Granted Patent B2

US 12,452,313 · App. 18/582,933 · Granted Oct 21, 2025

Inventor: Timucin Ozugur (Fairview, TX)

Assignee: Bank of America Corporation

H04L63/205H04L63/1433H04L63/1441

Abstract

Claims (76)

1. A computing platform comprising:

at least one processor;

a communication interface communicatively coupled to the at least one processor; and

memory storing computer-readable instructions that, when executed by the at least one processor, configure the computing platform to:

receive, based on cyberthreat modeling and vulnerability scanning of one or more applications corresponding to a network, information of cyberthreats and vulnerabilities corresponding to the one or more applications;

train, based on the information of cyberthreats and vulnerabilities, a zero trust model, wherein training the zero trust model configures the zero trust model to generate cyberthreat mappings for applications based on input of information of cyberthreats and vulnerabilities;

identify, based on one or more parameters, a first application, of the one or more applications, for cyberthreat testing;

generate, based on a subset of information, of the information of cyberthreats and vulnerabilities and corresponding to the first application, a cyberthreat mapping for the first application, wherein the cyberthreat mapping comprises a plurality of vulnerability-cyberthreat pairings and wherein the generating the cyberthreat mapping is further based on inputting the subset of information into the zero trust model;

generate, based on the cyberthreat mapping, a cyberthreat record, wherein the cyberthreat record comprises a representation of the cyberthreat mapping;

generate, by comparing the cyberthreat record to one or more trigger criteria, a cyberthreat level indicator for the first application, wherein the cyberthreat level indicator indicates a likelihood of a cyberthreat affecting the first application;

identify, by comparing the cyberthreat level indicator to a threshold, whether the cyberthreat level indicator satisfies the threshold;

initiate, based on identifying that the cyberthreat level indicator satisfies the threshold, one or more cyberthreat remediation actions for the application;

update, based on identifying whether the cyberthreat level indicator satisfies the threshold, the information of cyberthreats and vulnerabilities; and

update, based on the updated information of cyberthreats and vulnerabilities, the zero trust model.

2. The computing platform of claim 1 , wherein the updating the zero trust model is further based on the initiating the one or more cyberthreat remediation actions.

3. The computing platform of claim 1 , wherein the cyberthreat modeling comprises identifying, based on a design of the first application, one or more potential cyberthreats to the network and the vulnerability scanning comprises identifying whether the one or more potential cyberthreats are resolved.

4. The computing platform of claim 1 , wherein the identifying the first application for cyberthreat testing comprises:

identifying whether a threshold amount of time corresponding to cyberthreat testing of the first application is satisfied, or

identifying whether an update time corresponding to the first application antedates a cyberthreat testing time corresponding to the first application.

5. The computing platform of claim 1 , wherein the trigger criteria comprises one or more of:

a ratio of incorrectly closed cyberthreats to correctly closed cyberthreats,

a negative divergence between vulnerability scans of the first application, or

a divergence between a ratio of unverified cyberthreats and a ratio of verified cyberthreats.

6. The computing platform of claim 1 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, further configure the computing platform to:

cause, based on identifying that the cyberthreat level indicator satisfies the threshold and prior to the initiating the one or more cyberthreat remediation actions, display of a cyberthreat remediation interface.

7. The computing platform of claim 1 , wherein the one or more cyberthreat remediation actions comprise one or more of:

identifying, for each of the plurality of vulnerability-cyberthreat pairings, whether an associated cyberthreat is resolved, or

resolving, based on the plurality of vulnerability-cyberthreat pairings, one or more cyberthreats.

8. A method comprising:

at a computing device comprising at least one processor, a communication interface, and memory:

receiving, based on cyberthreat modeling and vulnerability scanning of one or more applications corresponding to a network, information of cyberthreats and vulnerabilities corresponding to the one or more applications;

training, based on the information of cyberthreats and vulnerabilities, a zero trust model, wherein training the zero trust model configures the zero trust model to generate cyberthreat mappings for applications based on input of information of cyberthreats and vulnerabilities;

identifying, based on one or more parameters, a first application, of the one or more applications, for cyberthreat testing;

generating, based on a subset of information, of the information of cyberthreats and vulnerabilities and corresponding to the first application, a cyberthreat mapping for the first application, wherein the cyberthreat mapping comprises a plurality of vulnerability-cyberthreat pairings and wherein the generating the cyberthreat mapping is based on inputting the subset of information into the zero trust model;

generating, based on the cyberthreat mapping, a cyberthreat record, wherein the cyberthreat record comprises a representation of the cyberthreat mapping;

generating, by comparing the cyberthreat record to one or more trigger criteria, a cyberthreat level indicator for the first application, wherein the cyberthreat level indicator indicates a likelihood of a cyberthreat affecting the first application;

identifying, by comparing the cyberthreat level indicator to a threshold, whether the cyberthreat level indicator satisfies the threshold;

initiating, based on identifying that the cyberthreat level indicator satisfies the threshold, one or more cyberthreat remediation actions for the application;

updating, based on identifying whether the cyberthreat level indicator satisfies the threshold, the information of cyberthreats and vulnerabilities; and

updating, based on the updated information of cyberthreats and vulnerabilities, the zero trust model.

