities, such as a bank, that provide accounts to customers for conducting transactions (e.g., payment transactions), such as initiating credit and / or debit payments. For example, an issuer institution may provide an account identifier, such as a PAN, to a customer that uniquely identifies one or more accounts associated with that customer. The account identifier may be embodied on a portable financial device, such as a physical financial instrument, e.g., a payment card, and / or may be electronic and used for electronic payments. The term “issuer system” refers to one or more computer devices operated by or on behalf of an issuer institution, such as a servercomputer executing one or more software applications. For example, an issuer system may include one or more authorization servers for authorizing a transaction.

[0068] As used herein, the term “merchant” may refer to an individual or entity that provides goods and / or services, or access to goods and / or services, to customers based on a transaction, such as a payment transaction. The term “merchant” or “merchant system” may also refer to one or more computer systems operated by or on behalf of a merchant, such as a server computer executing one or more software applications.

[0069] As used herein, a “point-of-sale (POS) device” may refer to one or more devices, which may be used by a merchant to conduct a transaction (e.g., a payment transaction) and / or process a transaction. For example, a POS device may include one or more client devices. Additionally or alternatively, a POS device may include peripheral devices, card readers, scanning devices (e.g., code scanners), Bluetooth® communication receivers, near-field communication (NFC) receivers, radio frequency identification (RFID) receivers, and / or other contactless transceivers or receivers, contact-based receivers, payment terminals, and / or the like. As used herein, a “point- of-sale (POS) system” may refer to one or more client devices and / or peripheral devices used by a merchant to conduct a transaction. For example, a POS system may include one or more POS devices and / or other like devices that may be used to conduct a payment transaction. In some non-limiting embodiments or aspects, a POS system (e.g., a merchant POS system) may include one or more server computers configured to process online payment transactions through webpages, mobile applications, and / or the like.

[0070] As used herein, the term “transaction service provider” may refer to an entity that receives transaction authorization requests from merchants or other entities and provides guarantees of payment, in some cases through an agreement between the transaction service provider and an issuer institution. For example, a transaction service provider may include a payment network such as Visa® or any other entity that processes transactions. The term “transaction processing system” may refer to one or more computer systems operated by or on behalf of a transaction service provider, such as a transaction processing server executing one or more software applications. A transaction processing server may include one or more processors and, in some non-limiting embodiments or aspects, may be operated by or on behalf of a transaction service provider.

[0071] Non-limiting embodiments or aspects of the disclosed subject matter are directed to methods, systems, and computer program products for artificial intelligence assisted cybersecurity threat modeling tool that provide advantages over existing threat modeling systems. The disclosed subject matter provides for converting data associated with a security architecture document from a natural language format to a threat modeling data format and allows additional contextual information specific to a subject to be effectively analyzed by a machine learning model for identifying threats and mitigation actions.

[0072] Additionally, the disclosed subject matter provides for comparing a plurality of vector embeddings based on the threat modeling data with vector embeddings based on source threats, such as CIS, MITRE, and OWASP and allows a machine learning model to effectively analyze contextual threat information regarding subject. In some non-limiting embodiments or aspects, the disclosed subject matter provides for generating the plurality of vector embeddings based on receiving the indication of approval from the user device. In some non-limiting embodiments or aspects, the disclosed subject matter provides for structuring the threat modeling data format according to a relationship between a subject and an object of a plurality of subjects and objects included in a security architecture document, a trust boundary that includes a boundary that distinguishes between differing defined levels of trust in a security architecture document, and a software application of the specific software environment.

[0073] In some non-limiting embodiments or aspects, the disclosed subject matter provides for converting the list from a first data format to a second data format to provide natural language threat modeling data using a large language model (LLM), wherein the second data format includes a natural language format and generates a comprehensive threat modeling report based on the natural language threat modeling data. In some non-limiting embodiments or aspects, the disclosed subject matter provides for performing a reduction analysis via functional processing calls provided to an LLM. In some non-limiting embodiments or aspects, the disclosed subject matter provides for chunking the data associated with the security architecture document based on each category of relationship between a subject and an object of the plurality of categories of relationships to provide a plurality of chunks of threat modeling data, wherein each chunk of the plurality of chunks of threat modeling data is based on a specified category of a relationship between a subject and an object. In some non-limiting embodiments or aspects, the disclosed subject matter provides for comparing each of the plurality of vector embeddings to known vector embeddings associated with the one or more potential cybersecurity threats and identifying the one or more potential cybersecurity threats that are within a threshold distance of a vector embedding of the plurality of vector embeddings, according to a measure of cosine similarity.

[0074] In this way, the disclosed subject matter may provide for threat modeling tailored to a computer system that removes inaccuracies produced by manual processes. Additionally, the disclosed subject matter may provide for the generation of contextual threat modeling diagrams that may be used during threat model procedures. Also, the disclosed subject matter is unique and unconventional.

[0075] Referring now to FIG. 1 , shown is example system 100 for artificial intelligence assisted cybersecurity threat modeling, according to some non-limiting embodiments or aspects. For example, system 100 may include artificial intelligence (Al) threat modeling system 102, machine learning (ML) model management database 104, user device 106, and / or communication network 108.

[0076] Al threat modeling system 102 may include one or more devices capable of receiving information from and / or communicating information to ML model management database 104 and / or user device 106 (e.g., directly via wired or wireless communication connection, indirectly via communication network 108, and / or the like). For example, Al threat modeling system 102 may include a computing device, such as a server, a group of servers, a desktop computer, a portable computer, a mobile device, and / or other like devices. In some non-limiting embodiments or aspects, Al threat modeling system 102 may be in communication with a data storage device (e.g., ML model management database 104), which may be local or remote to Al threat modeling system 102. In some non-limiting embodiments or aspects, Al threat modeling system 102 may be capable of receiving information from, storing information in, communicating information to, or searching information stored in the data storage device (e.g., ML model management database 104).

[0077] ML model management database 104 may include one or more devices capable of receiving information from and / or communicating information to Al threat modeling system 102 and / or user device 106 (e.g., directly via wired or wireless communication connection, indirectly via communication network 108, and / or the like). For example, ML model management database 104 may include a computing device,such as a server, a group of servers, a desktop computer, a portable computer, a mobile device, and / or other like devices. In some non-limiting embodiments or aspects, ML model management database 104 may include a data storage device. In some non-limiting embodiments or aspects, ML model management database 104 may be capable of receiving information from, storing information in, communicating information to, or searching information stored in the data storage device. In some non-limiting embodiments or aspects, ML model management database 104 may be part of Al threat modeling system 102 and / or part of the same system as Al threat modeling system 102.

[0078] User device 106 may include one or more devices capable of receiving information from and / or communicating information to Al threat modeling system 102 and / or ML model management database 104 (e.g., directly via wired or wireless communication connection, indirectly via communication network 108, and / or the like). For example, user device 106 may include a computing device, such as a mobile device, a portable computer, a desktop computer, and / or other like devices. Additionally or alternatively, each user device 106 may include a device capable of receiving information from and / or communicating information to other user devices 106 (e.g., directly via wired or wireless communication connection, indirectly via communication network 108, and / or the like). In some non-limiting embodiments or aspects, user device 106 may be part of Al threat modeling system 102 and / or part of the same system as Al threat modeling system 102. For example, Al threat modeling system 102, ML model management database 104, and user device 106 may all be (and / or be part of) a single system and / or a single computing device.

[0079] Communication network 108 may include one or more wired and / or wireless networks. For example, communication network 108 may include a cellular network (e.g., a long-term evolution (LTE®) network, a third generation (3G) network, a fourth generation (4G) network, a fifth generation (5G) network, a code division multiple access (CDMA) network, and / or the like), a public land mobile network (PLMN), a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a telephone network (e.g., the public switched telephone network (PSTN)), a private network (e.g., a private network associated with a transaction service provider), an ad hoc network, an intranet, the Internet, a fiber optic-based network, a cloud computing network, and / or the like, and / or a combination of these or other types of networks.

[0080] The number and arrangement of systems and devices shown in FIG. 1 are provided as an example. There may be additional systems and / or devices, fewer systems and / or devices, different systems and / or devices, and / or differently arranged systems and / or devices than those shown in FIG. 1. Furthermore, two or more systems or devices shown in FIG. 1 may be implemented within a single system or device, or a single system or device shown in FIG. 1 may be implemented as multiple, distributed systems or devices. Additionally or alternatively, a set of systems (e.g., one or more systems) or a set of devices (e.g., one or more devices) of system 100 may perform one or more functions described as being performed by another set of systems or another set of devices of system 100.

