# US 11,907,407 B2 · Generating attack graphs in agile security platforms > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,907,407 B2 - Document ID: US11907407B2 - Status: Granted - Kind: B2 - Application number: 17/644,503 - Filed: 2021-12-15 - Published: 2022-04-28 - Granted: 2024-02-20 - Earliest claimed: 2018-12-03 - Assignees: Accenture Global Solutions Limited - Applicants: Accenture Global Solutions Limited - Inventors: Eitan Hadar; Amin Hassanzadeh; Anup Nayak - Web page: https://patentgrep.com/patent/US11907407B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06F 16/9024: {Graphs; Linked lists (G06F16/9027 takes precedence)} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 21/70: Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer - H04L 41/142: using statistical or mathematical methods - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L 41/5058: {Service discovery by the service manager} - H04L 43/026: using flow identification - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 2221/034: Test or assess a computer or a system - G06Q 10/06315: {Needs-based resource requirements planning or analysis} - H04L 43/0823: Errors, e.g. transmission errors - Y02P 90/80: Management or planning - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - Y02P: CLIMATE CHANGE MITIGATION TECHNOLOGIES IN THE PRODUCTION OR PROCESSING OF GOODS ## Abstract Implementations of the present disclosure include providing a graph representative of a network, a set of nodes representing respective assets, each edge representing one or more lateral paths between assets, the graph data including configurations affecting at least one impact that has an effect on an asset, determining multiple sets of fixes for configurations, each fix having a cost associated therewith, incorporating fix data of the sets of fixes into the graph, defining a set of fixes including one or more fixes from the multiple sets of fixes by defining an optimization problem that identifies one or more impacts that are to be nullified and executing resolving the optimization problem to define the set of fixes, each fix in the set of fixes being associated with a respective configuration in the graph, and scheduling performance of each fix in the set of fixes based on one or more operational constraints. ## Claims ### Claim 1 A computer-implemented method for applying remediations for cyber security in enterprise networks, the method being executed by one or more processors and comprising: providing, by a security platform, graph data defining a graph that is representative of an enterprise network, the graph comprising nodes and edges between nodes, the nodes comprising: a set of configuration nodes each representing a condition of an asset of the enterprise network; a set of rule nodes each representing an attack methodology; and a set of impact nodes each representing an impact on the enterprise network, wherein an edge between a configuration node and a rule node indicates that the condition represented by the configuration node enables the attack methodology represented by the rule node, and an edge between a rule node and an impact node indicates that the attack methodology represented by the rule node causes the impact; identifying, by the security platform, one or more fixes for each of multiple respective conditions represented by configuration nodes of the graph; incorporating, by the security platform, fix data representative of the identified one or more fixes into the graph, including linking each of the one or more fixes to the configuration node representing the respective condition; defining, by the security platform and using the graph data, a set of fixes from the identified one or more fixes by executing an optimization problem for nullifying one or more impacts represented by impact nodes of the graph; and scheduling, by the security platform, performance of each fix in the set of fixes. ### Claim 2 (depends on 1) The method of claim 1, wherein each impact comprises an effect on an asset within the enterprise network. ### Claim 3 (depends on 1) The method of claim 1, wherein each fix in the set of fixes has a cost associated therewith, wherein executing the optimization problem comprises optimizing the cost of the set of fixes. ### Claim 4 (depends on 3) The method of claim 3, wherein the cost comprises one or more of a monetary cost, a temporal cost, and a resource cost. ### Claim 5 (depends on 1) The method of claim 1, wherein the optimization problem is executed using a greedy algorithm and a coverage matrix. ### Claim 6 (depends on 5) The method of claim 5, wherein the coverage matrix defines, for each fix of the one or more fixes, one or more impacts that the fix nullifies. ### Claim 7 (depends on 6) The method of claim 6, wherein the coverage matrix further defines, for each fix of the one or more fixes, a linked impact with respect to one or more impacts affected by the fix. ### Claim 8 (depends on 1) The method of claim 1, wherein scheduling, by the security platform, performance of each fix in the set of fixes is executed by performing a multi-objective optimization to minimize one or more of risk and cost for a given objective. ### Claim 9 (depends on 8) The method of claim 8, wherein risk represents a risk of one or more vulnerabilities being exploited over time. ### Claim 10 (depends on 1) The