US 12,113,822 B1Granted

Graph analysis-based assessment to determine relative node significance

AssigneeRapid7, Inc.

InventorsWah-Kwan Lin, Paul Deardorff

Life of this patent

Estimating the term…

Loading patent…

Abstract

Various embodiments include systems and methods to implement a graph analysis-based assessment to determine relative node significance. Network traffic data associated with a network may be obtained. A graph analysis-based assessment of the network may be performed to determine network traffic paths between a plurality of nodes in the network based at least in part on the network traffic data and to calculate, for each node and based at least in part on the network traffic paths, a respective centrality value. The respective centrality value may be indicative of a respective node being a potential source of disruption to the network relative to other nodes. At least one significant node in the network may be identified based at least in part on the centrality values, and a particular action to be performed with respect to the at least one significant node may be determined.

Claims20

Dependent claims

A system, comprising:

one or more hardware processors with associated memory that implement a graph analysis-based assessment to determine relative node significance, wherein the one or more hardware processors are configured to:
obtain network traffic data associated with a network;
perform a graph analysis-based assessment of the network, including to:
determine, based at least in part on the network traffic data, network traffic paths between a plurality of nodes in the network;
and
calculate, for each node of the plurality of nodes and based at least in part on the network traffic paths, a respective centrality value of a respective node indicative of a level of potential disruption to operations of the network if the respective node is attacked or damaged;
identify, based at least in part on the centrality values, at least one significant node in the network;
and
determine to perform one or more actions to harden the at least one significant node identified in the network against damage or attack, wherein the one or more actions includes establishing an alert mechanism to trigger an alert responsive to particular conditions being satisfied for the at least one significant node.

6 more elements

One or more non-transitory computer-accessible storage media storing program instructions that, when executed on or across one or more hardware processors, implement at least a portion of a system that implements a graph analysis-based assessment to determine relative node significance and cause the system to:

obtain network traffic data associated with a network;
perform a graph analysis-based assessment of the network, including to:
determine, based at least in part on the network traffic data, network traffic paths between a plurality of nodes in the network;
and
calculate, for each node of the plurality of nodes and based at least in part on the network traffic paths, a respective centrality value of a respective node indicative of a level of potential disruption to operations of the network if the respective node is attacked or damaged;
identify, based at least in part on the centrality values, at least one significant node in the network;
and
determine to perform one or more actions to harden the at least one significant node identified in the network against damage or attack, wherein the one or more actions includes establishing an alert mechanism to trigger an alert responsive to particular conditions being satisfied for the at least one significant node.

5 more elements

Dependencies are inferred from the claim text.