[0081] Referring now to FIG. 2, shown is a flow diagram for process 200 for threat modeling, according to some non-limiting embodiments or aspects. The steps shown in FIG. 2 are for example purposes only. It will be appreciated that additional, fewer, different, and / or different order of steps may be used in non-limiting embodiments or aspects. In some non-limiting embodiments or aspects, a step may be automatically performed in response to performance and / or completion of a prior step. In some nonlimiting embodiments or aspects, one or more of the steps of process 200 may be performed (e.g., completely, partially, and / or the like) by Al threat modeling system 102 (e.g., at least one computing device of Al threat modeling system 102). In some non-limiting embodiments or aspects, one or more of the steps of process 200 may be performed (e.g., completely, partially, and / or the like) by another system, another device, another group of systems, or another group of devices, separate from or including Al threat modeling system 102, such as ML model management database 104, user device 106, and / or the like.

[0082] As shown in FIG. 2, at step 202, process 200 may include receiving data associated with security architecture for a specific software environment. For example, Al threat modeling system 102 may receive data associated with security architecture for a specific software environment. In some non-limiting embodiments or aspects, a user may input data associated with security architecture for a specific software environment into user device 106. In some non-limiting embodiments or aspects, user device 106 may transmit data associated with security architecture for a specific software environment to Al threat modeling system 102.

[0083] As shown in FIG. 2, at step 204, process 200 may include converting the data associated with the security architecture from a natural language format to athreat modeling data format. For example, Al threat modeling system 102 may convert the data associated with the security architecture from a natural language format to a threat modeling data format. In some non-limiting embodiments or aspects, Al threat modeling system 102 may convert the data associated with the security architecture from a natural language format to a threat modeling data format in response to receiving data associated with architecture for a specific software environment from user device 106.

[0084] In some non-limiting embodiments or aspects, the threat modeling data format may be a JSON format. In some non-limiting embodiments or aspects, the threat modeling data format may be structured according to a relationship between a subject and an object. In some non-limiting embodiments or aspects, the subject and the object may be data elements included in the data associated with the security architecture document. In some non-limiting embodiments or aspects, the threat modeling data format may be structured according to a relationship between a subject and an object of a plurality of subjects and objects included in a security architecture document. In some non-limiting embodiments or aspects, threat modeling data may comprise data associated with each category of relationship between a subject and an object of a plurality of categories of relationships. In some non-limiting embodiments or aspects, the threat modeling data format may be structured according to a trust boundary that includes a boundary that distinguishes between differing defined levels of trust in a security architecture document. In some non-limiting embodiments or aspects, the threat modeling data format may be structured according to a software application of the specific software environment.

[0085] In some non-limiting embodiments or aspects, converting the data associated with the security architecture document from a natural language format to a threat modeling data format to provide threat modeling data may include performing a reduction analysis via functional processing calls provided to a large language model (LLM). Al threat modeling system 102 may include the LLM. In some non-limiting embodiments or aspects, the LLM may be used to convert user input into necessary computer understandable outputs to interact with different components or data. In some non-limiting embodiments or aspects, the LLM may be used to convert computer understandable inputs to natural language format output. In some non-limiting embodiments or aspects, converting the data associated with the security architecture document from a natural language format to a threat modeling data format to providethreat modeling data may include chunking the data associated with the security architecture document based on each category of relationship between a subject and an object of the plurality of categories of relationships to provide a plurality of chunks of threat modeling data. In some non-limiting embodiments or aspects, each chunk of the plurality of chunks of threat modeling data may be based on a specific category of relationship between a subject and an object.

[0086] Al threat modeling system 102 may generate a visual representation of a software architecture model using a machine learning model based on the threat modeling data based on converting the data associated with the security architecture document from a natural language format to a threat modeling data format. In some non-limiting embodiments or aspects, Al threat modeling system 102 may provide the visual representation of the software architecture model to user device 106. In some non-limiting embodiments or aspects, user device 106 may display the visual representation of the software architecture model for a user to view. In some nonlimiting embodiments or aspects, Al threat modeling system 102 may provide a request for approval of the software architecture model to user device 106. In some non-limiting embodiments or aspects, user device 106 may approve the software architecture model on user device 106. In some non-limiting embodiments or aspects, user device 106 may transmit an indication of approval of the software architecture model to Al threat modeling system 102. In some non-limiting embodiments or aspects, ML model management database 104 may provide Al threat modeling system 102 designs or prompts for Al threat modeling system 102 to generate a visual representation of a software architecture.

[0087] As shown in FIG. 2, at step 206, process 200 may include generating a plurality of vector embeddings. For example, Al threat modeling system 102 may generate a plurality of vector embeddings. In some non-limiting embodiments or aspects, Al threat modeling system 102 may generate a plurality of vector embeddings based on receiving the indication of approval from user device 106. In some nonlimiting embodiments or aspects, Al threat modeling system 102 may generate the plurality of vector strings based on the threat modeling data using the LLM. In some non-limiting embodiments or aspects, Al threat modeling system 102 may generate the plurality of vector embeddings by converting each chunk of the plurality of chunks of threat modeling data to a vector string using the LLM. In some non-limiting embodiments or aspects, Al threat modeling system 102 may transmit the plurality ofvector embeddings to ML model management database 104. In some non-limiting embodiments or aspects, ML model management database 104 may store the plurality of vector embeddings.

[0088] As shown in FIG. 2, at step 208, process 200 may include identifying potential security threats. For example, Al threat modeling system 102 may identify potential security threats. In some non-limiting embodiments or aspects, Al threat modeling system 102 may identify one or more potential cybersecurity threats based on the plurality of vector embeddings. In some non-limiting embodiments or aspects, Al threat modeling system 102 may identity one or more potential cybersecurity threats by comparing each of the plurality of vectors to known vector embeddings associated with the one or more potential cybersecurity threats. In some non-limiting embodiments or aspects, known vector embeddings associated with the one or more potential cybersecurity threats may be stored in ML model management database 104. In some non-limiting embodiments or aspects, ML model management database 104 may include a vector database having a plurality of vector embeddings. In some nonlimiting embodiments or aspects, the vector database may include open source threats, such as CIS, MITRE, and OWASP. Identifying the one or more potential cybersecurity threats may include identifying the one or more cybersecurity threats that are within a threshold distance of a vector embedding of the plurality of vector embeddings, according to a measure of cosine similarity. In some non-limiting embodiments or aspects, the one or more potential threats may be associated with one or more relationships between a subject and an object of a plurality of subjects and objects included in a security architecture document. In some non-limiting embodiments or aspects, Al threat modeling system 102 may receive known vector embeddings associated with the one or more potential cybersecurity threats from ML model management database 104. In some non-limiting embodiments or aspects, Al threat modeling system 102 may identify potential security threats in response to receiving known vector embeddings associated with the one or more potential cybersecurity threats from ML model management database 104.

[0089] As shown in FIG. 2, at step 210, process 200 may include mapping the potential cybersecurity threats to corresponding controls that provide a potential mitigation action. For example, Al threat modeling system 102 may map the potential cybersecurity threats to corresponding controls that provide a potential mitigation action. In some non-limiting embodiments or aspects, Al threat modeling system 102may map the one or more potential cybersecurity threats to one or more corresponding controls that provide a potential mitigation action for the one or more potential cybersecurity threats.

[0090] In some non-limiting embodiments or aspects, Al threat modeling system 102 may generate a list that includes the one or more potential cybersecurity threats and the one or more corresponding controls that provide a potential mitigation action for the one or more potential cybersecurity threats. In some non-limiting embodiments or aspects, Al threat modeling system 102 may convert the list from a first data format to a second data format to provide natural language threat modeling data. In some non-limiting embodiments or aspects, an LLM of Al threat modeling system 102 may convert the list from a first data format to a second data format to provide natural language threat modeling data. The second data format may include a natural language format. In some non-limiting embodiments or aspects, Al threat modeling system 102 may generate a comprehensive threat modeling report based on the natural language threat modeling data. In some non-limiting embodiments or aspects, Al threat modeling system 102 may transmit the comprehensive threat modeling report to user device 106.

[0091] Referring now to FIGS. 3A-3I, shown are schematic diagrams of exemplary implementations of a method and / or system for process 300 for artificial intelligence assisted cybersecurity threat modeling, according to some non-limiting embodiments or aspects.

