US 12,603,914 B2Granted

Cybersecurity gap identification using knowledge graphs

AssigneeArctic Wolf Networks, Inc.

InventorsMatthew Wayne Keen, Kaushik Sarkar, Sylvain Huy Phong Lu, Saravana Bhawa Nukala, Aditya Deepak Mahale, Avneet Singh, Yuxuan Hu, Mallik Imtiaz Hassan, Rubin K C

Life of this patent

Estimating the term…

patentgrep

Loading patent…

Abstract

Disclosed are systems for detecting gaps in security measures performed in a network security environment. A system can: receive prevention data from a prevention system that generates and provides prevention measures to a third party system in a network security environment to prevent potential vulnerabilities, receive detection data from a detection system that generates and provides detection measures to the third party system to block the potential vulnerabilities, receive a framework taxonomy that includes relationships between vulnerabilities, tactics, techniques, and sub-techniques, and generate a knowledge graph based on mapping the prevention data, the detection data, and the tactics, techniques, and sub-techniques of the framework taxonomy. The system can also traverse the knowledge graph, iteratively detect gaps in the prevention measures or the detection measures based on traversing the knowledge graph, and return information about the detected gaps.

A system for detecting gaps in cybersecurity measures performed in a network security environment, the system comprising:

a cybersecurity prevention system comprising one or more processors and memory storing instructions that, when executed, cause the one or more processors to generate and provide prevention measures to a third party system in a network security environment, wherein the prevention measures comprise configuration settings that, when implemented at the third party system, cause the third party system to prevent potential cybersecurity vulnerabilities;
a cybersecurity detection system comprising one or more processors and memory storing instructions that, when executed, cause the one or more processors to generate and provide detection measures to the third party system in the network security environment, wherein the detection measures comprise rules that are triggered, by the third party system, in response to detecting and blocking the potential cybersecurity vulnerabilities;
a mapping engine comprising one or more processors and memory storing instructions that, when executed, cause the one or more processors to:
receive prevention data from the cybersecurity prevention system;
receive detection data from the cybersecurity detection system;
receive a framework taxonomy from a cybersecurity framework, wherein the framework taxonomy comprises relationships between cybersecurity vulnerabilities, tactics, techniques, and sub-techniques;
and
generate a knowledge graph based on mapping the prevention data, the detection data, and the tactics, techniques, and sub-techniques of the framework taxonomy;
and
a gap detection engine comprising one or more processors and memory storing instructions that, when executed, cause the one or more processors to:
receive the knowledge graph from the mapping engine;
traverse the knowledge graph;
iteratively detect gaps in the prevention measures or the detection measures based on traversing the knowledge graph, wherein iteratively detecting the gaps comprises generating weighted count values for connections between nodes in the knowledge graph and based on the traversing;
rank the detection measures and the prevention measures according to the weighted count values;
select a subset of the ranked detection measures and prevention measures having the weighted count values that satisfy one or more improvement criteria;
and
return information about the selected subset of the ranked detection measures and prevention measures as opportunities for improvement.

14 more elements

Abstract

Claims13