Probabilistic model for cyber risk forecasting
AssigneeNeo Prime, LLC
InventorsCraig A Schultz, John J. Nitao, Jeffrey M. Starr, John Compton
Life of this patent
Estimating the term…
Abstract
A system and method are presented for forecasting the risk of cyber-attacks on targeted networks. The described technology quantifies linear and non-linear damages to network-dependent assets by propagating probabilistic distributions of events in sequence and time in order to forecast damages over specified periods. Damage-forecasts are used to estimate probabilistically time-varying financial losses for cyber-attacks. The described technology incorporates quantities and dependencies for pricing insurance, re-insurance, and self-insurance, assessing cost-benefit tradeoffs for sequenced implementation of security control measures, and detecting attacks in the targeted network.
Claims20
A method estimating risks related to threats to a networked system of at least one target organization, the method comprising:
- receiving, by a processor, one or more target organization information, asset information, system information, and threat information descriptive of at least one target organization;
- calculating, by the processor, threat characteristics for the networked system of the at least one target organization, based on the one or more target organization information, asset information, system information, and threat information descriptive of the at least one target organization;
- modeling, by the processor, one or more pathways for at least one of the threats based on the calculated threat characteristics for the networked systemof the at least one target organization, wherein the one or more pathways includes at least one time-dependent event,
- wherein at least one of the one or more pathways includes known and modeled attack agent objectives, attacker attributes, attack tactics and techniques, and time-related interactions of one or more attackers or attack behaviors and one or more sets of response actions of the at least one target organization,
- wherein the one or more sets of response actions of the at least one target organization includes:
- effects of automatic security control measures within the networked system;
- and
- human responses modeled by computing probabilities as a function of reward-cost from an attacker's perspective and from a targeted organization's perspective;
- estimating, by the processor, for the one or more pathways:
- probabilities that at least one of the time-dependent events will occur, and
- probability distributions of times of occurrence of the at least one time-dependent events;
- and
- determining, by the processor, based on the estimating, a probability distribution of damage to assets of the at least one target organization and a probability distribution of one or more times of such damage to the assets;
- and
- dynamically reconfiguring or deploying operation of one or more hardware components of the networked system at the one or more pathways bases on the determined probability distribution of damage to the assets and the probability distribution of one or more times of such damage to the assets,
- wherein reconfiguring or deploying operation of one or more hardware components of the networked system includes reconfiguring or deploying a firewall, security device, or sensor with respect to the one or more pathways.
A non-transitory computer-readable storage medium storing instructions that, if executed by a processor of a computing system, cause the computing system to perform a method for estimating risks related to threats to a networked system of at least one target organization, the method comprising:
- receiving one or more target organization information, asset information, system information, and threat information descriptive of at least one target organisation;
- calculating threat characteristics for the networked systems the at least one target organization, based on the one or more target organization information, asset information, system information, and threat information descriptive of the at least one target organization;
- modeling one or more pathways for at least one of the threats based on the calculated threat characteristics for the networked system of the at least one target organization, wherein the one or more pathways includes at least one time-dependent event,
- wherein at least one of the one or more pathways includes known and remodeled attack agent objectives, attacker attributes, attack tactics and techniques, and a time-related interactions of one or more attackers or attack behaviors and one or more sets of response actions of the at least one target organization,
- wherein the one or more sets of response actions of the at least one target organization includes:
- effects of automatic security control measures within the networked system;
- and
- human responses modeled by computing probabilities as a function of reward-cost from an attackers perspective and from a targeted organization's perspective:
- estimating for the one or more pathways;
- probabilities that at least one of the time-dependent events will occur, and
- probability distributions of times of occurrence of the at least one time-dependent events;
- and
- determining based on the estimating, a probability distribution of damage to assets of the at least one target organization and a probability distribution of one or more times of such damage to the assets;
- and
- dynamically reconfiguring or deploying operation of one or more hardware components of the networked system at the one or more pathways based on the determined probability distribution of damage to the assets and the probability distribution of one or more times of such damage to the assets,
- wherein reconfiguring or deploying operation of one or more hardware components of the networked system includes reconfiguring or deploying a firewall, security device, or sensor with respect to the one or more pathways.
Dependencies are inferred from the claim text.