[0092] As shown by reference number 302 in FIG. 3A, Al threat modeling system 102 may generate known vector embeddings. For example, Al threat modeling system 102 may generate graph 326 including known vector embeddings 324, based on a plurality of known open-source cybersecurity threats, such as center for internet security (CIS) threats, MITRE adversarial tactics, techniques, common knowledge (ATT&CK) threats, OWSAP threats, etc. In some non-limiting embodiments or aspects, Al threat modeling system 102 may store known vector embeddings 324 in a memory of Al threat modeling system 102, ML model management database 104, and / or user device 106.

[0093] As shown by reference number 304 in FIG. 3B, Al threat modeling system 102 may receive data associated with a security architecture document. For example, Al threat modeling system 102 may receive data associated with a security architecture document input by a user from user device 106. In some non-limitingembodiments or aspects, the data associated with a security architecture document may include a plurality of data elements. The security architecture document may be for a specific software environment. The data may be formatted according to a natural language data format.

[0094] In some non-limiting embodiments or aspects, Al threat modeling system 102 may include one or more machine learning models. For example, Al threat modeling system 102 may include LLM 318 (shown in FIGS. 30 and 3E). Al threat modeling system 102 may generate (e.g., train, re-train, and / or implement) the one or more machine learning models. For example, Al threat modeling system 102 may generate (e.g., train, re-train, and / or implement) LLM 318. In some non-limiting embodiments or aspects, Al threat modeling system 102 may train LLM 318 to perform a task.

[0095] As shown by reference number 306 in FIG. 30, Al threat modeling system 102 may convert the data associated with the security architecture from a natural language format to a threat modeling data format. For example, LLM 318 may convert the data associated with the security architecture from the natural language format to a threat modeling data format to provide threat modeling data 316. Threat modeling data 316 may be formatted according to the threat modeling data format. In some nonlimiting embodiments or aspects, the threat modeling data format may be structured according to a relationship between a subject and an object, where the subject and the object may include one or more of the plurality of data elements included in the data associated with the security architecture document.

[0096] In some non-limiting embodiments or aspects, LLM 318 may be trained based on receiving data associated with a plurality of security architecture documents for a plurality of specific software environments. For example, Al threat modeling system 102 may train LLM 318 to provide threat modeling data 316 as an output based on receiving the data associated with the security architecture in the natural language format as an input from Al threat modeling system 102.

[0097] In some non-limiting embodiments or aspects, LLM 318 may receive function processing calls (e.g., from Al threat modeling system 102). In some nonlimiting embodiments or aspects, when converting the data associated with the security architecture document from a natural language format to a threat modeling data format to provide threat modeling data 316, LLM 318 may perform a reduction analysis via functional processing calls. In some non-limiting embodiments or aspects,the functional processing calls may include a structured request to execute a functionlike behavior (e.g., call an external API, retrieve data, translate data, and / or perform structured processing). In some non-limiting embodiments or aspects, the structure request may include a request for LLM 318 to process the input (e.g., the data associated with the security architecture document) in the natural language format and return a threat modeling data format. In some non-limiting embodiments or aspects, LLM 318 may process the request using logical reasoning, mathematical calculations, and / or code execution.

[0098] In some non-limiting embodiments or aspects, the threat modeling data format may include a JSON format. In some non-limiting embodiments or aspects, the threat modeling data format may be structured according to a relationship between a subject and an object of a plurality of subjects and objects included in a security architecture document, a trust boundary that includes a boundary that distinguishes between differing defined levels of trust in a security architecture document, a software application of the specific software environment, and / or any combination thereof.

[0099] In some non-limiting embodiments or aspects, threat modeling data 316 may include data associated with each category of relationship between a subject and an object of a plurality of categories of relationships.

[0100] In some non-limiting embodiments or aspects, Al threat modeling system 102 may generate a visual representation of a software architecture model (e.g., a context, container, component code (C4) model) using a machine learning model (not shown) based on threat modeling data 316 and / or C4 design data retrieved from a database (e.g., ML model management database 104). In some non-limiting embodiments or aspects, the machine learning model may include a supervised machine learning model and / or an unsupervised machine learning model. In some non-limiting embodiments or aspects, the machine learning model may include a classification model, a neural network model, a clustering model, a deep learning model, a decision tree model, a linear regression model, a logistic regression model, a reinforcement learning model, and / or the like.

[0101] In some non-limiting embodiments or aspects, Al threat modeling system 102 may provide the visual representation of the software architecture model (e.g., the C4 model) and / or threat modeling data 316 to a user device (e.g., user device 106). User device 106 may display the visual representation of the software architecturemodel (e.g., the C4 model) and / or threat modeling data 316 via a display of user device 106.

[0102] In some non-limiting embodiments or aspects, user device 106 may display data associated with a user selection via a graphical user interface (GUI) displayed via the display. In some non-limiting embodiments or aspects, the user selection may include a selectable option, including an approval and / or a denial. In some non-limiting embodiments or aspects, user device 106 may receive a selection of the selectable option indicating an approval and / or denial of the visual representation of the software architecture model (e.g., the C4 model) and / or threat modeling data 316. In some nonlimiting embodiments or aspects, Al threat modeling system 102 may receive an indication of approval and / or denial from user device 106 based on the user’s selection.

[0103] As shown in FIG. 3D, when converting the data associated with the security architecture document from a natural language format to a threat modeling data format to provide threat modeling data 316, Al threat modeling system 102 may chunk the data associated with the security architecture document based on each category of relationship between a subject and an object of the plurality of categories of relationships to provide a plurality of chunks 320 of threat modeling data 316. Each chunk of the plurality of chunks 320 of threat modeling data 316 may be based on a specified category of a relationship between a subject and an object.

[0104] As shown by reference number 308 in FIG. 3E, Al threat modeling system 102 may generate a plurality of vector embeddings. For example, Al threat modeling system 102 may generate vector embeddings 322 based on threat modeling data 316 using LLM 318. In some non-limiting embodiments or aspects, LLM 318 may generate vector embeddings 322 based on receiving the indication of approval of the visual representation of the software architecture model (e.g., the C4 model) and / or threat modeling data 316 from user device 106.

[0105] In some non-limiting embodiments or aspects, LLM 318 may receive threat modeling data 316 as an input. LLM 318 may provide vector embeddings 322 as outputs based on receiving threat modeling data 316 as an input.

[0106] In some non-limiting embodiments or aspects, when generating vector embeddings 322, LLM 318 may convert each chunk of the plurality of chunks 320 of threat modeling data 316 to a vector string.

[0107] As shown by reference number 310 in FIG. 3F, Al threat modeling system 102 may identify potential cybersecurity threats. For example, Al threat modeling system 102 may identify one or more potential cybersecurity threats based on vector embeddings 322 by comparing each of the plurality of vector embeddings to known vector embeddings 324 associated with the one or more potential cybersecurity threats.

[0108] In some non-limiting embodiments or aspects, Al threat modeling system 102 may identify the one or more potential cybersecurity threats that are within a threshold distance of a vector embedding of the plurality of vector embeddings according to a measure of cosine similarity (e.g., a measure that calculates the cosine of an angle between two vectors that is used to measure how similar the two vectors are).

[0109] As shown in FIG. 3G, Al threat modeling system 102 may generate graphs 326, 328, 330. Graphs 326, 328, 330 may include a plurality of vector embeddings 324, 334, 336, 338, 340.

[0110] In some non-limiting embodiments or aspects, graph 326 may be generated based on known vector embeddings 324.

[0111] In some non-limiting embodiments or aspects, graph 328 may be generated based on known vector embeddings 324 and an input from a user. Vector 334 may be associated with an incorrect classifier, vector 336 may be associated with a correct classifier, and vector 338 may be associated with the input from the user. Al threat modeling system 102 may generate vector 338 based on receiving the input from the user. In some non-limiting embodiments or aspects, Al threat modeling system 102 (e.g., LLM 318) may retrieve data based on receiving the user input vector. In a case where the user input includes unnecessary data (e.g., noise), Al threat modeling system 102 may return the incorrect classifier vector (e.g., vector 334) rather than the correct classifier vector (e.g., vector 336) because the incorrect classifier vector (e.g., vector 334) points in the same direction as the user input vector (e.g., vector 338).

[0112] In some non-limiting embodiments or aspects, graph 330 may be generated based on known vector embeddings 324 and the input from a user. Graph 330 may include an after functional processing vector (e.g., vector 340). In some non-limiting embodiments or aspects, Al threat modeling system 102 may provide LLM 318 with the functional processing calls to reduce the noise of the data associated with the input from the user. In response to receiving the functional processing calls, LLM 318 maysearch for parameters which map back to the threat modeling data structure. Since known vector embeddings 324 are based on similar data structure and parameters, when LLM 318 performs a cosine similarity analysis, a highly accurate piece of information (e.g., vector 340) is retrieved.

