IP Library › Granted Patent US 12682077

Granted Patent B2

US 12682077 · App. 18/743,030 · Granted Jul 14, 2026

Generating threat statements for a threat model using artificial intelligence

Inventors: Urooj Siraj (McLean, VA); Caitlin Coffey (McLean, VA)

Assignee: Capital One Services, LLC

G06F21/577 G06F2221/034 G06N3/09

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 12682077
App. No.: 18/743,030
Granted: Jul 14, 2026
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

Methods and systems are described herein for a threat modeling system. The threat modeling system may use machine learning and operator help to determine whether the threat model has errors and/or whether the threat model is complete. In particular, the threat modeling system may input each threat or threat statement within the threat model into a machine learning model that has been trained to detect errors within the threat model. When errors are detected, the threat modeling system may present those errors to an operator to be fixed. In addition, the threat modeling system may enable an operator to add new threats to the model and then check those threats for error and completeness.

Claims (66)

1 . A system for updating threat models, the system comprising:

one or more processors; and

a non-transitory, computer-readable storage medium storing instructions, which, when executed by the one or more processors cause the one or more processors to:

receive, from a data node, a file representing a data structure of a threat model associated with an application, wherein the threat model comprises a textual representation of one or more threats for the application, and wherein the textual representation comprises, for each threat, a corresponding threat vector, a corresponding threat agent, a corresponding threat impact and a corresponding computing component;

input, for each threat, the corresponding threat vector, the corresponding threat agent, the corresponding threat impact and the corresponding computing component into an error determination machine learning model to obtain one or more threat model errors for the threat model, wherein the error determination machine learning model has been trained to identify threat model errors based on textual representations of threat models;

receive, from an operator, corrections to the one or more threat model errors;

determine, based on input from the operator, that the threat model is incomplete, wherein the input comprises a new threat vector, a new threat agent, a new threat impact, and a new computing component;

input the new threat vector, the new threat agent, the new threat impact, and the new computing component into a large language model to obtain a new threat statement for the threat model, wherein the large language model uses the textual representation of the threat model as a prompt for generating the new threat statement; and

update the threat model based on the corrections and the new threat statement, wherein updating the threat model comprises:

identifying, based on the corrections, one or more threat statements within the threat model to be corrected;

generating updated threat statements based on the corrections; and

executing, via an application programming interface (API), a call to the data node to update the data structure associated with the threat model to include the updated threat statements.

2 . A method comprising:

receiving, from a data node, a file representing a data structure of a threat model associated with an application, wherein the threat model comprises a textual representation of one or more threats for the application, and wherein the textual representation comprises, for each threat, one or more of a corresponding threat vector, a corresponding threat agent, a corresponding threat impact, or a corresponding computing component;

generating for display a representation of the threat model, wherein the representation is viewed by an operator;

determining, based on input from the operator, that the threat model is incomplete, wherein the input comprises, a new threat vector, a new threat agent, a new threat impact and a new computing component;

receiving, from an operator device, corrections to one or more threat model errors; and

updating the threat model based on the corrections, wherein updating the threat model comprises:

identifying, based on the corrections, one or more threat statements within the threat model to be corrected;

generating updated threat statements based on the corrections; and

executing, via an application programming interface (API), a call to the data node to update the data structure associated with the threat model to include the updated threat statements.

3 . The method of claim 2 , further comprising generating a model score for the threat model based on a number of threat model errors, a type of threat level errors, and a number of threat statements within the threat model.

4 . The method of claim 3 , further comprising generating a plurality of model score components affecting the model score, wherein the plurality of model score components comprises a threat vector component, a threat agent component, a threat impact component, and a computing component.

5 . The method of claim 4 , further comprising generating, based on the threat vector component, the threat agent component, the threat impact component, and the computing component, an explanation of the model score.

6 . The method of claim 5 , wherein generating the explanation of the model score comprises: inputting the corresponding threat vector, the corresponding threat agent, the corresponding threat impact, and the corresponding computing component into a score explanation machine learning model.

7 . The method of claim 2 , wherein the threat model is a structured file comprising textual and graphical data.

8 . The method of claim 2 , further comprising:

inputting the new threat vector, the new threat agent, the new threat impact and the new computing component into a large language model to obtain a new threat statement for the threat model, wherein the large language model uses the textual representation of the threat model as a prompt for generating the new threat statement; and

updating the threat model based on the new threat statement and the corrections.

9 . The method of claim 8 , further comprising:

determining, for the one or more threat model errors, corresponding one or more threat model components; and

generating for display on operator device the one or more threat model errors and representations of the corresponding one or more threat model components.

10 . The method of claim 8 , further comprising:

determining, based on the input of the operator, one or more additional prompts for the operator;

receiving, from the operator, additional input in response to the one or more additional prompts; and

inputting the additional input into the large language model.

11 . The method of claim 8 , further comprising:

generating a training prompt for the large language model to train the large language model using a plurality of threat vectors, a plurality of threat agents, and a plurality of impacts to identify errors threat vectors, threat agents, and impacts; and

inputting the prompt into the large language model.

12 . The method of claim 8 , further comprising:

receiving, from the large language model, the new threat statement for the threat model; and

inputting the new threat statement into an error determination machine learning model to obtain one or more threat statement errors.

13 . One or more non-transitory, computer-readable storage media storing instructions that when executed by one or more processors cause operations comprising:

generating for display a representation of the threat model, wherein the representation is viewed by an operator;

inputting at least part of the textual representation of the one or more threats for the application into an error determination machine learning model to obtain one or more threat model errors for the threat model;

receiving, from an operator device, corrections to the one or more threat model errors; and

updating the threat model based on the corrections, wherein updating the threat model comprises:

identifying, based on the corrections, one or more threat statements within the threat model to be corrected;

generating updated threat statements based on the corrections; and

executing, via an application programming interface (API), a call to the data node to update the data structure associated with the threat model to include the updated threat statements.

14 . The one or more non-transitory, computer-readable storage media of claim 13 , wherein the instructions further cause the one or more processors to generate a model score for the threat model based on a number of threat model errors, a type of threat level errors, and a number of threat statements within the threat model.

15 . The one or more non-transitory, computer-readable storage media of claim 14 , wherein the instructions further cause the one or more processors to generate a plurality of model score components affecting the model score, wherein the plurality of model score components comprises a threat vector component, a threat agent component, a threat impact component, and a computing component.

16 . The one or more non-transitory, computer-readable storage media of claim 15 , wherein the instructions further cause the one or more processors to generate, based on the threat vector component, the threat agent component, the threat impact component, and the computing component, an explanation of the model score.

17 . The one or more non-transitory, computer-readable storage media of claim 16 , wherein the instructions for generating the explanation of the model score further cause the one or more processors to input the corresponding threat vector, the corresponding threat agent, the corresponding threat impact, and the corresponding computing component into a score explanation machine learning model.

18 . The one or more non-transitory, computer-readable storage media of claim 13 , wherein the instructions further cause the one or more processors to perform operations comprising:

updating the threat model based on the new threat statement and the corrections.

19 . The one or more non-transitory, computer-readable storage media of claim 18 , wherein the instructions further cause the one or more processors to perform operations comprising:

determining, for the one or more threat model errors, corresponding one or more threat model components;

generating for display on the operator device the one or more threat model errors and representations of the corresponding one or more threat model components.

20 . The one or more non-transitory, computer-readable storage media of claim 18 , wherein the instructions further cause the one or more processors to perform operations comprising:

determining, based on the input of the operator, one or more additional prompts for the operator;

receiving, from the operator, additional input in response to the one or more additional prompts; and

inputting the additional input into the large language model.