Systems for network risk assessment including processing of user access rights associated with a network of devices
AssigneePalantir Technologies Inc.
InventorsMiles Seiver, Stephen Cohen
Life of this patent
Estimating the term…
Abstract
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for network risk assessment. One of the methods includes obtaining information describing network traffic between a plurality of network devices within a network. A network topology of the network is determined based on the information describing network traffic, with the network topology including nodes connected by an edge to one or more other nodes, and with each node being associated with one or more network devices. Indications of user access rights of users are associated to respective nodes included in the network topology. User interface data associated with the network topology is generated.
Claims20
A computerized method comprising:
- by a system of one or more computer systems, accessing a network risk map being applied to a first network, the network risk map defining a plurality of risk values, wherein an individual risk value is a combination of an individual compromise value and an individual compromise vulnerability which are associated with an individual user account or an individual network device, wherein a compromise value indicates an importance an attacker would place on compromising a network device and/or user account, and wherein a compromise vulnerability indicates a likelihood of compromise of the user account and/or network device;
- and
- determining a second network of a plurality of networks which is to receive the network risk map, the determination being based on at least a subset of the risk values, the subset being determined using common metrics for the first network and the second network;
- and
- providing information associated with the network risk map to the second network, wherein the information includes information usable to determine compromise values and compromise vulnerabilities.
A system comprising one or more processors and non-transitory computer storage media storing instructions that when executed by the one or more processors, cause the one or more processors to:
- access a network risk map being applied to a first network, the network risk map defining a plurality of risk values, wherein an individual risk value is a combination of an individual compromise value and an individual compromise vulnerability which are associated with an individual user account or an individual network device, wherein a compromise value indicates an importance an attacker would place on compromising a network device and/or user account, and wherein a compromise vulnerability indicates a likelihood of compromise of the user account and/or network device;
- and
- determine a second network of a plurality of networks which is to receive the network risk map, the determination being based on at least a subset of the risk values, the subset being determined using common metrics for the first network and the second network;
- and
- provide information associated with the network risk map to the second network, wherein the information includes information usable to determine compromise values and compromise vulnerabilities.
Non-transitory computer storage media storing instructions that when executed by a system of one or more processors, cause the one or more processors to:
- access a network risk map being applied to a first network, the network risk map defining a plurality of risk values, wherein an individual risk value is a combination of an individual compromise value and an individual compromise vulnerability which are associated with an individual user account or an individual network device, wherein a compromise value indicates an importance an attacker would place on compromising a network device and/or user account, and wherein a compromise vulnerability indicates a likelihood of compromise of the user account and/or network device;
- and
- determine a second network of a plurality of networks which is to receive the network risk map, the determination being based on at least a subset of the risk values, the subset being determined using common metrics for the first network and the second network;
- and
- provide information associated with the network risk map to the second network, wherein the information includes information usable to determine compromise values and compromise vulnerabilities.
Dependencies are inferred from the claim text.