[0113] As shown by reference number 312 in FIG. 3H, Al threat modeling system 102 may generate a list including one or more potential cybersecurity threats and one or more corresponding controls that provide a potential mitigation action for the one or more potential cybersecurity threats. For example, Al threat modeling system 102 may generate the list based on identifying the potential cybersecurity threats. In some nonlimiting embodiments or aspects, the list may be formatted according to a fist data format. In some non-limiting embodiments or aspects, the first data format may include the threat modeling data format. In some non-limiting embodiments or aspects, Al threat modeling system 102 may convert the list from the first data format (e.g., the threat modeling data format) to a second data format (e.g., a natural language format) to provide natural language threat modeling data using LLM 318.

[0114] As shown by reference number 314 in FIG. 3I, Al threat modeling system 102 may map the potential cybersecurity threats to corresponding controls that provide a potential mitigation action for the potential cybersecurity threats.

[0115] In some non-limiting embodiments or aspects, Al threat modeling system 102 may generate a comprehensive threat modeling report based on the natural language threat modeling data. In some non-limiting embodiments or aspects, Al threat modeling system 102 may send the report to user device 106.

[0116] Referring now to FIG. 4, shown is a diagram of an exemplary implementation of environment 400 for artificial intelligence assisted cybersecurity threat modeling, according to some non-limiting embodiments or aspects.

[0117] As shown in FIG. 4, environment 400 may include front end portal 402, Al engine 404, and / or vector knowledge system 406. In some non-limiting embodiments or aspects, Al engine 404 may communicate data to and / or receive data from front end portal 402 and / or vector knowledge system 406.

[0118] In some non-limiting embodiments or aspects, front end portal 402 may be the same as, similar to, and / or part of user device 106. Front end portal 402 may include UML / application design parsing system 408 and / or threat model creator system 410. In some non-limiting embodiments or aspects, UML / application design parsing system 408 may ingest a plurality of application design specifications from aplurality of documentation sources. The application design specification may include data associated with a security architecture document for a specific software environment. UML / application design parsing system 408 may output threat modeling data.

[0119] In some non-limiting embodiments or aspects, Al engine 404 may include LLM 412, imaging module 414, threat detection module 416, controls output module 418, and / or underlying Al models 420. In some non-limiting embodiments or aspects, Al engine 404 may be the same as, similar to, and / or part of Al threat modeling system 102. In some non-limiting embodiments or aspects, LLM 412 may be the same as, similar to, and or part of LLM 318.

[0120] In some non-limiting embodiments or aspects, vector knowledge system 406 may store data associated with a plurality of known cybersecurity threats and / or C4 data. Vector knowledge system 406 may include C4 design database 422 which may store C4 data, threat model database 424 which may store threat modeling data, and / or open-source threat database 426 which may store data associated with known open-source threats.

[0121] In some non-limiting embodiments or aspects, UML / application design parsing system 408 and / or threat model creator system 410 may input data to Al engine 404. For example, UML / application design parsing system 408 and / or threat model creator system 410 may input data associated with a security architecture document for a specific software environment (e.g., business required documents (BRD), diagrams, and / or raw user input describing an application) to LLM 412.

[0122] In some non-limiting embodiments or aspects, LLM 412 may include a function calling model trained to perform a reduction analysis to convert the data from a first data format (e.g., natural language format) to a second data format (e.g., threat modeling data format). In some non-limiting embodiments or aspects, LLM 412 may perform a reduction analysis via functional processing calls provided to LLM 412 and convert the data associated with the security architecture document from the natural language format to the threat modeling data format to provide threat modeling data. In some non-limiting embodiments or aspects, LLM 412 may send the threat modeling data to imaging module 414.

[0123] In some non-limiting embodiments or aspects, imaging module 414 may convert the threat modeling data from the second data format (e.g., threat modeling data) to a third data format (e.g., context, container, component code (C4) format) bymapping the threat modeling data with data retrieved from C4 design database 422 to provide a visual representation of a C4 model of the data. In some non-limiting embodiments or aspects, imaging module 414 may send a message to front end portal 402, the message including the threat modeling data and the visual representation of the C4 model of the threat modeling data to front end portal 402 for validation (e.g., approval or denial). In some non-limiting embodiments or aspects, the user may select an option displayed via a display of front end portal 402 to approve or deny the message, including the threat modeling data and the graphical representation of the C4 model of the threat modeling data.

[0124] In some non-limiting embodiments or aspects, in response to the user selecting to approve the message, LLM 412 may divide the threat modeling data into a plurality of chunks based on relationships defined by the threat modeling data (e.g., a relationship between a subject and an object of a plurality of categories of relationships) to provide a plurality of chunks of the threat modeling data. LLM 412 may convert each chunk of the plurality of chunks to a vector string. Then, LLM 412 may generate a plurality of vector embeddings based on the vector strings. In some non-limiting embodiments or aspects, LLM 412 may send the plurality of vector embeddings to threat detection module 416.

[0125] In some non-limiting embodiments or aspects, upon receiving the plurality of vector embeddings, threat detection module 416 may identify potential cybersecurity threats based on the plurality of vector embeddings. Threat detection module 416 may compare each of the plurality of vector embeddings to known vector embeddings associated with the one or more potential cybersecurity threats and identify one or more potential cybersecurity threats that are within a threshold distance of a vector embedding of the plurality of vector embeddings according to a measure of cosine similarity. The known vector embeddings may include embeddings generated based on one or more open-source threats (e.g., CIS threats, MITRE ATT&CK threats, OWSAP threats, etc.).

[0126] In some non-limiting embodiments or aspects, threat detection module 416 may send and / or receive data from controls output module 418. For example, threat detection module 416 may send the one or more potential cybersecurity threats to controls output module 418. In some non-limiting embodiments or aspects, controls output module 418 may map the one or more potential cybersecurity threats to one or more corresponding controls that provide a potential mitigation action for the one ormore potential cybersecurity threats. Controls output module 418 may generate a list that includes the one or more potential cybersecurity threats and the one or more corresponding controls that provide a potential mitigation action for the one or more potential cybersecurity threats. Controls output module 418 may include a vector database including vector embeddings associated with vectors passed through an embedding model (not shown). Controls output module 418 may map a specific threat (e.g., a threat identified in a cloud computing service, such as Amazon Web Services (AWS)) to a specific control (e.g., a specific control of a cloud computing service).

[0127] In some non-limiting embodiments or aspects, controls output module 418 may send the list, including the one or more potential cybersecurity threats and the one or more corresponding controls that provide a potential mitigation action for the one or more potential cybersecurity threats, to LLM 412. In response to receiving the list, LLM 412 may convert the list from a first format to a second format (e.g., natural language format).

[0128] In some non-limiting embodiments or aspects, LLM 412 may send the list in the natural language format to front end portal 402. Front end portal 402 may display the list in the natural language format via the display. In some non-limiting embodiments or aspects, underlying Al models 420 may include one or more embedding models (e.g., Ada models or DaVinci models).

[0129] Referring now to FIGS. 5A and 5B, shown are schematic diagrams of exemplary implementations of a method and / or system of process 500 for artificial intelligence assisted cybersecurity threat modeling, according to some non-limiting embodiments or aspects. As shown in FIGS. 5A and 5B, process 500 may include user device 506, web portal 508, LLM 510, imaging module 512, threat detection module 514, and / or controls output module 516. In some non-limiting embodiments or aspects, LLM 510, imaging module 512, threat detection module 514, and / or controls output module 516 may be the same as, similar to, and / or part of Al threat modeling system 102, Al engine 404, and / or vector knowledge system 406. In some non-limiting embodiments or aspects, LLM 510 may be the same as, similar to, and / or part of LLM 318 and / or LLM 412. In some non-limiting embodiments or aspects, imaging module 512 may be the same as, similar to, and / or part of imaging module 414. In some nonlimiting embodiments or aspects, threat detection module 514 may be the same as, similar to, and / or part of threat detection module 416. In some non-limiting embodiments or aspects, controls output module 516 may be the same as, similar to,and / or part of controls output module 418. In some non-limiting embodiments or aspects, user device 506 may be the same as, similar to, and / or part of user device 106 and / or front end portal 402.

