# US 12,113,822 B1 · Graph analysis-based assessment to determine relative node significance > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,113,822 B1 - Document ID: US12113822B1 - Status: Granted - Kind: B1 - Application number: 17/512,753 - Filed: 2021-10-28 - Granted: 2024-10-08 - Earliest claimed: 2021-10-28 - Assignees: Rapid7, Inc. - Applicants: Rapid7, Inc. - Inventors: Wah-Kwan Lin; Paul Deardorff - Web page: https://patentgrep.com/patent/US12113822B1 ## CPC - H04L 63/1433: {Vulnerability analysis} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Various embodiments include systems and methods to implement a graph analysis-based assessment to determine relative node significance. Network traffic data associated with a network may be obtained. A graph analysis-based assessment of the network may be performed to determine network traffic paths between a plurality of nodes in the network based at least in part on the network traffic data and to calculate, for each node and based at least in part on the network traffic paths, a respective centrality value. The respective centrality value may be indicative of a respective node being a potential source of disruption to the network relative to other nodes. At least one significant node in the network may be identified based at least in part on the centrality values, and a particular action to be performed with respect to the at least one significant node may be determined. ## Claims ### Claim 1 A system, comprising: one or more hardware processors with associated memory that implement a graph analysis-based assessment to determine relative node significance, wherein the one or more hardware processors are configured to: obtain network traffic data associated with a network; perform a graph analysis-based assessment of the network, including to: determine, based at least in part on the network traffic data, network traffic paths between a plurality of nodes in the network; and calculate, for each node of the plurality of nodes and based at least in part on the network traffic paths, a respective centrality value of a respective node indicative of a level of potential disruption to operations of the network if the respective node is attacked or damaged; identify, based at least in part on the centrality values, at least one significant node in the network; and determine to perform one or more actions to harden the at least one significant node identified in the network against damage or attack, wherein the one or more actions includes establishing an alert mechanism to trigger an alert responsive to particular conditions being satisfied for the at least one significant node. ### Claim 2 (depends on 1) The system of claim 1, wherein each individual centrality value of the centrality values corresponds to a betweenness centrality value. ### Claim 3 (depends on 1) The system of claim 1, wherein each individual centrality value of the centrality values corresponds to one of: an undirected centrality value; an in-degree centrality value; an out-degree centrality value; or an Eigenvector centrality value. ### Claim 4 (depends on 1) The system of claim 1, wherein the one or more actions includes prioritizing patching of the at least one significant node. ### Claim 5 (depends on 1) The system of claim 1, wherein the one or more actions includes prioritizing monitoring of the at least one significant node. ### Claim 6 (depends on 1) The system of claim 1, wherein one or more actions are selected based at least in part on a sensitivity type of information received by the at least one significant node. ### Claim 7 (depends on 1) The system of claim 1, wherein the one or more actions includes informing changes to a network structure associated with the network. ### Claim 8 (depends on 1) The system of claim 1, wherein the one or more actions includes informing an intrusion detection system of where to focus attention with respect to the network. ### Claim 9 (depends on 1) The system of claim 1, wherein the one or more hardware processors are configured to identify the at least one significant node in the network based at least in part on the centrality values and one or more qualitative attributes associated with individual nodes of the plurality of nodes. ### Claim 10 (depends on 9) The system of claim 9, wherein the one or more qualitative attributes include at least one of: an organization departmental attribute; a device label attribute; and an organization access attribute. ### Claim 11 A method comprising: implementing, using one or more hardware processors, a graph analysis-based assessment to determine relative node significance, wherein the implementing comprises: obtaining network traffic data associated with a network; performing a graph analysis-based assessment of the network, including: determining, based at least in part on the network traffic data, network traffic paths between a plurality of nodes in the network; and calculating, for each node of the plurality of nodes and based at least in part on the network traffic paths, a respective centrality value of a respective node indicative of a level of potential disruption to operations of the network if the respective node is attacked or damaged; identifying, based at least in part on the centrality values, at least one significant node in the network; and determining to perform one or more actions to harden the at least one significant node identified in the network against damage or attack, wherein the one or more actions includes establishing an alert mechanism to trigger an alert responsive to particular conditions being satisfied for the at least one significant node. ### Claim 12 (depends on 11) The method of claim 11, wherein each individual centrality value of the centrality values corresponds to a betweenness centrality value. ### Claim 13 (depends on 11) The method of claim 11, wherein each individual centrality value of the centrality values corresponds to one of: an undirected centrality value; an in-degree centrality value; an out-degree centrality value; or an Eigenvector centrality value. ### Claim 14 (depends on 11) The method of claim 11, wherein the one or more actions includes at least one of: prioritizing patching of the at least one significant node; prioritizing monitoring of the at least one significant node; informing changes to a network structure associated with the network; and informing an intrusion detection system of where to focus attention with respect to the network. ### Claim 15 One or more non-transitory computer-accessible storage media storing program instructions that, when executed on or across one or more hardware processors, implement at least a portion of a system that implements a graph analysis-based assessment to determine relative node significance and cause the system to: obtain network traffic data associated with a network; perform a graph analysis-based assessment of the network, including to: determine, based at least in part on the network traffic data, network traffic paths between a plurality of nodes in the network; and calculate, for each node of the plurality of nodes and based at least in part on the network traffic paths, a respective centrality value of a respective node indicative of a level of potential disruption to operations of the network if the respective node is attacked or damaged; identify, based at least in part on the centrality values, at least one significant node in the network; and determine to perform one or more actions to harden the at least one significant node identified in the network against damage or attack, wherein the one or more actions includes establishing an alert mechanism to trigger an alert responsive to particular conditions being satisfied for the at least one significant node. ### Claim 16 (depends on 15) The one or more non-transitory computer-accessible storage media of claim 15, wherein each individual centrality value of the centrality values corresponds to a betweenness centrality value. ### Claim 17 (depends on 15) The one or more non-transitory computer-accessible storage media of claim 15, wherein each individual centrality value of the centrality values corresponds to one of: an undirected centrality value; an in-degree centrality value; an out-degree centrality value; or an Eigenvector centrality value. ### Claim 18 (depends on 15) The one or more non-transitory computer-accessible storage media of claim 15, wherein the one or more actions includes at least one of: prioritizing patching of the at least one significant node; prioritizing monitoring of the at least one significant node; informing changes to a network structure associated with the network; and informing an intrusion detection system of where to focus attention with respect to the network. ### Claim 19 (depends on 15) The one or more non-transitory computer-accessible storage media of claim 15, wherein the program instructions when executed on or across the one or more hardware processors cause the system to: identify the at least one significant node in the network based at least in part on the centrality values and one or more qualitative attributes associated with individual nodes of the plurality of nodes. ### Claim 20 (depends on 19) The one or more non-transitory computer-accessible storage media of claim 19, wherein the one or more qualitative attributes include at least one of: an organization departmental attribute; a device label attribute; and an organization access attribute.