Discovering cyber-attack process model based on analytical attack graphs

A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for process discovery in an enterprise network, the operations comprising:

• receiving, by the one or more processors, analytical attack graph data representative of an analytical attack graph, the analytical attack graph including:
• one or more rule nodes each representing a network configuration rule;
• and
• one or more impact nodes each representing an impact of one or more respective network configuration rules;
• converting, by the one or more processors, the analytical attack graph to a tactic graph including one or more tactic nodes, each tactic node representing at least one rule node and at least one impact node, the converting comprising:
• retrieving, from a data base, data that associates tactic nodes with combinations of rule nodes and impact nodes;
• and
• replacing combinations of rule nodes and impact nodes of the analytical attack graph with tactic nodes based on the retrieved data;
• determining, by the one or more processors, one or more paths of the tactic graph that lead to a particular network impact;
• generating, by the one or more processors, a process model that is different from the tactic graph based on the determined one or more paths that lead to the particular network impact, the process model representing network activity for execution of a process that leads to the particular network impact;
• and
• executing, by the one or more processors and within the enterprise network, one or more remedial actions based on the process model to mitigate cyber-security risk to the enterprise network.

A system, comprising:

• one or more computers;
• and
• a computer-readable storage device coupled to the one or more computers and having instructions stored thereon which, when executed by the one or more computers, cause the one or more computers to perform operations for process discovery in an enterprise network, the operations comprising:
• receiving, by one or more computers, analytical attack graph data representative of an analytical attack graph, the analytical attack graph including:
• one or more rule nodes each representing a network configuration rule;
• and
• one or more impact nodes each representing an impact of one or more respective network configuration rules;
• converting, by the one or more computers, the analytical attack graph to a tactic graph including one or more tactic nodes, each tactic node representing at least one rule node and at least one impact node, the converting comprising:
• retrieving, from a data base, data that associates tactic nodes with combinations of rule nodes and impact nodes;
• and
• replacing combinations of rule nodes and impact nodes of the analytical attack graph with tactic nodes based on the retrieved data;
• determining, by the one or more computers, one or more paths of the tactic graph that lead to a particular network impact;
• generating, by the one or more computers, a process model that is different from the tactic graph based on the determined one or more paths that lead to the particular network impact, the process model representing network activity for execution of a process that leads to the particular network impact;
• and
• executing, by the one or more computers and within the enterprise network, one or more remedial actions based on the process model to mitigate cyber-security risk to the enterprise network.