Cybersecurity Event Verification for Multi-Source Risk Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Corporate cybersecurity risks have become complex due to asymmetric, distributed, and networked threats, making it difficult for corporations to manage and understand the interdependence between their risk portfolios and business operations.
Innovation Solution
A method utilizing a trained large language model (LLM) to identify and verify cybersecurity events, update risk scores, and integrate data from multiple sources, including news articles, regulatory reports, and third-party APIs, with expert-defined rules to enhance accuracy and responsiveness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional cybersecurity monitoring systems are used to track multiple threat sources, then comprehensive data collection is achieved, but false positives increase and manual review burden increases
Solution Approach 1:
The patent introduces an entity verification module as an intermediary between data collection and event detection. This module uses domain information (domains and names associated with entities) to verify identifiers extracted from text data, ensuring that cybersecurity events are correctly attributed to the right entities before further processing. This intermediary step reduces false positives by preventing misattribution of events to wrong entities, thereby improving detection accuracy without requiring proportional increases in manual review time.
2Difficulty of detecting and measuring
If multiple data sources are integrated to improve cybersecurity risk assessment, then detection capability is enhanced, but system complexity increases
Solution Approach 1:
The patent segments the cybersecurity monitoring system into distinct functional modules: a data collection module that gathers information from multiple sources, an entity verification module that validates identifiers against domain information, and a risk assessment module that calculates risk scores. This segmentation allows each module to perform its specific function independently, making the overall system more manageable and less complex while maintaining enhanced detection capabilities across multiple data sources.
3Speed
If real-time cybersecurity risk scoring is implemented, then responsiveness is improved, but computational resources increase
Solution Approach 1:
The patent implements preliminary action by pre-collecting and organizing domain information (domains and names associated with entities) into a verification database before cybersecurity events occur. When events are detected, the system can quickly verify identifiers against this pre-organized information without performing complex computations in real-time. This preliminary preparation enables rapid risk score updates while minimizing computational resource consumption during actual event processing.
Data Source
AI summary
The present disclosure presents methods and systems for determining cybersecurity risk exposure for entities. In one aspect, a method is provided that includes providing first text data to a trained LLM to identify data associated with a first candidate cybersecurity event for an entity, comparing the entity's identifier to domain information to verify the entity's identifier, determining if the first candidate cybersecurity event represents a new cybersecurity event based on com with previous data, and updating a cybersecurity risk score for the entity based on this determination. Further enhancements include training the LLM with cybersecurity event data, outputting documentation of the event source, and various methods for evaluating the novelty and severity of the cybersecurity event, including similarity measures and manual review triggers. The techniques leverage LLMs, machine learning models, and automated actions to provide a comprehensive approach to cybersecurity risk assessment and response. Other aspects are also provided.