Distributed system for autonomous discovery and exploitation of an organization's computing
AssigneeInternational Business Machines Corporation
InventorsDavid Wolpoff, Eric McIntyre, Evan Anderson
Life of this patent
Estimating the term…
Abstract
A system and method for performing autonomous analysis of computing resources of a particular entity across the open internet. In particular, a modularized system that is configured to distribute work to ephemeral worker nodes in order perform a blackbox analysis of a target entity and various computing resources under the control or administration of that entity. The blackbox analysis includes an evaluation of discovered resources and services based on appeal or threat actor temptation heuristic.
Claims19
A modularized system for evaluation of a vulnerability presented by an instance of software executed by a computing resource, the modularized system configured to receive a set of entity reconnaissance data associated with an entity, comprising:
- identifying at least one computing resource likely administered by the entity and, for each respective computing resource:
- identifying an instance of software executed by the computing resource:
- identifying a vulnerability presented by the instance of software;
- and
- generating or updating an appeal score based at least in part on the vulnerability, the appeal score corresponding to a prediction of attractiveness of the respective computing resource to an exploitation attempt by a third party;
- and
- generating or updating a reconnaissance plan comprising a set of jobs, each job defining at least one computational task, the reconnaissance plan based on one or more of:
- at least one appeal score;
- or
- at least one identified vulnerability.
A method for evaluation of Internet-connected computing resources administered by an entity, the method comprising:
- receiving data from at least one computing task performed as part of entity reconnaissance of an entity, and with the data:
- identifying a computing resource likely administered by the entity;
- identifying an instance of software executed by the computing resource;
- identifying a vulnerability presented by the instance of software;
- and
- updating an appeal score of the computing resource, the appeal score corresponding to a likelihood of an exploitation attempt by a third party.
A method for presenting and ranking results of an evaluation operation enumerating computing resources of an entity, the method comprising:
- receiving data from entity reconnaissance associated with a target entity, and with the received data:
- identifying a computing resource likely administered by the target entity;
- identifying an instance of software executed by the computing resource;
- identifying a vulnerability presented by the instance of software;
- and
- updating or creating an appeal score of the computing resource, the appeal score corresponding to a prediction of attractiveness of the computing resource and vulnerability to an exploitation attempt by a third party;
- displaying at a user interface information related to at least a subset of identified computing resources, in descending order of appeal score.
Dependencies are inferred from the claim text.