Granted Patent B2

US 12,608,486 · App. 18/607,141 · Granted Apr 21, 2026

Inventors: William Franklin Cameron (Jacksonville, FL); Pramod Goyal (Ahmedabad, IN); Prithvi Narayana Rao (Allen, TX); Manjit Rajaretnam (Irving, TX); Miriam Silver (New York, NY)

Assignee: CITIBANK, N.A.

G06F21/577G06F21/552

Abstract

Claims (72)

1 . A system for generating predicted end-to-end cyber-security attack characteristics via bifurcated machine learning-based processing of multi-modal data, the system comprising:

at least one hardware processor; and

at least one non-transitory memory storing instructions, which, when executed by the at least one hardware processor, cause the system to:

access multi-modal data indicating a set of security information related to a computing system of an entity, the multi-modal data comprising (i) security attributes of computing system components of the computing system, (ii) security policy information of the computing system of the entity, and (iii) third party-derived security vulnerability information;

apply a supervised machine learning model to the multi-modal data to generate a set of extracted characteristics indicating a cyber-security attack on the computing system of the entity,

wherein the supervised machine learning model is trained on historical multi-modal data indicating labeled subsets of the historical multi-modal data, and

wherein the labeled subsets of the historical multi-modal data indicate whether the subset of the historical multi-modal data indicates a cyber-security attack;

apply an embedding model to the extracted set of characteristics indicating the cyber-security attack to generate a vectorized representation of the extracted set of characteristics indicating the cyber-security attack;

apply an unsupervised machine learning model to the vectorized representation of the extracted set of characteristics indicating the cyber-security attack to generate a revised set of extracted characteristics indicating the cyber-security attack on the computing system of the entity,

wherein the revised set of extracted characteristics includes at least one new characteristic that was not included in the extracted set of characteristics indicating the cyber-security attack on the computing system of the entity;

execute a mitigation action responsive to the revised set of extracted characteristics indicating the cyber-security attack, wherein the mitigation action comprises a platform usage mitigation action, a data storage mitigation action, a cryptography mitigation action, a network communication mitigation action, or a client code integration mitigation action; and

generate for display, at a graphical user interface (GUI), a graphical representation of the revised set of extracted characteristics indicating the cyber-security attack on the computing system of the entity.

2 . The system of claim 1 , wherein the instructions, which, when executed by the at least one hardware processor, cause the system to:

store the revised set of extracted characteristics indicating the cyber-security attack on the computing system of the entity in a database; and

in response to storing the revised set of extracted characteristics indicating the cyber-security attack on the computing system of the entity, cause a training routine to be performed on the supervised machine learning model, the training routine comprising updating one or more parameters of the supervised machine learning model based on the revised set of characteristics indicating the cyber-security attack.

3 . The system of claim 2 , wherein the instructions, which, when executed by the at least one hardware processor, cause the system to:

prior to causing the training routine to be performed on the supervised machine learning model, receive a verification indication of the revised set of extracted characteristics indicating the cyber-security attack on the computing system of the entity from a user; and

in response to receiving a positive verification indication of the revised set of extracted characteristics indicating the cyber-security attack on the computing system of the entity from the user, cause the training routine to be performed on the supervised machine learning model.

4 . The system of claim 1 , wherein the supervised machine learning model comprises a set of supervised machine learning models, and wherein the instructions, which, when executed by the at least one hardware processor, cause the system to:

categorize the multi-modal data into a set of categories corresponding to a data format of the security information related to the computing system of the entity;

determine, for each supervised machine learning model of the set of supervised machine learning models, a data format that the respective supervised machine learning model is configured to receive; and

generate the set of extracted characteristics indicating the cyber-security attack on the computing system of the entity by:

for each category of the set of categories of the multi-modal data, providing the respective category of the multi-modal data as input to a respective supervised machine learning model based on a matching data format of (i) the respective category and (ii) the respective supervised machine learning model.

