Cybersecurity Rating System Using Graph Correlation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current cybersecurity rating systems for firms are often costly, time-consuming, and yield non-informative or methodologically flawed ratings, with limited applicability to other organizations, and existing solutions like case-by-case tests or in-house systems lack broad applicability.

Innovation Solution

A system and method that continuously improve cybersecurity ratings by parsing cybersecurity reports to build instance graphs, annotating them with a knowledge base, comparing them to reference graphs, and generating auto-remediation workflows to address vulnerabilities and adjust policies, using a feed processor, cybersecurity knowledge graph builder, correlation engine, and recommendation engine.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional cybersecurity rating systems are used, then security assessment is provided, but the process is costly and time-consuming

Engineering Contradiction:

Improvesecurity assessment qualityVSAvoidrating generation time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary actions by continuously monitoring security events, vulnerabilities, and configuration changes in real-time, maintaining an up-to-date security profile before formal rating is needed. This eliminates the need for time-consuming periodic assessments while ensuring current accuracy.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent replaces manual mechanical assessment processes with automated computational systems that use machine learning models, security event logs, and vulnerability databases to generate ratings automatically, dramatically reducing time while maintaining reliability.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Reliability

If traditional cybersecurity rating systems are used, then security assessment is provided, but the cost is high

Engineering Contradiction:

Improvesecurity assessment qualityVSAvoidassessment cost

Core Design Contradiction:

ReliabilityVSLoss of energy

Solution Approach 1:

The system enables organizations to self-assess their own security posture using automated tools that continuously collect and analyze security data from their own systems, eliminating the need to pay external assessors while maintaining assessment quality through objective algorithmic evaluation.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

Manual expert assessment processes are replaced with automated machine learning systems that process security data at low computational cost, eliminating human labor costs while maintaining or improving assessment consistency and reliability.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Measurement precision

If case-by-case cybersecurity tests are developed, then specific security issues are addressed, but applicability to other organizations is limited

Engineering Contradiction:

Improvesecurity test accuracyVSAvoidcross-organization applicability

Core Design Contradiction:

Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The system creates a universal security assessment framework that processes multiple types of security data (vulnerabilities, events, configurations) through a single platform applicable to any organization, while the machine learning models adapt to organization-specific contexts, achieving both precision and versatility.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The assessment system is dynamic and adaptive, adjusting its evaluation criteria and weightings based on organization-specific characteristics while maintaining a consistent core framework, allowing precise measurement tailored to each organization without requiring separate case-by-case test development.

Inventive Principle:

Principle #15Dynamics

4Measurement precision

If in-house cybersecurity rating systems are manually installed, then organization-specific assessment is achieved, but applicability to other cybersecurity-concerned organizations is virtually non-existent

Engineering Contradiction:

Improveorganization-specific assessment accuracyVSAvoidsystem implementation complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The system provides a universal platform that can be deployed across multiple organizations with consistent functionality, eliminating the need for each organization to manually install and configure separate systems, while still achieving organization-specific assessment through adaptive data collection and analysis.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS20240144136A1System and method for continuous improvement of a cyber security rating of a firm

Publication Date: 2024.05.02 GUARDIAN LIFE INSURANCE COMPANY OF AMERICA

AI summary

A system and method for continuously improving the cybersecurity rating of a firm includes a feed processor configured to parse at least one cybersecurity report and to feed for building an instance graph. The system may identify, measure, and monitor portfolio dimensions of public-facing digital artifacts. In addition, the system and method may each include the instance graph being compared by a correlation engine with a reference graph to generate automated or semi-automated remediation recommendations that may lead to continuous improvement of a cybersecurity rating for an organization or firm.