# US 12,603,891 B2 · Method, product, and system for generating a software representation that embodies network configuration and policy data of a computer network for use in security management > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,603,891 B2 - Document ID: US12603891B2 - Status: Granted - Kind: B2 - Application number: 17/711,850 - Filed: 2022-04-01 - Published: 2023-10-05 - Granted: 2026-04-14 - Earliest claimed: 2022-04-01 - Assignees: Vectra AI, Inc. - Applicants: Vectra AI, Inc. - Inventors: Nicolas Beauchesne; Sohrob Kazerounian; William Stow Finlayson, IV; Karl Matthew Lynn - Web page: https://patentgrep.com/patent/US12603891B2 ## CPC - H04L 63/104: {Grouping of entities} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Disclosed is an approach for generating a software representation that embodies network configuration and policy data of a computer network for use in security management. The software representation comprises a state machine where different states can be reached using respective transitions or properties which are possible as determined based on the network configuration and network policy data. The states correspond to respective entities on the network which may comprise resources that are identifiable for protection. The software representation can then be stimulated with various inputs to identify sequences of state-to-state transitions which may in turn be processed to generate corresponding detection signatures for use in monitoring the network. ## Claims ### Claim 1 A method comprising: identifying network configuration data and network policy data for a computer network; generating a software representation of the computer network based on the network configuration data and network policy data by: receiving the network configuration data and the network policy data; identifying a plurality of relationships between objects or entities represented in the network configuration data or the network policy data; and generating a plurality of functions based on the plurality of relationships, wherein at least some of the plurality of functions include one or more function calls selectable based on an input, at least one of the entities is identified for protection and associated with a crash statement, and the software representation is configured to be stimulated with inputs to identify a sequence of state-to-state transitions that cause execution of the crash statement. ### Claim 2 (depends on 1) The method of claim 1, wherein the network configuration data specifies access rights allocated to respective groups and the network policy data specifies a set of access rights for group members to access network resources. ### Claim 3 (depends on 1) The method of claim 1, wherein the software representation comprises a source code representation or an executable compiled from the source code representation and represents a plurality of states and transitions between states. ### Claim 4 (depends on 1) The method of claim 1, wherein the software representation comprises a source code representation or an executable compiled from the source code representation and encapsulates a bitmap representing a plurality of states and transitions between states. ### Claim 5 (depends on 1) The method of claim 1, wherein the objects comprise one or more entities and the entities comprise any of the following: computing devices, users, domains, group policy objects (GPOs), key vaults, subscriptions, tenants, resource groups, applications, virtual machines (VMs), groups, or organizational units (OUs). ### Claim 6 (depends on 1) The method of claim 1, wherein the plurality of relationships comprise access rights or properties that a respective entity can use to interact with another entity. ### Claim 7 (depends on 1) The method of claim 1, wherein the plurality of relationships are represented by respective state-transition-state tuples. ### Claim 8 (depends on 7) The method of claim 7, wherein a state-transition-state tuple represents a relationship of the plurality relationships and corresponds to a condition, and a function of the plurality of functions includes the condition as a prerequisite to executing a corresponding function call. ### Claim 9 A non-transitory computer readable medium having stored thereon a set of instructions, the set of instructions, when executed by a processor, causing a set of acts comprising: identifying network configuration data and network policy data for a computer network; generating a software representation of the computer network based on the network configuration data and network policy data by: receiving the network configuration data and the network policy data; identifying a plurality of relationships between objects or entities represented in the network configuration data or the network policy data; and generating a plurality of functions based on the plurality of relationships, wherein at least some of the plurality of functions include one or more function calls selectable based on an input, at least one of the entities is identified for protection and associated with a crash statement, and the software representation is configured to be stimulated with inputs to identify a sequence of state-to-state transitions that cause execution of the crash statement. ### Claim 10 (depends on 9) The computer readable medium of claim 9, wherein the network configuration data specifies access rights allocated to respective groups and the network policy data specifies a set of access rights for group members to access network resources. ### Claim 11 (depends on 9) The computer readable medium of claim 9, wherein the software representation comprises a source code representation or an executable compiled from the source code representation and represents a plurality of states and transitions between states. ### Claim 12 (depends on 9) The computer readable medium of claim 9, wherein the software representation comprises a source code representation or an executable compiled from the source code representation and encapsulates a bitmap representing a plurality of states and transitions between states. ### Claim 13 (depends on 9) The computer readable medium of claim 9, wherein the objects comprise one or more entities and the entities comprise any of the following: computing devices, users, domains, group policy objects (GPOs), key vaults, subscriptions, tenants, resource groups, applications, virtual machines (VMs), groups, or organizational units (OUs). ### Claim 14 (depends on 9) The computer readable medium of claim 9, wherein the plurality of relationships comprise access rights or properties that a respective entity can use to interact with another entity. ### Claim 15 (depends on 9) The computer readable medium of claim 9, wherein the plurality of relationships are represented by respective state-transition-state tuples. ### Claim 16 (depends on 15) The computer readable medium of claim 15, wherein a state-transition-state tuple represents a relationship of the plurality relationships and corresponds to a condition, and a function of the plurality of functions includes the condition as a prerequisite to executing a corresponding function call. ### Claim 17 A computing system comprising: a memory storing a set of instructions; and a processor to execute the set of instructions to perform a set of acts comprising: identifying network configuration data and network policy data for a computer network; generating a software representation of the computer network based on the network configuration data and network policy data by: receiving the network configuration data and the network policy data; identifying a plurality of relationships between objects or entities represented in the network configuration data or the network policy data; and generating a plurality of functions based on the plurality of relationships, wherein at least some of the plurality of functions include one or more function calls selectable based on an input, at least one of the entities is identified for protection and associated with a crash statement, and the software representation is configured to be stimulated with inputs to identify a sequence of state-to-state transitions that cause execution of the crash statement. ### Claim 18 (depends on 17) The computing system of claim 17, wherein the network configuration data specifies access rights allocated to respective groups and the network policy data specifies a set of access rights for group members to access network resources. ### Claim 19 (depends on 17) The computing system of claim 17, wherein the software representation comprises a source code representation or an executable compiled from the source code representation and represents a plurality of states and transitions between states. ### Claim 20 (depends on 17) The computing system of claim 17, wherein the software representation comprises a source code representation or an executable compiled from the source code representation and encapsulates a bitmap representing a plurality of states and transitions between states. ### Claim 21 (depends on 17) The computing system of claim 17, wherein the objects comprise one or more entities and the entities comprise any of the following: computing devices, users, domains, group policy objects (GPOs), key vaults, subscriptions, tenants, resource groups, applications, virtual machines (VMs), groups, or organizational units (OUs). ### Claim 22 (depends on 17) The computing system of claim 17, wherein the plurality of relationships comprise access rights or properties that a respective entity can use to interact with another entity. ### Claim 23 (depends on 17) The computing system of claim 17, wherein the plurality of relationships are represented by respective state-transition-state tuples. ### Claim 24 (depends on 23) The computing system of claim 23, wherein a state-transition-state tuple represents a relationship of the plurality relationships and corresponds to a condition, and a function of the plurality of functions includes the condition as a prerequisite to executing a corresponding function call.