Granted Patent B2

US 12,452,284 · App. 18/343,716 · Granted Oct 21, 2025

Inventors: Jason Crabtree (Vienna, VA); Richard Kelley (Woodbridge, VA)

Assignee: QOMPLX LLC

H04L63/1433H04L63/20

Abstract

Claims (52)

1. An artificial-intelligence-assisted (AI-assisted) cyberattack mission planning system, comprising:

a computing device comprising a memory, a processor, and a non-volatile data storage device;

a first machine learning algorithm operating on the computing device and trained to generate a cyberattack scenario based on information from a knowledge graph;

a knowledge graph stored on the non-volatile data storage device, the knowledge graph comprising nodes representing entities, concepts, or events, and edges representing relationships between the nodes, wherein the knowledge graph represents knowledge about a computer network;

an ontology manager comprising a first plurality of programming instructions stored in the memory which, when operating on the processor, causes the computing device to:

retrieve cybersecurity context information from a cybersecurity database;

organize the cybersecurity context information into an ontology;

receive information about the computer network, the information comprising a network configuration; and

create nodes and edges in the knowledge graph to store the information about the computer network according to the ontology

an incident generator comprising a second plurality of programming instructions stored in the memory which, when operating on the processor, causes the computing device to:

retrieve a cybersecurity threat in the form of a tactic, techniques, or procedure from the cybersecurity database;

process the cybersecurity threat through the first machine learning algorithm to generate a cyberattack scenario for the computer network based on the information about the computer network contained in the knowledge graph; and

generate a cybersecurity incident for the computer network from the cyberattack scenario, the cybersecurity incident comprising an attack mode and event severity.

2. The system of claim 1 , further comprising a control center comprising a third plurality of programming instructions stored in the memory which, when operating on the processor, causes the computing device to:

carry out the cybersecurity incident on the computer network; and

display a visualization of the progress of the cybersecurity incident.

3. The system of claim 2 , further comprising a second machine learning algorithm trained to suggest defense strategies for mitigating the cybersecurity incident.

4. The system of claim 3 , further comprising a blue team portal which provides the defense strategies to a blue team comprising information technology (IT) personnel or cybersecurity analysts assigned to mitigate the cybersecurity incident.

5. The system of claim 4 , further comprising a third machine learning algorithm trained to suggest attack strategies to overcome the defense strategies.

6. The system of claim 5 , further comprising a red team portal which provides the attack strategies to a red team comprising IT personnel or cybersecurity analysts assigned to expose weaknesses in the security of the computer network based on the cybersecurity incident.

7. The system of claim 2 , further comprising an incident monitor comprising a fourth plurality of programming instructions stored in the memory which, when operating on the processor, causes the computing device to log cyber metrics for the computer network during the course of the carrying out of the cybersecurity incident.

8. The system of claim 7 , further comprising an underwriting module comprising a fifth plurality of programming instructions stored in the memory which, when operating on the processor, causes the computing device to:

retrieve a cybersecurity insurance policy, the cybersecurity insurance policy comprising a policy term;

retrieve a cyber metric relevant to the policy term from the log of cyber metrics;

compare the cyber metric to the policy terms to determine a compliance of the cyber metric to the policy term; and

output the determination of compliance.

9. An artificial-intelligence-assisted (AI-assisted) cyberattack mission planning method, comprising the steps of:

a computing device comprising a memory, a processor, and a non-volatile data storage device;

training a first machine learning algorithm operating on a computing device comprising a memory, a processor, and a non-volatile data storage device to generate a cyberattack scenario based on information from a knowledge graph;

storing a knowledge graph stored on the non-volatile data storage device, the knowledge graph comprising nodes representing entities, concepts, or events, and edges representing relationships between the nodes, wherein the knowledge graph represents knowledge about a computer network;

using an ontology manager operating on the computing device to:

retrieve cybersecurity context information from a cybersecurity database;

organize the cybersecurity context information into an ontology;

receive information about the computer network, the information comprising a network configuration; and

create nodes and edges in the knowledge graph to store the information about the computer network according to the ontology

using an incident generator operating on the computing device to:

retrieve a cybersecurity threat in the form of a tactic, techniques, or procedure from the cybersecurity database;

process the cybersecurity threat through the first machine learning algorithm to generate a cyberattack scenario for the computer network based on the information about the computer network contained in the knowledge graph; and

generate a cybersecurity incident for the computer network from the cyberattack scenario, the cybersecurity incident comprising an attack mode and event severity.

10. The method of claim 9 , further comprising the step of using a control center operating on the computing device to:

carry out the cybersecurity incident on the computer network; and

display a visualization of the progress of the cybersecurity incident.

11. The method of claim 10 , further comprising the step of training a second machine learning algorithm to suggest defense strategies for mitigating the cybersecurity incident.

12. The method of claim 11 , further comprising the step of providing the defense strategies to a blue team comprising information technology (IT) personnel or cybersecurity analysts assigned to mitigate the cybersecurity incident via a blue team portal.

13. The method of claim 12 , further comprising the step of training a third machine learning algorithm to suggest attack strategies to overcome the defense strategies.

14. The method of claim 13 , further comprising the step of providing the attack strategies to a red team comprising IT personnel or cybersecurity analysts assigned to expose weaknesses in the security of the computer network based on the cybersecurity incident via a red team portal.

15. The method of claim 14 , further comprising the step of using an underwriting module operating on the computing device to:

retrieve a cybersecurity insurance policy, the cybersecurity insurance policy comprising a policy term;

retrieve a cyber metric relevant to the policy term from the log of cyber metrics;

compare the cyber metric to the policy terms to determine a compliance of the cyber metric to the policy term; and

output the determination of compliance.

16. The method of claim 9 , further comprising the step of using an incident monitor operating on the computing device to log cyber metrics for the computer network during the course of the carrying out of the cybersecurity incident.

Assignments (6)

Continuity (1)

References Cited (110)