[0130] As shown in FIG. 5A, at step 520, user device 506 may send data to web portal 508 in response to receiving the data as an input from a user. The data may include data associated with a security architecture document for a specific software environment (e.g., business required documents (BRD), diagrams, and / or raw user input describing an application).

[0131] As shown in FIG. 5A, at step 522, web portal 508 may send the data to LLM 510. In some non-limiting embodiments or aspects, LLM 510 may include a function calling model trained to perform a reduction analysis to convert the data from a first data format (e.g., natural language format) to a second data format (e.g., threat modeling data format).

[0132] As shown in FIG. 5A, at step 524, in response to receiving the data from web portal 508, LLM 510 may perform a reduction analysis via functional processing calls provided to the LLM and convert the data associated with the security architecture document from the natural language format to the threat modeling data format to provide threat modeling data.

[0133] As shown in FIG. 5A, at step 526, LLM 510 may send the threat modeling data to imaging module 512.

[0134] As shown in FIG. 5A, at step 528, imaging module 512 may convert the threat modeling data from the second data format (e.g., threat modeling data) to a third data format (e.g., context, container, component code (C4) format) by mapping the threat modeling data with data from a database (e.g., C4 design database 422) storing C4 data (e.g., 04 design prompts) to provide a visual representation of a 04 model of the data.

[0135] As shown in FIG. 5A, at step 530, imaging module 512 sends a message to user device 506, including the threat modeling data and the visual representation of the 04 model of the threat modeling data to user device 506 for validation (e.g., approval or denial).

[0136] As shown in FIG. 5A, at step 532, the user may select an option presented on user device 506 to approve or deny the message, including the threat modeling data and the graphical representation of the 04 model of the threat modeling data, and approval may be sent to web portal 508.

[0137] As shown in FIG. 5A, at step 534, web portal 508 sends the threat model data to LLM 510.

[0138] As shown in FIG. 5A, at step 536, upon receiving the threat model data from web portal 508, LLM 510 divides the threat model data into a plurality of chunks based on relationships defined by the threat model data (e.g., a relationship between a subject and an object of a plurality of categories of relationships) to provide a plurality of chunks of the threat modeling data. LLM 510 may convert each chunk of the plurality of chunks to a vector string. Then, LLM 510 may generate a plurality of vector embeddings based on the vector strings.

[0139] As shown in FIG. 5B, at step 538, LLM 510 sends the plurality of vector embeddings to threat detection module 514. As further shown in FIG. 5B, at step 540, upon receiving the plurality of vector embeddings, threat detection module 514 may identify potential cybersecurity threats based on the plurality of vector embeddings. Threat detection module 514 may compare each of the plurality of vector embeddings to known vector embeddings associated with the one or more potential cybersecurity threats and identify one or more potential cybersecurity threats that are within a threshold distance of a vector embedding of the plurality of vector embeddings according to a measure of cosine similarity. The known vector embeddings may include embeddings generated based on one or more open-source threats (e.g., CIS threats, MITRE ATT&CK threats, OWSAP threats, etc.).

[0140] As further shown in FIG. 5B, at step 542, threat detection module 514 may send the one or more potential cybersecurity threats to controls output module 516. As further shown in FIG. 5B, at step 544, controls output module 516 may map the one or more potential cybersecurity threats to one or more corresponding controls that provide a potential mitigation action for the one or more potential cybersecurity threats. Controls output module 516 may include a vector database, including vector embeddings associated with vectors passed through an embedding model (e.g., underlying Al models 420). Controls output module 516 may map a specific threat (e.g., a threat identified in in a cloud computing service) to a specific control (e.g., a specific in a cloud computing service control). Controls output module 516 may generate a list that includes the one or more potential cybersecurity threats and the one or more corresponding controls that provide a potential mitigation action for the one or more potential cybersecurity threats.

[0141] As further shown in FIG. 5B, at step 546, controls output module 516 may send the list, including the one or more potential cybersecurity threats and the one or more corresponding controls that provide a potential mitigation action for the one or more potential cybersecurity threats, to LLM 510. In some non-limiting embodiments or aspects, LLM 510 may convert the list from a first format to a second format (e.g., natural language format). As further shown in FIG. 5B, at step 548, LLM 510 may send the list in the natural language format to user device 506. User device 506 may display the list in the natural language format via a display of user device 506. As further shown in FIG. 5B, at step 550, user device 506 may send validation of the list and / or a message, including a request to probe further, to LLM 510.

[0142] Referring now to FIG. 6, depicted is a diagram of diagram of exemplary environment 600 in which methods, systems, and / or computer program products, described herein, may be implemented, according to some non-limiting embodiments or aspects. In some non-limiting embodiments or aspects, environment 600 may be used in conjunction with the methods, systems, and / or computer program products described herein, and / or the methods, systems, and / or computer program products described herein, may be implemented in environment 600. In some non-limiting embodiments or aspects, environment 600 may be an example payment processing network. As shown in FIG. 6, environment 600 may include transaction processing system 602, payment gateway system 612, merchant system 608, issuer system 604, acquirer system 610, and / or customer device 606. In some non-limiting embodiments or aspects, each of Al threat modeling system 102, ML model management database 104, and / or user device 106 of FIG. 1 may be implemented by (e.g., part of) transaction processing system 602. In some non-limiting embodiments or aspects, at least one of Al threat modeling system 102, ML model management database 104, and / or user device 106 of FIG. 1 may be implemented by (e.g., part of) another system, another device, another group of systems, or another group of devices, separate from or including transaction processing system 602, such as merchant system 608, issuer system 604, acquirer system 610, customer device 606, and / or the like. For example, Al threat modeling system 102 may be implemented by (e.g., part of) at least one of payment gateway system 612, merchant system 608, issuer system 604, acquirer system 610, and / or customer device 606. The systems and / or devices of FIG. 6 may communicate via communication network 614, which may include one or more wired and / or wireless communication networks.

[0143] Transaction processing system 602 may include one or more devices capable of receiving information from and / or communicating information to payment gateway system 612, merchant system 608, issuer system 604, acquirer system 610, customer device 606, and / or the like (e.g., directly, indirectly, via a public and / or private communication network connection, and / or the like). For example, as shown in FIG. 6, transaction processing system 602 may be in communication with one or more issuer systems (e.g., issuer system 604), one or more acquirer systems (e.g., acquirer system 610), and / or one or more payment gateway systems (e.g., payment gateway system 612). Although only a single issuer system 604, single acquirer system 610, and single payment gateway system 612 are shown, it will be appreciated that transaction processing system 602 may be in communication with a plurality of issuer systems, a plurality of acquirer systems, and / or a plurality of payment gateway systems. In some non-limiting embodiments or aspects, transaction processing system 602 may include a computing device, such as a server (e.g., a transaction processing server), a group of servers, and / or other like devices. In some non-limiting embodiments or aspects, transaction processing system 602 may be in communication with a data storage device, which may be local or remote to transaction processing system 602. In some non-limiting embodiments or aspects, transaction processing system 602 may be capable of receiving information from, storing information in, communicating information to, or searching information stored in the data storage device. In some non-limiting embodiments or aspects, transaction processing system 602 may be associated with a transaction service provider, as described herein. In some non-limiting embodiments or aspects, transaction processing system 602 may also operate as an issuer system such that both transaction processing system 602 and issuer system 604 are a single system and / or are controlled by a single entity.

[0144] Payment gateway system 612 may include one or more devices capable of receiving information from and / or communicating information to transaction processing system 602, merchant system 608, issuer system 604, acquirer system 610, customer device 606, and / or the like (e.g., directly, indirectly, via a public and / or private communication network connection, and / or the like). For example, as shown in FIG. 6, payment gateway system 612 may be in communication with one or more merchant systems (e.g., merchant system 608), one or more acquirer systems (e.g., acquirer system 610), and / or one or more transaction processing systems (e.g.,transaction processing system 602). Although only a single merchant system 608, single acquirer system 610, and single transaction processing system 602 are shown, it will be appreciated that payment gateway system 612 may be in communication with a plurality of merchant systems, a plurality of acquirer systems, and / or a plurality of transaction processing systems. In some non-limiting embodiments or aspects, payment gateway system 612 may include a computing device, such as a server, a group of servers, and / or other like devices. In some non-limiting embodiments or aspects, payment gateway system 612 may be associated with a payment gateway, as described herein.

