Systems for network risk assessment including processing of user access rights associated with a network of devices
AssigneePalantir Technologies Inc.
InventorsMiles Seiver, Stephen Cohen
Life of this patent
Estimating the term…
Abstract
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for network risk assessment. One of the methods includes obtaining information describing network traffic between a plurality of network devices within a network. A network topology of the network is determined based on the information describing network traffic, with the network topology including nodes connected by an edge to one or more other nodes, and with each node being associated with one or more network devices. Indications of user access rights of users are associated to respective nodes included in the network topology. User interface data associated with the network topology is generated.
Claims18
A computerized method comprising:
- by a system of one or more computer systems,
- accessing a network risk map being applied to a network, the network risk map defining a plurality of compromise values and a plurality of compromise vulnerabilities which are associated with user accounts or network devices, wherein a compromise value indicates an importance an attacker would place on compromising a network device and/or user account, and wherein a compromise vulnerability indicates a likelihood of compromise of the user account and/or network device;
- and
- identifying an external event associated with an effect on the network, wherein the compromise values and/or compromise vulnerabilities are modified based on the external event, and wherein modifying compromise vulnerabilities associated with user accounts compromises identifying that the external event affects particular network devices utilized by a subset of the user accounts and increasing compromise vulnerabilities associated with the subset;
- and
- providing, for presentation via an interactive user interface, information describing the external event.
A system comprising one or more processors and non-transitory computer storage media storing instructions that when executed by the one or more processors, cause the one or more processors to:
- access a network risk map being applied to a first network, the network risk map defining a plurality of compromise values and a plurality of compromise vulnerabilities which are associated with user accounts or network devices, wherein a compromise value indicates an importance an attacker would place on compromising a network device and/or user account, and wherein a compromise vulnerability indicates a likelihood of compromise of the user account and/or network device;
- and
- identify an external event associated with an effect on the network, wherein the compromise values and/or compromise vulnerabilities are modified based on the external event, and wherein to modify compromise vulnerabilities associated with user accounts the system is configured to identify that the external event affects particular network devices utilized by a subset of the user accounts and increase compromise vulnerabilities associated with the subset;
- and
- provide, for presentation via an interactive user interface, information describing the external event.
Non-transitory computer storage media storing instructions that when executed by a system of one or more computers cause the one or more computers to:
- access a network risk map being applied to a first network, the network risk map defining a plurality of compromise values and a plurality of compromise vulnerabilities which are associated with user accounts or network devices, wherein a compromise value indicates an importance an attacker would place on compromising a network device and/or user account, and wherein a compromise vulnerability indicates a likelihood of compromise of the user account and/or network device;
- and
- identify an external event associated with an effect on the network, wherein the compromise values and/or compromise vulnerabilities are modified based on the external event, and wherein to modify compromise vulnerabilities associated with user accounts the system is configured to identify that the external event affects particular network devices utilized by a subset of the user accounts and increase compromise vulnerabilities associated with the subset;
- and
- provide, for presentation via an interactive user interface, information describing the external event.
Dependencies are inferred from the claim text.