Abstract: Disclosed is a system and method for grounded query generation over heterogeneous data sources. The method includes receiving a user input corresponding to a user requirement from at least one user, extracting a plurality of sub-models corresponding to the received user input, creating a context of the received user input based on the extracted plurality of sub-models, generating an executable query in a specific query language based on the context using a Large Language Model (LLM) by processing the context and the user input within a structured prompt, validating the generated executable query using a multi-stage validation process, generating an LLM response for the received user input based on results of the validation, and outputting the generated LLM response on a user interface of a user device.

Abstract: Implementations are directed to methods, systems, and apparatus for automated prioritization of cyber risk to digital identities. Actions include obtaining graph data defining a knowledge graph including nodes and edges, the nodes representing respective objects of the enterprise network including digital identities and resources, each node being associated with an explicit risk score and properties of the represented object, each edge representing a relation between objects; determining priority scores for the objects, including, for a first object represented by a first node: determining an implicit risk score for the first node; determining a total risk score for the first node; and determining a priority score for the first node based on the total risk score and properties associated with the first node; generating a ranking of the objects according to the priority scores; and providing, for presentation on a display, cyber security risk data indicating the ranking of the objects.

Abstract: Implementations include a computer-implemented method comprising: obtaining data representing observed conditions in an enterprise network, each observed condition being associated with at least one cybersecurity issue, a cybersecurity issue comprising one of (i) a vulnerability comprising an instance of a vulnerable condition or (ii) a weakness that is likely to cause a vulnerability to occur; using a plurality of exploitation prediction models to determine probabilities of exploitation of the cybersecurity issues associated with the observed conditions in the enterprise network, wherein the plurality of exploitation prediction models are trained using a knowledge mesh generated using data from cybersecurity repositories; assigning a priority ranking to each of the observed conditions in the enterprise network based on the respective probabilities of exploitation for the cybersecurity issues associated with the observed conditions; and performing one or more actions to mitigate the observed conditions in the

Abstract: Implementations include methods, systems, computer-readable storage medium for mitigating cyber security risk of an enterprise network. A method includes: receiving an initial analytic attack graph (AAG) that is representative of paths within the enterprise network with respect to at least one target asset, the initial AAG comprising nodes and edges between the nodes; identifying, from the nodes of the initial AAG, a plurality of node groups, each node group including two or more nodes having at least one common attribute; generating an abstract AAG from the initial AAG, the abstract AAG including at least one abstract node, wherein each node group of the initial AAG is represented by a respective abstract node of the abstract AAG; determining a set of remedial actions at least partially based on the abstract AAG; and executing remedial actions in the set of remedial actions to reduce a cyber security risk to the enterprise network.

Abstract: A system that generates an explicit plan to separately guide multiple mechanisms to collectively generate a response to an event. The multiple mechanisms can include a program generation mechanism and a response generation mechanism, each of which may be provided with the generated plan. Each mechanism can utilize a prediction engine, such as for example a machine learning model or large language model, to perform a task based on the generated plan. The event can include an event triggered based on an interaction between an automated agent and a customer. The plan may be generated using a state machine, a machine learning model, such as for example a large language model, or some other mechanism. The plan can be structured such that it can be interpreted and audited for conformance with predefined constraints.

Abstract: System and method for generating an attack flow graph are disclosed. The method includes, receiving a cyber-attack report from a user device, extracting one or more attack actions from the cyber-attack report, extracting one or more attack assets from the cyber-attack report, determining one or more conditions and one or more operators associated with the one or more attack actions and the one or more attack assets. The method further includes, generating a subgraph using the one or more attack actions, the one or more attack assets, the one or more conditions and the one or more operators, generating an attack flow graph, wherein the attack flow graph is generated based on the subgraph, the cyber-attack report and an attack flow schema, and storing the attack flow graph in an attack flow knowledgebase.

Abstract: A system automatically imputes automated agent decision logic. An interaction record is used with other data to determine an optimal and efficient logical path from a starting point in an interaction record to the end of the interaction record between an automated agent and a client. The logical path can be determined using a process that works backward, from the end point to the starting point, to determine the optimal path. Once complete, the resulting interaction record is supplemented with additional information regarding what states and/or steps were taken in the agent architecture specification to navigate through the interaction record.