5 . The system of claim 1 , wherein the unsupervised machine learning model comprises a generative adversarial network (GAN), the generative adversarial network comprising a generator component and a discriminator component, the generator component being a variational auto encoder (VAE) configured to generate synthetic data representing characteristics of the cyber-security attack on the computing system of the entity.

6 . The system of claim 1 , wherein the revised set of extracted characteristics indicating the cyber-security attack on the computing system of the entity is provided to a blackboard machine learning model to generate computing-aspect impact levels reflecting a measure of security for a second computing system platform.

7 . A method for generating predicted end-to-end cyber-security attack characteristics via bifurcated machine learning-based processing of multi-modal data, the method comprising:

accessing multi-modal data indicating a set of security information related to a computing system of an entity;

applying a supervised machine learning model to the multi-modal data to generate a set of extracted characteristics indicating a cyber-security attack on the computing system of the entity,

wherein the supervised machine learning model is trained on historical multi-modal data indicating labeled subsets of the historical multi-modal data, and

wherein the labeled subsets of the historical multi-modal data indicate whether the subset of the historical multi-modal data indicates a cyber-security attack;

applying an unsupervised machine learning model to the extracted set of characteristics indicating the cyber-security attack to generate a revised set of extracted characteristics indicating the cyber-security attack on the computing system of the entity,

wherein the revised set of extracted characteristics includes at least one new characteristic that was not included in the extracted set of characteristics indicating the cyber-security attack on the computing system of the entity;

execute a mitigation action responsive to the revised set of extracted characteristics indicating the cyber-security attack, wherein the mitigation action comprises a platform usage mitigation action, a data storage mitigation action, a cryptography mitigation action, a network communication mitigation action, or a client code integration mitigation action; and

generating for display a graphical representation of the revised set of extracted characteristics indicating the cyber-security attack on the computing system of the entity.

8 . The method of claim 7 , further comprising:

applying an embedding model to the extracted set of characteristics indicating the cyber-security attack to generate a vectorized representation of the extracted set of characteristics indicating the cyber-security attack.

9 . The method of claim 7 , wherein the multi-modal data comprises (i) security attributes of computing system components of the computing system, (ii) security policy information of the computing system of the entity, and (iii) third party-derived security vulnerability information.

10 . The method of claim 7 , further comprising:

storing the revised set of extracted characteristics indicating the cyber-security attack on the computing system of the entity in a database; and

in response to storing the revised set of extracted characteristics indicating the cyber-security attack on the computing system of the entity, causing a training routine to be performed on the supervised machine learning model, the training routine comprising updating one or more parameters of the supervised machine learning model based on the revised set of characteristics indicating the cyber-security attack.

11 . The method of claim 10 , further comprising:

prior to causing the training routine to be performed on the supervised machine learning model, receiving a verification indication of the revised set of extracted characteristics indicating the cyber-security attack on the computing system of the entity from a user; and

in response to receiving a positive verification indication of the revised set of extracted characteristics indicating the cyber-security attack on the computing system of the entity from the user, causing the training routine to be performed on the supervised machine learning model, wherein the positive verification indication of the revised set of extracted characteristics is received.

12 . The method of claim 7 , wherein the supervised machine learning model comprises a set of supervised machine learning models, and wherein the method further comprises:

categorizing the multi-modal data into a set of categories corresponding to a data format of the security information related to the computing system of the entity;

determining, for each supervised machine learning model of the set of supervised machine learning models, a data format that the respective supervised machine learning model is configured to receive; and

generating the set of extracted characteristics indicating the cyber-security attack on the computing system of the entity by:

for each category of the set of categories of the multi-modal data, providing the respective category of the multi-modal data as input to a respective supervised machine learning model based on a matching data format of (i) the respective category and (ii) the respective supervised machine learning model.