[0145] Merchant system 608 may include one or more devices capable of receiving information from and / or communicating information to transaction processing system 602, payment gateway system 612, issuer system 604, acquirer system 610, customer device 606, and / or the like (e.g., directly, indirectly, via a public and / or private communication network connection, and / or the like). For example, as shown in FIG. 6, merchant system 608 may be in communication with one or more payment gateway systems (e.g., payment gateway system 612), one or more acquirer systems (e.g., acquirer system 610), and / or one or more consumer devices (e.g., customer device 606). Although only a single payment gateway system 612, single acquirer system 610, and single customer device 606 are shown, it will be appreciated that merchant system 608 may be in communication with a plurality of payment gateway systems, a plurality of acquirer systems, and / or a plurality of consumer devices. In some nonlimiting embodiments or aspects, merchant system 608 may include a computing device, such as a server, a group of servers, a client device, a group of client devices, a POS device, a POS system, computers, computer systems, peripheral devices, and / or other like devices. In some non-limiting embodiments or aspects, merchant system 608 may be associated with a merchant, as described herein. In some nonlimiting embodiments or aspects, merchant system 608 may include a device capable of receiving information from and / or communicating information to customer device 606 via a short range communication connection (e.g., an NFC communication connection, an RFID communication connection, a Bluetooth® communication connection, a Zigbee® communication connection, and / or the like) with customer device 606 and / or the like. In some non-limiting embodiments or aspects, merchant system 608 may include one or more client devices. For example, merchant system 608 may include a client device that allows a merchant to communicate information totransaction processing system 602 (e.g., via at least one of acquirer system 610 and / or payment gateway system 612). In some non-limiting embodiments or aspects, merchant system 608 (e.g., a client device thereof, a POS device thereof, and / or the like) may also operate as a payment gateway system such that both merchant system 608 and payment gateway system 612 are a single system and / or controlled by a single entity.

[0146] Issuer system 604 may include one or more devices capable of receiving information and / or communicating information to transaction processing system 602, payment gateway system 612, merchant system 608, acquirer system 610, customer device 606, and / or the like (e.g., directly, indirectly, via a public and / or private communication network connection, and / or the like). For example, as shown in FIG. 6, issuer system 604 may be in communication with one or more transaction processing systems (e.g., transaction processing system 602) and / or one or more consumer devices (e.g., customer device 606). Although only a single transaction processing system 602 and a single customer device 606 are shown, it will be appreciated that issuer system 604 may be in communication with a plurality of transaction processing systems and / or a plurality of customer devices 606. In some non-limiting embodiments or aspects, issuer system 604 may include a computing device, such as a server, a group of servers, and / or other like devices. In some nonlimiting embodiments or aspects, issuer system 604 may be associated with an issuer institution, as described herein. For example, issuer system 604 may be associated with an issuer institution that issued a credit account, debit account, credit card, debit card, a payment device, and / or the like to a user associated with customer device 606.

[0147] Acquirer system 610 may include one or more devices capable of receiving information from and / or communicating information to transaction processing system 602, payment gateway system 612, merchant system 608, issuer system 604, customer device 606, and / or the like (e.g., directly, indirectly, via a public and / or private communication network connection, and / or the like). For example, as shown in FIG. 6, acquirer system 610 may be in communication with one or more transaction processing systems (e.g., transaction processing system 602), one or more payment gateway systems (e.g., payment gateway system 612), and / or one or more merchant systems (e.g., merchant system 608). Although only a single transaction processing system 602, a single payment gateway system 612, and a single merchant system 608 are shown, it will be appreciated that acquirer system 610 may be incommunication with a plurality of transaction processing systems, a plurality of payment gateway systems, and / or a plurality of merchant systems. In some nonlimiting embodiments or aspects, acquirer system 610 may include a computing device, such as a server, a group of servers, and / or other like devices. In some nonlimiting embodiments or aspects, acquirer system 610 may be associated with an acquirer institution, as described herein.

[0148] Customer device 606 may include one or more devices capable of receiving information from and / or communicating information to transaction processing system 602, payment gateway system 612, merchant system 608, issuer system 604, acquirer system 610, and / or the like (e.g., directly, indirectly, via a public and / or private communication network connection, and / or the like). For example, as shown in FIG. 6, customer device 606 may be in communication with one or more merchant systems (e.g., merchant system 608) and / or one or more issuer systems (e.g., issuer system 604). Although only a single merchant system 608 and a single issuer system 604 are shown, it will be appreciated that customer device 606 may be in communication with a plurality of merchant systems and / or a plurality of issuer systems. In some nonlimiting embodiments or aspects, customer device 606 may be associated with a user to whom a credit account, debit account, credit card, debit card, a payment device, and / or the like has been issued. In some non-limiting embodiments or aspects, customer device 606 may include a computing device, such as a computer, a portable computer, a laptop computer, a tablet computer, a mobile device, a cellular phone, a smartphone, a wearable device (e.g., watches, glasses, lenses, clothing, and / or the like), a PDA, a client device, and / or other like devices. In some non-limiting embodiments or aspects, customer device 606 may include a payment device, as described herein. In some non-limiting embodiments or aspects, customer device 606 may include a device capable of receiving information from and / or communicating information to other customer devices 606 (e.g., directly, indirectly, via a public and / or private communication network connection, a short range communication connection, and / or the like). In some non-limiting embodiments or aspects, customer device 606 may include a device capable of receiving information from and / or communicating information to merchant system 608 via a short range communication connection (e.g., an NFC communication connection, an RFID communication connection, a Bluetooth® communication connection, a Zigbee® communication connection, and / orthe like) with merchant system 608 and / or the like. In some non-limiting embodiments or aspects, customer device 606 may include a client device.

[0149] In some non-limiting embodiments or aspects, transaction processing system 602 may communicate with merchant system 608 directly (e.g., via a public and / or private communication network connection and / or the like). Additionally or alternatively, transaction processing system 602 may communicate with merchant system 608 through payment gateway system 612 and / or acquirer system 610. In some non-limiting embodiments or aspects, acquirer system 610 associated with merchant system 608 may operate as payment gateway system 612 to facilitate the communication of transaction messages (e.g., authorization requests) from merchant system 608 to transaction processing system 602. In some non-limiting embodiments or aspects, merchant system 608 may communicate with payment gateway system 612 directly (e.g., via a public and / or private communication network connection and / or the like). For example, merchant system 608, that includes a physical POS device, may communicate with payment gateway system 612 through a public or private network to conduct card-present transactions. As another example, merchant system 608 that includes a server (e.g., a web server) may communicate with payment gateway system 612 through a public or private network, such as the Internet, to conduct card-not-present transactions.

[0150] For the purpose of illustration, processing a transaction (e.g., a payment transaction) may include generating a transaction message (e.g., authorization request and / or the like) based on an account identifier of a customer (e.g., accountholder associated with customer device 606 and / or the like) and / or transaction data associated with the transaction. For example, merchant system 608 (e.g., a client device of merchant system 608, a POS device of merchant system 608, and / or the like) may initiate the transaction, e.g., by generating an authorization request (e.g., in response to receiving the account identifier from a payment device and / or a portable financial device of the customer and / or the like). Merchant system 608 may communicate the authorization request to payment gateway system 612 and / or acquirer system 610. In some non-limiting embodiments or aspects, payment gateway system 612 may communicate the authorization request to acquirer system 610 and / or transaction processing system 602. Additionally or alternatively, acquirer system 610 (and / or payment gateway system 612) may communicate the authorization request to transaction processing system 602. After receiving the authorization request frommerchant system 608 that identifies the account identifier of the customer (e.g., the accountholder associated with customer device 606 and / or the account identifier), transaction processing system 602 may communicate the authorization request to issuer system 604 (e.g., the issuer system that issued the payment device and / or account identifier). Issuer system 604 may determine an authorization decision (e.g., approve, deny, and / or the like) based on the authorization request, and / or issuer system 604 may generate an authorization response based on the authorization decision and / or the authorization request. Issuer system 604 may communicate the authorization response to transaction processing system 602. Transaction processing system 602 may communicate the authorization response to acquirer system 610 and / or payment gateway system 612. In some non-limiting embodiments or aspects, acquirer system 610 may communicate the authorization response to payment gateway system 612 and / or merchant system 608. Additionally or alternatively, payment gateway system 612 (and / or acquirer system 610) may communicate the authorization response to merchant system 608.

