Automated modeling and analysis of security attacks and attack surfaces for an information system or computing device

A method for automating security analysis of an information system or computing device by modeling attacks and attack surfaces using a Security Attack Knowledge Graph with a Graph Computing system and algorithms comprising:

• receiving, via at least one computer device executing computer program instructions, a request for a security analysis originating from a human user, wherein the request includes a manifest for the security analysis comprising, a description of a target system and its operating environment, a set of parameters and criteria describing the security analysis, and at least one attack scenario;
• and,
• accessing, via the at least one computer device executing the computer program instructions, a security knowledge base, said security knowledge base comprising, a contextual data model of security attack-related information along with detailed data on known attack instances, and is organized in a form of a Security Attack Knowledge Graph compatible with the Graph Computing system and algorithms;
• and,
• invoking, via the at least one computer device executing the computer program instructions, at least one query to the Graph Computing system, said Graph Computing system processes the query as a traversal of the Security Attack Knowledge Graph to produce a result, wherein said result comprises one or more attack paths within the attack scenario for the target system, and a combined result of a set of queries represents an attack surface, comprising a plurality of attack paths for the attack scenario for the target system;
• and,
• analyzing, via the at least one computer device executing the computer program instructions, the results of graph queries to produce a set of relevant attack paths, wherein each relevant attack path correlates with information in the security analysis manifest;
• and,
• reviewing, via the at least one computer device executing the computer program instructions, the results of the analysis of the graph query results, wherein reviewing comprises, using textual, graphical and interactive techniques to visualize the results for the purpose of improving the security analysis by invoking revised queries to the Graph Computing system;
• and,
• generating, via the at least one computer device executing the computer program instructions, a finalized security analysis report, said report comprising, a list of the relevant attack paths along with corresponding recommendations and action plans from the security knowledge base for said target system, wherein recommendations and action plans comprise steps and techniques to identify, detect, diagnose, mitigate an attack, prevent an attack, or recover from the occurrence of an attack;
• and,
• applying, via the at least one computer device executing the computer program instructions, the recommendations and actions plans generated by the security analysis to the target system.