Abstract: A system provides a language model that utilizes an optimized parser and operates at the byte- level in a context free grammar (CFG) and a tokenizer vocabulary. The CFG is constrained and automatically transformed to a byte-level grammar. A prediction mechanism is used to predict the allowed sequences of bytes that can appear after a given prefix. In some instances, only the next token is constrained so that candidates for the next token can be intersected with tokens in the tokenizer vocabulary. To achieve this, lattice parsing is performed using a finite state automaton (FSA) that is generated and then minimized.

Abstract: The present technology, roughly described, generates grammars, such as context free grammars, dynamically and by induction, that can specify constraints for a decoding system. The grammar can be created to support an automated agent involved in an interaction (e.g., a conversation) with a client. In some instances, grammars can be generated dynamically based on copying portions of an interaction history and based on business logic rules. Grammars can also be induced automatically from API specifications and collections of strings. The newly generated context free grammars can be used by a language model to perform constrained decoding.

Abstract: Implementations include receiving graph data representative of a process-aware analytical attack graph (AAG) representing paths within an enterprise network with respect to observed facts of the enterprise network, the process-aware AAG at least partially defining a digital twin of the enterprise network, receiving data indicating at least one non-observed fact of the enterprise network, generating, from the graph data and the received data, an augmented process-aware AAG representing paths within the enterprise network with respect to the observed facts and the at least one non-observed fact, determining, by a process-aware risk assessment module, a risk assessment based on the augmented process-aware AAG, and providing, by a mitigation simulator module, a mitigation list based on the process-aware AAG and the risk assessment, the mitigation list comprising a prioritized list of observed facts of the process-aware AAG.

Abstract: Implementations include a computer-implemented method for reducing cyber-security risk, comprising: selecting one or more modules for inclusion in a knowledge mesh, wherein each module is associated with a respective aspect and maintains a knowledge graph specific to the respective aspect, wherein each knowledge graph is generated using data from one or more cyber-security repositories and includes nodes and connections between the nodes; receiving a query corresponding to a first node of a first knowledge graph included in the knowledge mesh; generating a response to the query by identifying connections between the first node of the first knowledge graph and at least one node of at least one other knowledge graph included in the knowledge mesh; and identifying, based on the response to the query, one or more actions to reduce cyber-security risk.

Abstract: The system provides improved controls for an automated agent by generating a declarative specification for an automated agent. The declarative specification is generated based at least in part from previous conversation data associated with interactions between an automated agent and a customer. The policies may include general policies and specific policies. A general policy is one that is applied to all automated agents. After creating the declarative specification, an automated agent can interact with a customer in an interaction based on the specification. The automated agent responses are evaluated based on checklists associated with the policies to determine if a response was proper.

Abstract: Implementations include a computer-implemented method for reducing cyber-security risk, comprising: accessing a knowledge mesh including a plurality of modules, wherein each module is associated with a respective aspect and maintains a knowledge graph specific to the respective aspect, wherein each knowledge graph is generated using data from one or more cyber-security repositories and includes nodes and connections between the nodes; performing an information completion process to generate connections between nodes of knowledge graphs maintained by different modules of the knowledge mesh, including performing at least one of: inheritance-based inference; natural language processing classifier-based inference; or natural language processing-based object matching inference; and identifying, using the generated connections between the nodes of the knowledge graphs, one or more actions to reduce cyber-security risk.

Abstract: A system that generates relevant and vetted training data using intelligent simulated users and evaluation of conversation data. A simulated user and an automated agent engage in a conversation to generate conversation and/or interaction data. The simulated user is guided by scenarios which are generated based on one or more controls to be followed by the automated agent. Using a simulated user driven by control-derived scenarios ensures the ensuing conversation data is relevant to the desired scope of operation for the automated agent. The conversation data is evaluated based on the controls to confirm the automated agent actions and responses followed the controls properly. Evaluating the conversation data based on the controls ensures that conversation data associated with properly followed controls is used as subsequent training data.