13 . The method of claim 7 , wherein the unsupervised machine learning model comprises a generative adversarial network (GAN), the generative adversarial network comprising a generator component and a discriminator component, the generator component being a variational auto encoder (VAE) configured to generate synthetic data representing characteristics of the cyber-security attack on the computing system of the entity.

14 . The method of claim 7 , wherein the revised set of extracted characteristics indicating the cyber-security attack on the computing system of the entity is provided to a blackboard machine learning model to generate computing-aspect impact levels reflecting a measure of security for a second computing system platform.

15 . One or more non-transitory, computer-readable media comprising instructions that, when executed by one or more processors, cause operations comprising:

accessing multi-modal data indicating a set of security information related to a computing system of an entity;

applying a supervised machine learning model to the multi-modal data to generate a set of extracted characteristics indicating a cyber-security attack on the computing system of the entity,

wherein the supervised machine learning model is trained on historical multi-modal data indicating labeled subsets of the historical multi-modal data, and

wherein the labeled subsets of the historical multi-modal data indicate whether the subset of the historical multi-modal data indicates a cyber-security attack;

applying an unsupervised machine learning model to the extracted set of characteristics indicating the cyber-security attack to generate a revised set of extracted characteristics indicating the cyber-security attack on the computing system of the entity,

wherein the revised set of extracted characteristics includes at least one new characteristic that was not included in the extracted set of characteristics indicating the cyber-security attack on the computing system of the entity;

execute a mitigation action responsive to the revised set of extracted characteristics indicating the cyber-security attack, wherein the mitigation action comprises a platform usage mitigation action, a data storage mitigation action, a cryptography mitigation action, a network communication mitigation action, or a client code integration mitigation action; and

generating for display a graphical representation of the revised set of extracted characteristics indicating the cyber-security attack on the computing system of the entity.

16 . The media of claim 15 , wherein the instructions, when executed by the one or more processors, further cause operations comprising:

storing the revised set of extracted characteristics indicating the cyber-security attack on the computing system of the entity in a database; and

in response to storing the revised set of extracted characteristics indicating the cyber-security attack on the computing system of the entity, causing a training routine to be performed on the supervised machine learning model, the training routine comprising updating one or more parameters of the supervised machine learning model based on the revised set of characteristics indicating the cyber-security attack.

17 . The media of claim 16 , wherein the instructions, when executed by the one or more processors, further cause operations comprising:

prior to causing the training routine to be performed on the supervised machine learning model, receiving a verification indication of the revised set of extracted characteristics indicating the cyber-security attack on the computing system of the entity from a user; and

in response to receiving a positive verification indication of the revised set of extracted characteristics indicating the cyber-security attack on the computing system of the entity from the user, causing the training routine to be performed on the supervised machine learning model.

18 . The media of claim 15 , wherein the supervised machine learning model comprises a set of supervised machine learning models, and wherein the instructions, when executed by the one or more processors, further cause operations comprising:

categorizing the multi-modal data into a set of categories corresponding to a data format of the security information related to the computing system of the entity;

determining, for each supervised machine learning model of the set of supervised machine learning models, a data format that the respective supervised machine learning model is configured to receive; and

generating the set of extracted characteristics indicating the cyber-security attack on the computing system of the entity by:

for each category of the set of categories of the multi-modal data, providing the respective category of the multi-modal data as input to a respective supervised machine learning model based on a matching data format of (i) the respective category and (ii) the respective supervised machine learning model.

19 . The media of claim 15 , wherein the unsupervised machine learning model comprises a generative adversarial network (GAN), the generative adversarial network comprising a generator component and a discriminator component, the generator component being a variational auto encoder (VAE) configured to generate synthetic data representing characteristics of the cyber-security attack on the computing system of the entity.

20 . The media of claim 15 , wherein the revised set of extracted characteristics indicating the cyber-security attack on the computing system of the entity is provided to a blackboard machine learning model to generate computing-aspect impact levels reflecting a measure of security for a second computing system platform.

Assignments (1)

Continuity (5)

References Cited (250)