9. The method of claim 8 , wherein the updating the zero trust model is further based on the initiating the one or more cyberthreat remediation actions.

10. The method of claim 8 , wherein the cyberthreat modeling comprises identifying, based on a design of the first application, one or more potential cyberthreats to the network and the vulnerability scanning comprises identifying whether the one or more potential cyberthreats are resolved.

11. The method of claim 8 , wherein the identifying the first application for cyberthreat testing comprises:

identifying whether a threshold amount of time corresponding to cyberthreat testing of the first application is satisfied, or

identifying whether an update time corresponding to the first application antedates a cyberthreat testing time corresponding to the first application.

12. The method of claim 8 , further comprising:

cause, based on identifying that the cyberthreat level indicator satisfies the threshold and prior to the initiating the one or more cyberthreat remediation actions, display of a cyberthreat remediation interface.

13. The method of claim 8 , wherein the trigger criteria comprises one or more of:

a ratio of incorrectly closed cyberthreats to correctly closed cyberthreats,

a negative divergence between vulnerability scans of the first application, or

a divergence between a ratio of unverified cyberthreats and a ratio of verified cyberthreats.

14. The method of claim 8 , wherein the one or more cyberthreat remediation actions comprise one or more of:

identifying, for each of the plurality of vulnerability-cyberthreat pairings, whether an associated cyberthreat is resolved, or

resolving, based on the plurality of vulnerability-cyberthreat pairings, one or more cyberthreats.

15. One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to:

receive, based on cyberthreat modeling and vulnerability scanning of one or more applications corresponding to a network, information of cyberthreats and vulnerabilities corresponding to the one or more applications;

train, based on the information of cyberthreats and vulnerabilities, a zero trust model, wherein training the zero trust model configures the zero trust model to generate cyberthreat mappings for applications based on input of information of cyberthreats and vulnerabilities;

identify, based on one or more parameters, a first application, of the one or more applications, for cyberthreat testing;

generate, based on a subset of information, of the information of cyberthreats and vulnerabilities and corresponding to the first application, a cyberthreat mapping for the first application, wherein the cyberthreat mapping comprises a plurality of vulnerability-cyberthreat pairings and wherein the generating the cyberthreat mapping is based on inputting the subset of information into the zero trust model;

generate, based on the cyberthreat mapping, a cyberthreat record, wherein the cyberthreat record comprises a representation of the cyberthreat mapping;

generate, by comparing the cyberthreat record to one or more trigger criteria, a cyberthreat level indicator for the first application, wherein the cyberthreat level indicator indicates a likelihood of a cyberthreat affecting the first application;

identify, by comparing the cyberthreat level indicator to a threshold, whether the cyberthreat level indicator satisfies the threshold;

initiate, based on identifying that the cyberthreat level indicator satisfies the threshold, one or more cyberthreat remediation actions for the application;

update, based on identifying whether the cyberthreat level indicator satisfies the threshold, the information of cyberthreats and vulnerabilities; and

update, based on the updated information of cyberthreats and vulnerabilities, the zero trust model.

16. The one or more non-transitory computer-readable media of claim 15 , wherein the updating the zero trust model is further based on the initiating the one or more cyberthreat remediation actions.

17. The one or more non-transitory computer-readable media of claim 15 , wherein the cyberthreat modeling comprises identifying, based on a design of the first application, one or more potential cyberthreats to the network and the vulnerability scanning comprises identifying whether the one or more potential cyberthreats are resolved.

18. The one or more non-transitory computer-readable media of claim 15 , wherein the identifying the first application for cyberthreat testing comprises:

identifying whether a threshold amount of time corresponding to cyberthreat testing of the first application is satisfied, or

identifying whether an update time corresponding to the first application antedates a cyberthreat testing time corresponding to the first application.

19. The one or more non-transitory computer-readable media of claim 15 , storing instructions that, when executed, further cause the computing platform to:

cause, based on identifying that the cyberthreat level indicator satisfies the threshold and prior to the initiating the one or more cyberthreat remediation actions, display of a cyberthreat remediation interface.

20. The one or more non-transitory computer-readable media of claim 15 , wherein the trigger criteria comprises one or more of:

a ratio of incorrectly closed cyberthreats to correctly closed cyberthreats,

a negative divergence between vulnerability scans of the first application, or

a divergence between a ratio of unverified cyberthreats and a ratio of verified cyberthreats.

Assignments (1)

Continuity (1)

References Cited (32)