Abstract: A system providing a state-driven automated agent. The state machine can include multiple nested state machines to receive, process, and generate responses to a user inquiry received through a chat application. The state machine has a plurality of states, and navigates between states based on one or more machine learning (ML) models. In some instances, each state is associated with a machine learning model that can predict what state the state machine should transition to from its current state. The machine learning model(s) can be implemented using one or more large language models (LLM). The state-driven automated agent includes an auditing state that analyzes a predicted response to a user inquiry and identifies errors with the response. The errors may be identified and automatically self-corrected.

Abstract: Implementations are directed to methods, systems, and apparatus for ontology-based risk propagation over digital twins. Actions include obtaining knowledge graph data defining a knowledge graph including nodes and edges between the nodes, the nodes including asset nodes representing assets and process nodes representing processes; each edge representing a relation between nodes; determining, from the knowledge graph, an aggregated risk for a first process represented by a first process node, including: identifying, for the first process node, a set of incoming nodes, each incoming node comprising an asset node or a process node and being connected to the first process node by a respective edge; determining a direct risk for the first process; and determining an indirect risk for the first process; and generating, based on the aggregated risk for the first process node, a mitigation recommendation including actions for reducing the aggregated risk for the first process node.

Abstract: Implementations are directed to receiving graph data representative of a process-aware AAG that is representative of potential lateral movement of adversaries within a computer network, receiving risk profile data representative of a risk profile of an enterprise with respect to two or more risk aspects, generating, by a process-aware risk assessment module, a risk assessment based on the process-aware AAG and the risk profile, and generating, by a mitigation simulator module, a mitigation list based on the process-aware AAG, the risk profile, and the risk assessment, the mitigation list comprising a prioritized list of two or more facts of the process-aware AAG. Other implementations of this aspect include corresponding systems, apparatus, and computer programs, configured to perform the actions of the methods, encoded on computer storage devices.

Abstract: The present disclosure provides a system architecture for designing and monitoring privacy-aware services and improving privacy regulation compliance. A privacy-preserving knowledge graph (PPKG) system provides functionality for modelling and analyzing processes that use, share, or request sensitive data from users and the outcomes of such functionality may be utilized to modify the design of the processes (e.g., to improve security of the process, regulatory compliance of the process, and the like). The PPKG system may also be used to modify the process, such as to write code that may be compiled into executable form and deployed to a run-time environment. A privacy-preserving posture (PPP) system monitors the run-time environment and analyzes where processes obtain, store, and share sensitive data. The PPP system may identify run-time vulnerabilities that may pose risks with respect to the sensitive data, as well as areas where modifications could be made to improve regulatory compliance.

Abstract: Implementations include a computer-implemented method for mitigating cyber security risk of an enterprise network, the method comprising: receiving an analytical attack graph (AAG) representing paths within the enterprise network with respect to at least one target asset, the AAG defining a digital twin of the enterprise network and comprising a set of rule nodes, each rule node representing an attack tactic that can be used to move along a path of the AAG; integrating the AAG with a knowledge graph comprising a set of asset nodes, each asset node representing a digital asset that can be affected by one or more of the attack tactics; determining, based on integrating the AAG with the knowledge graph, a plurality of security controls, each security control having an assigned priority value; and selectively implementing the security controls in the enterprise network based on the assigned priority values of the security controls.

Abstract: Implementations are directed to methods, systems, and apparatus for automated prioritization of cyber risk to digital identities. Actions include obtaining graph data defining a knowledge graph including nodes and edges, the nodes representing respective objects of the enterprise network including digital identities and resources, each node being associated with an explicit risk score and properties of the represented object, each edge representing a relation between objects; determining priority scores for the objects, including, for a first object represented by a first node: determining an implicit risk score for the first node; determining a total risk score for the first node; and determining a priority score for the first node based on the total risk score and properties associated with the first node; generating a ranking of the objects according to the priority scores; and providing, for presentation on a display, cyber security risk data indicating the ranking of the objects.