method of claim 1, wherein each fix is one of an official fix that wholly resolves a vulnerability of a configuration, a work-around fix that works around the vulnerability of the configuration, and a temporary fix that only temporarily resolves the vulnerability of the configuration. ### Claim 11 (depends on 1) The method of claim 1, wherein assets comprise one or more of information technology (IT) assets and operational technology (OT) assets. ### Claim 12 A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for applying remediations for cyber security in enterprise networks, the operations comprising: providing, by a security platform, graph data defining a graph that is representative of an enterprise network, the graph comprising nodes and edges between nodes, each node representing an asset within the enterprise network, and each edge representing at least a portion of one or more lateral paths between assets in the enterprise network, the graph data comprising a set of configurations, each configuration affecting at least one impact; determining, by the security platform, multiple sets of fixes for respective configurations; incorporating, by the security platform, fix data representative of the multiple sets of fixes into the graph; defining, by the security platform, a set of fixes comprising one or more fixes from the multiple sets of fixes by executing an optimization problem for nullifying one or more impacts, wherein the optimization problem is executed using a greedy algorithm and a coverage matrix that defines, for each fix in the multiple sets of fixes, one or more impacts that the fix nullifies; and scheduling, by the security platform, performance of each fix in the set of fixes. ### Claim 13 (depends on 12) The non-transitory computer-readable storage medium of claim 12, wherein each impact comprises an effect on an asset within the enterprise network. ### Claim 14 (depends on 12) The non-transitory computer-readable storage medium of claim 12, wherein each fix in the set of fixes has a cost associated therewith, wherein executing the optimization problem comprises optimizing the cost of the set of fixes. ### Claim 15 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the cost comprises one or more of a monetary cost, a temporal cost, and a resource cost. ### Claim 16 (depends on 12) The non-transitory computer-readable storage medium of claim 12, wherein each fix in the set of fixes is associated with a respective configuration in the graph. ### Claim 17 A system, comprising: one or more computers; and a computer-readable storage device coupled to the one or more computers and having instructions stored thereon which, when executed by the one or more computers, cause the one or more computers to perform operations for applying remediations for cyber security in enterprise networks, the operations comprising: providing, by a security platform, graph data defining a graph that is representative of an enterprise network, the graph comprising nodes and edges between nodes, the nodes comprising: a set of configuration nodes each representing a condition of an asset of the enterprise network; a set of rule nodes each representing an attack methodology; and a set of impact nodes each representing an impact on the enterprise network, wherein an edge between a configuration node and a rule node indicates that the condition represented by the configuration node enables the attack methodology represented by the rule node, and an edge between a rule node and an impact node indicates that the attack methodology represented by the rule node causes the impact; identifying, by the security platform, one or more fixes for each of multiple respective conditions represented by configuration nodes of the graph; incorporating, by the security platform, fix data representative of the identified one or more fixes into the graph, including linking each of the one or more fixes to the configuration node representing the respective condition; defining, by the security platform and using the graph data, a set of fixes from the identified one or more fixes by executing an optimization problem for nullifying one or more impacts represented by impact nodes of the graph; and scheduling, by the security platform, performance of each fix in the set of fixes. ### Claim 18 (depends on 17) The system of claim 17, wherein: each fix in the set of fixes has a cost associated therewith, executing the optimization problem comprises optimizing the cost of the set of fixes, and the cost comprises one or more of a monetary cost, a temporal cost, and a resource cost. ### Claim 19 (depends on 17) The system of claim 17, wherein: the optimization problem is executed using a greedy algorithm and a coverage matrix, the coverage matrix defines, for each fix of the one or more fixes, one or more impacts that the fix nullifies, and the coverage matrix further defines, for each fix of the one or more fixes, a linked impact with respect to one or more impacts affected by the fix. ### Claim 20 (depends on 17) The system of claim 17, wherein scheduling, by the security platform, performance of each fix in the set of fixes is executed by performing a multi-objective optimization to minimize one or more of risk and cost for a given objective, wherein risk represents a risk of one or more vulnerabilities being exploited over time.