US 11,914,709 B2
Hybrid machine learning and knowledge graph approach for estimating and mitigating the spread of malicious software
George Anthony Albero, Charlotte, NC (US); and Maharaj Mukherjee, Poughkeepsie, NY (US)
Assigned to Bank of America Corporation, Charlotte, NC (US)
Filed by Bank of America Corporation, Charlotte, NC (US)
Filed on Jul. 20, 2021, as Appl. No. 17/380,450.
Prior Publication US 2023/0026135 A1, Jan. 26, 2023
Int. Cl. G06F 21/56 (2013.01); G06N 5/04 (2023.01); G06N 20/00 (2019.01)
CPC G06F 21/566 (2013.01) [G06N 5/04 (2013.01); G06N 20/00 (2019.01); G06F 2221/033 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computing platform comprising:
at least one processor;
a communication interface communicatively coupled to the at least one processor; and
memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
generate a knowledge graph that includes a plurality of computing devices and indicates relationships between the plurality of computing devices;
train, using historical information, a machine learning model, wherein training the machine learning model configures the machine learning model to predict time horizons for spread of malicious software, wherein each of the time horizons includes a subset of the plurality of computing devices;
identify malicious software at one computing device of the plurality of computing devices;
input characteristics of the malicious software into the machine learning model to produce time horizons for the identified malicious software;
identify, using the knowledge graph and based on the time horizons for the identified malicious software, subsets of the plurality of computing devices, each corresponding to a particular time horizon; and
perform, at a time within a first time horizon, a first security action for at least a first subset of the plurality of computing devices located within the first time horizon and a second security action for at least a second subset of the plurality of computing devices located within a second time horizon, wherein the first time horizon and the second time horizon indicate that the first subset of the plurality of computing devices will be affected by the identified malicious software prior to the second subset of the plurality of computing devices.