# US 10,313,382 B2 · System and method for visualizing and analyzing cyber-attacks using a graph model > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,382 B2 - Document ID: US10313382B2 - Status: Granted - Kind: B2 - Application number: 15/084,153 - Filed: 2016-03-29 - Published: 2017-10-05 - Granted: 2019-06-04 - Earliest claimed: 2016-03-29 - Assignees: The MITRE Corporation - Applicants: The MITRE Corporation - Inventors: Steven Noel; Eric Harley; Kam Him Tam; Michael Limiero; Matthew Share - Web page: https://patentgrep.com/patent/US10313382B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06F 16/28: Databases characterised by their database models, e.g. relational or object models - G06F 16/9024: {Graphs; Linked lists (G06F16/9027 takes precedence)} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L 67/565: Conversion or adaptation of application format or content (adding application control or application functional data H04L67/561) - G06F 2221/034: Test or assess a computer or a system - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system and method for implementing a graph database to analyze and monitor a status of an enterprise computer network is provided. In one example, a plurality of sensors can be inputted into sensor interface in which all of the data associated with the sensors in converted into a common data format. The data can be parsed into a data model that contains nodes and edges in order to generate a graph database model that can allow a network analyst to analyze the real-time status of a computer network. The graph database model can include multiple layers including an infrastructure layer, a cyber threats layer, a cyber posture layer, and a mission readiness layer. The graph database model can also be queried by a user using a domain-specific query language, so as to provide a user-friendly syntax in generating queries. ## Claims ### Claim 1 A computing system for assessing a computer network using a graph database, comprising: a plurality of network sensors; one or more sensor interfaces configured to received data from the plurality of network sensors; one or more processors; memory; and one or more programs stored in the memory that when executed by the one or more processors cause the one or more processors to: receive data from the plurality of network sensors and convert the received data to a common format, wherein the received data is based on a present state of a computer network; generate a graph model comprising a plurality of nodes and a plurality of edges based on the data converted to the common format and store the generated plurality of nodes and the plurality of edges within a graph database, wherein the graph model comprises a plurality of predetermined layers, each layer associated with a type of computer-network information and comprising a subset of the plurality of nodes and the plurality of edges that is generated from the received data supplying the type of computer-network information associated with that layer; receive a cyber-domain specific data query from a user of the computing system; convert the received cyber-domain specific data query to a graph database native query comprising function calls for returning corresponding matching subgraphs from the plurality of predetermined layers of the graph model; and execute the graph database native query upon the graph database to provide the user with a visualization of the returned matching subgraphs from across the predetermined layers of the graph model. ### Claim 2 (depends on 1) The computing system of claim 1, wherein a layer of the plurality of predetermined layers comprise a subset of the generated plurality of nodes and a subset of the plurality of edges that convey information about a mission readiness state of the computer network. ### Claim 3 (depends on 2) The computing system of claim 2, wherein at least one node and at least one edge of the plurality of nodes and plurality of edges convey information about a mission objective of the computing network. ### Claim 4 (depends on 3) The computing system of claim 3, wherein at least one node and at least one edge of the plurality of nodes and plurality of edges convey information about a task of the computing network, wherein the task is based on the mission objective of the computing network. ### Claim 5 (depends on 4) The computing system of claim 4, wherein at least one node and at least one edge of the plurality of nodes and plurality of edges convey information about an information asset of the computing network, wherein the information asset is based on the task of the computing network. ### Claim 6 (depends on 3) The computing system of claim 3, wherein at least one node and at least one edge of the plurality of nodes and plurality of edges convey information about a cyber asset of the computing network, wherein the cyber asset is based on the information asset of the computing network. ### Claim 7 (depends on 1) The computing system of claim 1, wherein a layer of the plurality of predetermined layers comprise one or more nodes and one or more edges that convey information about potential cyber threats to the computer network. ### Claim 8 (depends on 1) The computing system of claim 1, wherein a layer of the plurality of predetermined layers comprise one or more nodes and one or more edges that convey information about a cyber posture of the computer network. ### Claim 9 (depends on 1) The computing system of claim 1, wherein a layer of the plurality of predetermined layers comprise one or more nodes and one or more edges that convey information about an infrastructure of the computer network. ### Claim 10 (depends on 1) The computing system of claim 1 comprising: a document-oriented database configured to receive the data from the plurality of sensors and convert the received data into one or more entries in the document-oriented database, and wherein the graph database is configured to generate the plurality of nodes and the plurality of edges based on the one or more entries in the document-oriented database. ### Claim 11 A method of assessing a computer network using a graph database, the method comprising: receiving data from a plurality of network sensors and convert the received data to a common format, wherein the received data is based on a present state of a computer network; generating a graph model comprising a plurality of nodes and a plurality of edges based on the data converted to the common format and store the generated plurality of nodes and the plurality of edges within a graph database, wherein the graph model comprises a plurality of predetermined layers, each layer associated with a type of computer-network information and comprising a subset of the plurality of nodes and the plurality of edges that is generated from the received data supplying the type of computer-network information associated with that layer; receiving a cyber-domain specific data query from a user; converting the received cyber-domain specific data query to a graph