Patent application EP21176516A (EP), filed 2021-05-28
Publication number: EP3926503A1
Title: DYNAMICALLY PROVIDING CYBERSECURITY TRAINING BASED ON USER-SPECIFIC THREAT INFORMATION
Abstract: Aspects of the disclosure relate to dynamically providing cybersecurity training based on user-specific threat information. A computing platform may receive (505), from a targeted attack protection (TAP) server, user-specific threat information indicating at least one threat that has been encountered by at least one user. The computing platform may identify (510) one or more users to receive cybersecurity training in a first cybersecurity training topic based on the user-specific threat information indicating the at least one threat that has been encountered by the at least one user. Subsequently, the computing platform may load (515) one or more cybersecurity training modules based on identifying the one or more users to receive the cybersecurity training in the first cybersecurity training topic. Then, the computing platform may provide (520) the one or more cybersecurity training modules to one or more user computing devices.
IPC codes: G06F  21/    56            A I
G06F  21/    57            A I
G06N  20/    00            A I
H04L  29/    06            A I
Claims: number: 1
text: A computer-implemented method, comprising:
number: 2
text: The method of claim 1, wherein receiving (208, 505) the user-specific threat information indicating the at least one threat that has been encountered by the at least one user comprises receiving information stored by the TAP server (120) based on the TAP server (120) monitoring (202) email traffic and identifying (203) cybersecurity threats associated with the email traffic.
number: 3
text: The method of claim 1 or 2, wherein receiving (208, 505) the user-specific threat information indicating the at least one threat that has been encountered by the at least one user comprises receiving information indicating that a first enterprise user has encountered a first message-based threat and a second enterprise user has encountered a second message-based threat.
number: 4
text: The method of claim 1, 2 or 3, wherein receiving (208, 505) the user-specific threat information indicating the at least one threat that has been encountered by the at least one user comprises receiving information indicating one or more user identifiers and one or more specific threats corresponding to the one or more user identifiers.
number: 5
text: The method of any of the preceding claims, wherein receiving (208, 505) the user-specific threat information indicating the at least one threat that has been encountered by the at least one user comprises receiving threat family information associated with the at least one user and threat degree information associated with the at least one user.
number: 6
text: The method of any of the preceding claims, wherein identifying (209, 510) the one or more users to receive the cybersecurity training in the first cybersecurity training topic based on the user-specific threat information indicating the at least one threat that has been encountered by the at least one user comprises identifying a first user of the one or more users to receive the cybersecurity training in the first cybersecurity training topic based on the user-specific threat information indicating that the first user has encountered a specific threat corresponding to the first cybersecurity training topic.
number: 7
text: The method of any of the preceding claims, wherein identifying (209, 510) the one or more users to receive the cybersecurity training in the first cybersecurity training topic based on the user-specific threat information indicating the at least one threat that has been encountered by the at least one user comprises identifying a second user of the one or more users to receive the cybersecurity training in the first cybersecurity training topic based on the user-specific threat information indicating that the second user is a top clicker and/or a very attacked person, VAP.
number: 8
text: The method of any of the preceding claims, wherein providing (212, 520) the one or more cybersecurity training modules to the one or more user computing devices (140, 150) comprises:
number: 9
text: The method of any of the preceding claims, wherein providing (212, 520) the one or more cybersecurity training modules to the one or more user computing devices (140, 150) comprises automatically enrolling a specific user in a specific training module.
number: 10
text: The method of any of the preceding claims, further comprising:
number: 11
text: The method of any of the preceding claims, further comprising:
number: 12
text: The method of claim 11, further comprising:
number: 13
text: A data processing apparatus comprising at least one processor (111) configured to perform the method of any of the preceding claims.
number: 14
text: A computer-readable medium comprising instructions which, when executed by a computer (110), cause the computer (110) to carry out the method of any of claims 1-12.
number: 15
text: A computer program product comprising instructions which, when the program is executed by a computer (110), cause the computer (110) to carry out the method of any of claims 1-12.
Office action: search_report, dated 2021-12-22
Rejection reasons: novelty_epc_54
Prior art cited: ref_id: US2019173919A1
ref_type: patent
severity: background
ref_id: US2013203023A1
ref_type: patent
severity: background
ref_id: US2014199664A1
ref_type: patent
severity: background
ref_id: US2014199663A1
ref_type: patent
severity: background
ref_id: US2018041537A1
ref_type: patent
severity: background
ref_id: US2013203023
ref_type: patent
severity: novelty_destroying
ref_id: US2014199664
ref_type: patent
severity: novelty_destroying
ref_id: US2014199663
ref_type: patent
severity: novelty_destroying
ref_id: US2019173919
ref_type: patent
severity: novelty_destroying
Final disposition: pending (2021-12-22)