[0151] In some non-limiting embodiments or aspects, transaction processing system 602 and / or issuer system 604 may include at least one machine learning model (e.g., at least one of a fraud detection model, a risk detection model, a transaction authorization model, a credit approval model, a product recommendation model, a classifier model, an anomaly detection model, an authentication model, any combination thereof, and / or the like). For example, the machine learning model(s) may be trained based on synthetic data generated, as described herein. Transaction processing system 602 and / or issuer system 604 may perform at least one task (e.g., generate a prediction and / or generate an embedding) based on the authorization request and the machine learning model(s). For example, performing the task(s) may include generating at least one prediction associated with fraud detection, risk detection, transaction authorization, credit approval, product recommendation, classification, anomaly detection, authentication, any combination thereof, and / or the like. In some non-limiting embodiments or aspects, transaction processing system 602 may communicate at least one message based on performing the task (e.g., generating the prediction and / or generating an embedding) to issuer system 604 (e.g., along with the authorization request). In some non-limiting embodiments or aspects, issuer system 604 may determine the authorization decision (e.g., approve, deny,and / or the like) based on the authorization request and the performance of the task (e.g., generation of the prediction and / or generation of the embedding).

[0152] For the purpose of illustration, clearing and / or settlement of a transaction may include generating a message (e.g., clearing message and / or the like) based on an account identifier of a customer (e.g., associated with customer device 606 and / or the like) and / or transaction data associated with the transaction. For example, merchant system 608 may generate at least one clearing message (e.g., a plurality of clearing messages, a batch of clearing messages, and / or the like). Merchant system 608 may communicate the clearing message(s) to acquirer system 610 (and / or payment gateway system 612, which may communicate the clearing message(s) to acquirer system 610). Acquirer system 610 may communicate the clearing message(s) to transaction processing system 602. Transaction processing system 602 may communicate the clearing message(s) to issuer system 604. Issuer system 604 may generate at least one settlement message based on the clearing message(s). In some non-limiting embodiments or aspects, issuer system 604 may communicate the settlement message(s) and / or funds to transaction processing system 602 (and / or a settlement bank system associated with transaction processing system 602), and transaction processing system 602 (and / or the settlement bank system) may communicate the settlement message(s) and / or funds to acquirer system 610. Additionally or alternatively, issuer system 604 may communicate the settlement message(s) and / or funds to acquirer system 610. In some non-limiting embodiments or aspects, acquirer system 610 may communicate the settlement message(s) and / or funds to merchant system 608 (and / or an account associated with merchant system 608).

[0153] Communication network 614 may include one or more wired and / or wireless networks. For example, communication network 614 may include a cellular network (e.g., a long-term evolution (LTE) network, a third generation (3G) network, a fourth generation (4G) network, a fifth generation (5G) network, a code division multiple access (CDMA) network, and / or the like), a public land mobile network (PLMN), a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a telephone network (e.g., the public switched telephone network (PSTN)), a private network (e.g., a private network associated with a transaction service provider), an ad hoc network, an intranet, the Internet, a fiber optic-based network, a cloud computing network, and / or the like, and / or a combination of these or other types of networks.

[0154] The number and arrangement of systems, devices, and / or networks shown in FIG. 6 are provided as an example. There may be additional systems, devices, and / or networks; fewer systems, devices, and / or networks; different systems, devices, and / or networks; and / or differently arranged systems, devices, and / or networks than those shown in FIG. 6. Furthermore, two or more systems or devices shown in FIG. 6 may be implemented within a single system or device, or a single system or device shown in FIG. 6 may be implemented as multiple, distributed systems or devices. Additionally or alternatively, a set of systems (e.g., one or more systems) or a set of devices (e.g., one or more devices) of environment 600 may perform one or more functions described as being performed by another set of systems or another set of devices of environment 600.

[0155] Referring now to FIG. 7, shown is a diagram of example components of device 700, according to non-limiting embodiments or aspects. Device 700 may correspond to at least one of Al threat modeling system 102, ML model management database 104, and / or user device 106 in FIG. 1 and / or at least one of transaction processing system 602, issuer system 604, customer device 606, merchant system 608, and / or acquirer system 610 in FIG. 6, as an example. In some non-limiting embodiments or aspects, such systems or devices in FIG. 1 or FIG. 6 may include at least one device 700 and / or at least one component of device 700. The number and arrangement of components shown in FIG. 7 are provided as an example. In some non-limiting embodiments or aspects, device 700 may include additional components, fewer components, different components, or differently arranged components than those shown in FIG. 7. Additionally or alternatively, a set of components (e.g., one or more components) of device 700 may perform one or more functions described as being performed by another set of components of device 700.

[0156] As shown in FIG. 7, device 700 may include bus 702, processor 704, memory 706, storage component 708, input component 710, output component 712, and communication interface 714. Bus 702 may include a component that permits communication among the components of device 700. In some non-limiting embodiments or aspects, processor 704 may be implemented in hardware, firmware, or a combination of hardware and software. For example, processor 704 may include a processor (e.g., a central processing unit (CPU), a graphics processing unit (GPU), an accelerated processing unit (APU), etc.), a microprocessor, a digital signal processor (DSP), and / or any processing component (e.g., a field-programmable gatearray (FPGA), an application-specific integrated circuit (ASIC), etc.) that can be programmed to perform a function. Memory 706 may include random access memory (RAM), read only memory (ROM), and / or another type of dynamic or static storage device (e.g., flash memory, magnetic memory, optical memory, etc.) that stores information and / or instructions for use by processor 704.

[0157] With continued reference to FIG. 7, storage component 708 may store information and / or software related to the operation and use of device 700. For example, storage component 708 may include a hard disk (e.g., a magnetic disk, an optical disk, a magneto-optic disk, a solid-state disk, etc.) and / or another type of computer-readable medium. Input component 710 may include a component that permits device 700 to receive information, such as via user input (e.g., a touch screen display, a keyboard, a keypad, a mouse, a button, a switch, a microphone, etc.). Additionally or alternatively, input component 710 may include a sensor for sensing information (e.g., a global positioning system (GPS) component, an accelerometer, a gyroscope, an actuator, etc.). Output component 712 may include a component that provides output information from device 700 (e.g., a display, a speaker, one or more light-emitting diodes (LEDs), etc.). Communication interface 714 may include a transceiver-like component (e.g., a transceiver, a separate receiver and transmitter, etc.) that enables device 700 to communicate with other devices, such as via a wired connection, a wireless connection, or a combination of wired and wireless connections. Communication interface 714 may permit device 700 to receive information from another device and / or provide information to another device. For example, communication interface 714 may include an Ethernet interface, an optical interface, a coaxial interface, an infrared interface, a radio frequency (RF) interface, a universal serial bus (USB) interface, a Wi-Fi® interface, a cellular network interface, and / or the like.

[0158] Device 700 may perform one or more processes described herein. Device 700 may perform these processes based on processor 704 executing software instructions stored by a computer-readable medium, such as memory 706 and / or storage component 708. A computer-readable medium may include any non-transitory memory device. A memory device includes memory space located inside of a single physical storage device or memory space spread across multiple physical storage devices. Software instructions may be read into memory 706 and / or storage component 708 from another computer-readable medium or from another device viacommunication interface 714. When executed, software instructions stored in memory 706 and / or storage component 708 may cause processor 704 to perform one or more processes described herein. Additionally or alternatively, hardwired circuitry may be used in place of or in combination with software instructions to perform one or more processes described herein. Thus, embodiments described herein are not limited to any specific combination of hardware circuitry and software. The term “configured to,” as used herein, may refer to an arrangement of software, device(s), and / or hardware for performing and / or enabling one or more functions (e.g., actions, processes, steps of a process, and / or the like). For example, “a processor configured to” may refer to a processor that executes software instructions (e.g., program code) that cause the processor to perform one or more functions.

[0159] Although embodiments have been described in detail for the purpose of illustration, it is to be understood that such detail is solely for that purpose and that the disclosure is not limited to the disclosed embodiments or aspects, but, on the contrary, is intended to cover modifications and equivalent arrangements that are within the spirit and scope of the appended claims. For example, it is to be understood that the present disclosure contemplates that, to the extent possible, one or more features of any embodiment or aspect can be combined with one or more features of any other embodiment or aspect.

Claims

WHAT IS CLAIMED IS:1 . A computer-implemented method, comprising: receiving, with at least one processor, data associated with a security architecture document for a specific software environment; converting, with at least one processor, the data associated with the security architecture document from a natural language format to a threat modeling data format using a large language model (LLM) to provide threat modeling data, wherein the threat modeling data format is structured according to a relationship between a subject and an object, and wherein the subject and the object are data elements included in the data associated with the security architecture document; generating, with at least one processor, a plurality of vector embeddings based on the threat modeling data using the LLM; identifying, with at least one processor, one or more potential cybersecurity threats based on the plurality of vector embeddings; and mapping, with at least one processor, the one or more potential cybersecurity threats to one or more corresponding controls that provide a potential mitigation action for the one or more potential cybersecurity threats.