database native query, comprising function calls for returning corresponding matching subgraphs from the plurality of predetermined layers of the graph model; and executing the graph database native query upon the graph database to provide the user with a visualization of the returned matching subgraphs from across the predetermined layers of the graph model. ### Claim 12 (depends on 11) The method of claim 11, wherein a layer of the plurality of predetermined layers comprise a subset of the generated plurality of nodes and a subset of the plurality of edges that convey information about a mission readiness state of the computer network. ### Claim 13 (depends on 12) The method of claim 12, wherein at least one node and at least one edge of the plurality of nodes and plurality of edges convey information about a mission objective of the computing network. ### Claim 14 (depends on 13) The method of claim 13, wherein at least one node and at least one edge of the plurality of nodes and plurality of edges convey information about a task of the computing network, wherein the task is based on the mission objective of the computing network. ### Claim 15 (depends on 14) The method of claim 14, wherein at least one node and at least one edge of the plurality of nodes and plurality of edges convey information about an information asset of the computing network, wherein the information asset is based on the task of the computing network. ### Claim 16 (depends on 13) The method of claim 13, wherein at least one node and at least one edge of the plurality of nodes and plurality of edges convey information about a cyber asset of the computing network, wherein the cyber asset is based on the information asset of the computing network. ### Claim 17 (depends on 11) The method of claim 11, wherein a layer of the plurality of predetermined layers comprise one or more nodes and one or more edges that convey information about potential cyber threats to the computer network. ### Claim 18 (depends on 11) The method of claim 11, wherein a layer of the plurality of predetermined layers comprise one or more nodes and one or more edges that convey information about a cyber posture of the computer network. ### Claim 19 (depends on 11) The method of claim 11, wherein a layer of the plurality of predetermined layers comprise one or more nodes and one or more edges that convey information about an infrastructure of the computer network. ### Claim 20 (depends on 11) The method of claim 11, comprising: receiving the data from the one or more sensors and converting the received data into one or more entries in a document-oriented database, and wherein generating the plurality of nodes and the plurality of edges is based on the one or more entries in the document-oriented database. ### Claim 21 A non-transitory computer readable storage medium having stored thereon a set of instructions for assessing a computer network using a graph database that when executed by a computing device, cause the computing device to: receive data from a plurality of network sensors and convert the received data to a common format, wherein the received data is based on a present state of a computer network; generate a graph model comprising a plurality of nodes and a plurality of edges based on the data converted to the common format and store the generated plurality of nodes and the plurality of edges within a graph database, wherein the graph model comprises a plurality of predetermined layers, each layer associated with a type of computer-network information and comprising a subset of the plurality of nodes and the plurality of edges that is generated from the received data supplying the type of computer-network information associated with that layer; receive a cyber-domain specific data query from a user; convert the received cyber-domain specific data query to a graph database native query comprising function calls for returning corresponding matching subgraphs from the plurality of predetermined layers of the graph model; and execute the graph database native query upon the graph database to provide the user with a visualization of the returned matching subgraphs from across the predetermined layers of the graph model. ### Claim 22 (depends on 21) The non-transitory computer readable storage medium of claim 21, wherein a layer of the plurality of predetermined layers comprise a subset of the generated plurality of nodes and a subset of the plurality of edges that convey information about a mission readiness state of the computer network. ### Claim 23 (depends on 22) The non-transitory computer readable storage medium of claim 22, wherein at least one node and at least one edge of the plurality of nodes and plurality of edges convey information about a mission objective of the computing network. ### Claim 24 (depends on 23) The non-transitory computer readable storage medium of claim 23, wherein at least one node and at least one edge of the plurality of nodes and plurality of edges convey information about a task of the computing network, wherein the task is based on the mission objective of the computing network. ### Claim 25 (depends on 24) The non-transitory computer readable storage medium of claim 24, wherein at least one node and at least one edge of the plurality of nodes and plurality of edges convey information about an information asset of the computing network, wherein the information asset is based on the task of the computing network. ### Claim 26 (depends on 23) The non-transitory computer readable storage medium of claim 23, wherein at least one node and at least one edge of the plurality of nodes and plurality of edges convey information about a cyber asset of the computing network, wherein the cyber asset is based on the information asset of the computing network. ### Claim 27 (depends on 21) The non-transitory computer readable storage medium of claim 21, wherein a layer of the plurality of predetermined layers comprise one or more nodes and one or more edges that convey information about potential cyber threats to the computer network. ### Claim 28 (depends on 21) The non-transitory computer readable storage medium of claim 21, wherein a layer of the plurality of predetermined layers comprise one or more nodes and one or more edges that convey information about a cyber posture of the computer network. ### Claim 29 (depends on 21) The non-transitory computer readable storage medium of claim 21, wherein a layer of the plurality of predetermined layers comprise one or more nodes and one or more edges that convey information about an infrastructure of the computer network. ### Claim 30 (depends on 21) The non-transitory computer readable storage medium of claim 21, wherein the computing device is further caused to: receive the data from the plurality of sensors and convert the received data into one or more entries in a document-oriented database, and wherein generating the plurality of nodes and the plurality of edges is based on the one or more entries in the document-oriented database.