System and method for visualizing and analyzing cyber-attacks using a graph model

A method of assessing a computer network using a graph database, the method comprising:

• receiving data from a plurality of network sensors and convert the received data to a common format, wherein the received data is based on a present state of a computer network;
• generating a graph model comprising a plurality of nodes and a plurality of edges based on the data converted to the common format and store the generated plurality of nodes and the plurality of edges within a graph database, wherein the graph model comprises a plurality of predetermined layers, each layer associated with a type of computer-network information and comprising a subset of the plurality of nodes and the plurality of edges that is generated from the received data supplying the type of computer-network information associated with that layer;
• receiving a cyber-domain specific data query from a user;
• converting the received cyber-domain specific data query to a graph database native query, comprising function calls for returning corresponding matching subgraphs from the plurality of predetermined layers of the graph model;
• and
• executing the graph database native query upon the graph database to provide the user with a visualization of the returned matching subgraphs from across the predetermined layers of the graph model.

A non-transitory computer readable storage medium having stored thereon a set of instructions for assessing a computer network using a graph database that when executed by a computing device, cause the computing device to:

• receive data from a plurality of network sensors and convert the received data to a common format, wherein the received data is based on a present state of a computer network;
• generate a graph model comprising a plurality of nodes and a plurality of edges based on the data converted to the common format and store the generated plurality of nodes and the plurality of edges within a graph database, wherein the graph model comprises a plurality of predetermined layers, each layer associated with a type of computer-network information and comprising a subset of the plurality of nodes and the plurality of edges that is generated from the received data supplying the type of computer-network information associated with that layer;
• receive a cyber-domain specific data query from a user;
• convert the received cyber-domain specific data query to a graph database native query comprising function calls for returning corresponding matching subgraphs from the plurality of predetermined layers of the graph model;
• and
• execute the graph database native query upon the graph database to provide the user with a visualization of the returned matching subgraphs from across the predetermined layers of the graph model.