2. The computer-implemented method of claim 1 , further comprising: generating a visual representation of a software architecture model using a machine learning model based on the threat modeling data based on converting the data associated with the security architecture document from a natural language format to a threat modeling data format; providing the visual representation of the software architecture model to a user device; and receiving an indication of approval from the user device; wherein generating the plurality of vector embeddings comprises: generating the plurality of vector embeddings based on receiving the indication of approval from the user device.

3. The computer-implemented method of claim 1 , wherein the threat modeling data format is a JSON format, and the threat modeling data format is structured according to: a relationship between a subject and an object of a plurality of subjects and objects included in a security architecture document; a trust boundary that includes a boundary that distinguishes between differing defined levels of trust in a security architecture document; and a software application of the specific software environment.

4. The computer-implemented method of claim 1 , further comprising: generating a list that includes the one or more potential cybersecurity threats and the one or more corresponding controls that provide a potential mitigation action for the one or more potential cybersecurity threats; converting the list from a first data format to a second data format to provide natural language threat modeling data using the LLM, wherein the second data format includes a natural language format; and generating a comprehensive threat modeling report based on the natural language threat modeling data.

5. The computer-implemented method of claim 1 , wherein converting the data associated with the security architecture document from a natural language format to a threat modeling data format to provide threat modeling data comprises: performing a reduction analysis via functional processing calls provided to the LLM.

6. The computer-implemented method of claim 1 , wherein the threat modeling data comprises data associated with each category of relationship between a subject and an object of a plurality of categories of relationships, and wherein converting the data associated with the security architecture document from a natural language format to a threat modeling data format to provide the threat modeling data comprises:chunking the data associated with the security architecture document based on each category of relationship between a subject and an object of the plurality of categories of relationships to provide a plurality of chunks of threat modeling data, wherein each chunk of the plurality of chunks of threat modeling data is based on a specified category of a relationship between a subject and an object; wherein generating the plurality of vector embeddings comprises: converting each chunk of the plurality of chunks of threat modeling data to a vector string using the LLM.

7. The computer-implemented method of claim 1 , wherein identifying the one or more potential cybersecurity threats comprises: comparing each of the plurality of vector embeddings to known vector embeddings associated with the one or more potential cybersecurity threats; and identifying the one or more potential cybersecurity threats that are within a threshold distance of a vector embedding of the plurality of vector embeddings according to a measure of cosine similarity.

8. A system comprising: at least one processor configured to: receive data associated with a security architecture document for a specific software environment; convert the data associated with the security architecture document from a natural language format to a threat modeling data format using a large language model (LLM) to provide threat modeling data, wherein the threat modeling data format is structured according to a relationship between a subject and an object, and wherein the subject and the object are data elements included in the data associated with the security architecture document; generate a plurality of vector embeddings based on the threat modeling data using the LLM; identify one or more potential cybersecurity threats based on the plurality of vector embeddings; andmap the one or more potential cybersecurity threats to one or more corresponding controls that provide a potential mitigation action for the one or more potential cybersecurity threats.

9. The system of claim 8, wherein the at least one processor is further configured to: generate a visual representation of a software architecture model using a machine learning model based on the threat modeling data based on converting the data associated with the security architecture document from a natural language format to a threat modeling data format; provide the visual representation of the software architecture model to a user device; and receive an indication of approval from the user device; wherein, when generating the plurality of vector embeddings, the at least one processor is configured to: generate the plurality of vector embeddings based on receiving the indication of approval from the user device.

10. The system of claim 8, wherein the threat modeling data format is a JSON format, and the threat modeling data format is structured according to: a relationship between a subject and an object of a plurality of subjects and objects included in a security architecture document; a trust boundary that includes a boundary that distinguishes between differing defined levels of trust in a security architecture document; and a software application of the specific software environment.1 1 . The system of claim 8, wherein the at least one processor is further configured to: generate a list that includes the one or more potential cybersecurity threats and the one or more corresponding controls that provide a potential mitigation action for the one or more potential cybersecurity threats; convert the list from a first data format to a second data format to provide natural language threat modeling data using the LLM, wherein the second data format includes a natural language format; andgenerate a comprehensive threat modeling report based on the natural language threat modeling data.

12. The system of claim of 8, wherein, when converting the data associated with the security architecture document from a natural language format to a threat modeling data format to provide threat modeling data, the at least one processor is configured to: perform a reduction analysis via functional processing calls provided to the LLM.

13. The system of claim 8, wherein the threat modeling data comprises data associated with each category of relationship between a subject and an object of a plurality of categories of relationships, and wherein, when converting the data associated with the security architecture document from a natural language format to a threat modeling data format to provide the threat modeling data, the at least one processor is configured to: chunk the data associated with the security architecture document based on each category of relationship between a subject and an object of the plurality of categories of relationships to provide a plurality of chunks of threat modeling data, wherein each chunk of the plurality of chunks of threat modeling data is based on a specified category of a relationship between a subject and an object; wherein, when generating the plurality of vector embeddings, the at least one processor is configured to: convert each chunk of the plurality of chunks of threat modeling data to a vector string using the LLM.

14. The system of claim 8, wherein, when identifying the one or more potential cybersecurity threats, the at least one processor is configured to: compare each of the plurality of vector embeddings to known vector embeddings associated with the one or more potential cybersecurity threats; and identify the one or more potential cybersecurity threats that are within a threshold distance of a vector embedding of the plurality of vector embeddings according to a measure of cosine similarity.

15. A computer program product comprising at least one non- transitory computer-readable medium including program instructions that, when executed by at least one processor, cause the at least one processor to: receive data associated with a security architecture document for a specific software environment; convert the data associated with the security architecture document from a natural language format to a threat modeling data format using a large language model (LLM) to provide threat modeling data, wherein the threat modeling data format is structured according to a relationship between a subject and an object, and wherein the subject and the object are data elements included in the data associated with the security architecture document; generate a plurality of vector embeddings based on the threat modeling data using the LLM; identify one or more potential cybersecurity threats based on the plurality of vector embeddings; and map the one or more potential cybersecurity threats to one or more corresponding controls that provide a potential mitigation action for the one or more potential cybersecurity threats.

16. The computer program product of claim 15, wherein the instructions further cause the at least one processor to: generate a visual representation of a software architecture model using a machine learning model based on the threat modeling data based on converting the data associated with the security architecture document from a natural language format to a threat modeling data format; provide the visual representation of the software architecture model to a user device; and receive an indication of approval from the user device; wherein, the instructions that cause that least one processor to generate the plurality of vector embeddings, cause the at least one processor to: generate the plurality of vector embeddings based on receiving the indication of approval from the user device.

17. The computer program product of claim 15, wherein the threat modeling data format is a JSON format, and the threat modeling data format is structured according to: a relationship between a subject and an object of a plurality of subjects and objects included in a security architecture document; a trust boundary that includes a boundary that distinguishes between differing defined levels of trust in a security architecture document; and a software application of the specific software environment.

18. The computer program product of claim 15, wherein the instructions further cause the at least one processor to: generate a list that includes the one or more potential cybersecurity threats and the one or more corresponding controls that provide a potential mitigation action for the one or more potential cybersecurity threats; convert the list from a first data format to a second data format to provide natural language threat modeling data using the LLM, wherein the second data format includes a natural language format; and generate a comprehensive threat modeling report based on the natural language threat modeling data.

19. The computer program product of claim 15, wherein, the instructions that cause the at least one processor to convert the data associated with the security architecture document from a natural language format to a threat modeling data format to provide threat modeling data, cause the at least one processor to: perform a reduction analysis via functional processing calls provided to the LLM.

20. The computer program product of claim 15, wherein the threat modeling data comprises data associated with each category of relationship between a subject and an object of a plurality of categories of relationships, and wherein, the instructions that cause the at least one processor to convert the data associated with the security architecture document from a natural language format to a threat modeling data format to provide the threat modeling data, cause the at least one processor to:chunk the data associated with the security architecture document based on each category of relationship between a subject and an object of the plurality of categories of relationships to provide a plurality of chunks of threat modeling data, wherein each chunk of the plurality of chunks of threat modeling data is based on a specified category of a relationship between a subject and an object; wherein, the one or more instructions that cause the at least one processor to generate the plurality of vector embedding, cause the at least one processor to: convert each chunk of the plurality of chunks of threat modeling data to a vector string using the LLM.

Images