# US 12,603,909 B2 · Network monitoring with multiple attack graphs > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,603,909 B2 - Document ID: US12603909B2 - Status: Granted - Kind: B2 - Application number: 18/844,143 - Filed: 2023-02-10 - Published: 2025-05-29 - Granted: 2026-04-14 - Earliest claimed: 2022-03-10 - Assignees: British Telecommunications public limited company - Applicants: British Telecommunications Public Limited Company - Inventors: Ian Herwono; Fadi El-Moussa - Web page: https://patentgrep.com/patent/US12603909B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 21/554: {involving event detection and direct action} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A computer-implemented method for monitoring a computer network is provided, the method comprising: storing a first attack graph, the attack graph comprising a plurality of nodes each representing an event that may occur within the computer network; storing one or more predetermined variation properties of one or more of the events represented by the nodes, the variation properties being indicative of possible changes to the nodes within the first attack graph; determining a plurality of possible alternative sequences of the nodes in the first attack graph based on the variation properties; generating a plurality of additional attack graphs, each of the additional attack graphs comprising a plurality of the nodes of the first attack graph arranged in one of the possible sequences; and monitoring events within the network to detect a set of events occurring in a sequence that corresponds to one of the additional attack graphs to identify a potential security attack. A computer system including at least one processor and memory storing computer program code configured to perform the said method, and a computer program or computer readable medium comprising instructions that when executed by a computer system cause the computer system to perform the said method are also provided. ## Claims ### Claim 1 A computer implemented method for monitoring a computer network, the method comprising: storing a first attack graph, the attack graph comprising a plurality of nodes each representing an event that may occur within the computer network; storing one or more predetermined variation properties of one or more of the events represented by the nodes, the variation properties being indicative of possible changes to the nodes within the first attack graph; determining a plurality of possible alternative sequences of the nodes in the first attack graph based on the variation properties; generating a plurality of additional attack graphs, each of the additional attack graphs comprising a plurality of the nodes of the first attack graph arranged in one of the possible sequences; and monitoring events within the network to detect a set of events occurring in a sequence that corresponds to one of the additional attack graphs to identify a potential security attack. ### Claim 2 (depends on 1) The method of claim 1 wherein the variation properties include requirements needed for one or more particular events represented by the nodes to occur. ### Claim 3 (depends on 2) The method of claim 2 wherein the requirements include one or more prerequisite events that need to occur before the particular events can occur. ### Claim 4 (depends on 1) The method of claim 1, wherein the variation properties include optional events that may be omitted or bypassed in a security attack. ### Claim 5 (depends on 4) The method of claim 4, wherein generating the plurality of additional attack graphs includes omitting one or more of the nodes representing optional events from the additional attack graphs. ### Claim 6 (depends on 1) The method of claim 1, wherein the first attack graph is determined by receiving one or more inputs from a user within a user interface. ### Claim 7 (depends on 1) The method of claim 1, wherein the predetermined variation properties are determined by receiving one or more inputs from a user within a user interface. ### Claim 8 (depends on 1) The method of claim 1, wherein at least one of the nodes specifies one or more devices and/or one or more systems at which the events occur or may occur. ### Claim 9 (depends on 8) The method of claim 8 wherein the device or system at which the events occur or may occur is specified by using at least one identifier such as an IP address or a MAC address. ### Claim 10 (depends on 8) The method of claim 8, wherein the device or system at which events occur or may occur is specified by receiving one or more inputs from a user within a user interface. ### Claim 11 (depends on 1) The method of claim 1, wherein monitoring events within the network comprises analysing logs of the network. ### Claim 12 (depends on 1) The method of claim 1, wherein the logs of the network, the first attack graph, the predetermined variation properties and the additional attack graphs are stored in a database. ### Claim 13 (depends on 1) The method of claim 1, further comprising generating an alert upon detecting that a set of events occurs in a sequence that corresponds to one of the additional attack graphs. ### Claim 14 A computer system for monitoring a computer network, the computer system comprising at least one processor and memory storing computer program code which is executable by the at least one processor such that computer system is configured to: store a first attack graph, the attack graph comprising a plurality of nodes each representing an event that may occur within the computer network; store one or more predetermined variation properties of one or more of the events represented by the nodes, the variation properties being indicative of possible changes to the nodes within the first attack graph; determine a plurality of possible alternative sequences of the nodes in the first attack graph based on the variation properties; generate a plurality of additional attack graphs, each of the additional attack graphs comprising a plurality of the nodes of the first attack graph arranged in one of the possible sequences; and monitor events within the network to detect a set of events occurring in a sequence that corresponds to one of the additional attack graphs to identify a potential security attack. ### Claim 15 (depends on 14) The computer system of claim 14 wherein: the variation properties include requirements needed for one or more particular events represented by the nodes to occur; and the requirements include one or more prerequisite events that need to occur before the particular events can occur. ### Claim 16 (depends on 14) The computer system of claim 14, wherein: the variation properties include optional events that may be omitted or bypassed in a security attack; and the generation of the plurality of additional attack graphs includes omission of one or more of the nodes representing optional events from the additional attack graphs. ### Claim 17 (depends on 14) The computer system of claim 14 wherein the predetermined variation properties are determined by receiving one or more inputs from a user within a user interface. ### Claim 18 (depends on 14) The computer system of claim 14 wherein: at least one of the nodes specifies one or more devices and/or one or more systems at which the events occur or may occur; and the device or system at which the events occur or may occur is specified by using at least one identifier such as an IP address or a MAC address. ### Claim 19 (depends on 14) The computer system of claim 14 wherein: at least one of the nodes specifies one or more devices and/or one or more systems at which the events occur or may occur; and the device or system at which events occur or may occur is specified by receiving one or more inputs from a user within a user interface. ### Claim 20 (depends on 1) A non-transitory computer-readable storage medium storing a computer program comprising instructions that when executed by a computer system cause the computer system to perform the steps of the method of claim 1.