# US 12,647,445 B2 · System and method for emulating a known attack on a target computer network

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,647,445 B2
- Document ID: US12647445B2
- Status: Granted
- Kind: B2
- Application number: 18/434,372
- Filed: 2024-02-06
- Published: 2024-05-30
- Granted: 2026-06-02
- Earliest claimed: 2020-04-10
- Assignees: AttackIQ, Inc.
- Applicants: AttackIQ, Inc.
- Inventors: George Tomic; Andres Gazzoli; Pablo Caballero; Raul Lopez; Franco Ardiani; Juan Pablo Fuertes; Facundo Osimi; Rajesh K Sharma
- Web page: https://patentgrep.com/patent/US12647445B2

## CPC

- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- H04L 63/1491: {using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

One variation of a system for emulating a known attack on a computer network includes a computer system configured to: generate a set of data packets by recombining packet fragments transmitted between machines during a prior malicious attack on a second network; define transmission triggers for transmission of the set of data packets between pairs of agents connected to a target network based on timestamps of packet fragments; generate an executable file including the set of data packets and the transmission triggers; initiate transmission of the set of data packets between the pairs assets according to the set of transmission triggers to emulate the malicious attack on the target network; and, in response to absence of a security event related to the emulation in a log of a security technology deployed on the target network, generate a prompt to reconfigure the security technology to respond to the malicious attack.

## Claims

### Claim 1

A system for emulating a known attack on a computer network, the system comprising:
a second external asset; and
a computer system configured to:
access a set of data packets representing data transmitted between machines in communication with a second computer network during a malicious attack on the second computer network;
select a set of assets as actors in an emulation of the malicious attack on a target computer network, the set of assets comprising:
a first internal asset within the target computer network; and
the second external asset external to the target computer network;
for each data packet in the set of data packets:
assign a transmission trigger, in a set of transmission triggers, to the data packet based on transmission of corresponding data during the malicious attack on the second computer network;
select a recipient asset, in the set of assets, to receive the data packet; and
select a source asset, in the set of assets, to transmit the data packet to the recipient asset according to the transmission trigger;
generate an executable file:
comprising the set of data packets;
defining the set of transmission triggers; and
configured to selectively initiate transmission of data packets in the set of data packets, from the first internal asset to recipient assets in the set of assets, according to transmission triggers in the set of transmission triggers, responsive to execution of the executable file at the first internal asset;
store the executable file for loading onto the first internal asset; and
trigger the second external asset to store the set of data packets in local memory.

### Claim 2 (depends on 1)

The system of claim 1, wherein the computer system is further configured to:
access a set of network event records generated by a security technology, deployed on the target computer network, during transmission of the set of data packets from source assets to recipient assets, in the set of assets, according to the set of transmission triggers; and
in response to absence of a network event record, in the set of network event records, indicating the malicious attack:
generate a prompt to reconfigure the security technology to detect the malicious attack at the target computer network.

### Claim 3 (depends on 2)

The system of claim 2:
wherein the computer system configured to generate the executable file comprises the computer system configured to generate the executable file configured to trigger the first internal asset to generate a log comprising the set of network event records; and
wherein the computer system configured to access the set of network event records comprises the computer system configured to access the log comprising the set of network event records.

### Claim 4 (depends on 1)

The system of claim 1, wherein the computer system is further configured to:
access a set of network event records generated by a security technology, deployed on the target computer network, during transmission of the set of data packets from source assets to recipient assets, in the set of assets, according to the set of transmission triggers; and
in response to presence of a network event record, in the set of network event records, indicating the malicious attack:
confirm configuration of the security technology to respond to computer network attacks analogous to the malicious attack at the target computer network.

### Claim 5 (depends on 1)

The system of claim 1:
wherein the computer system configured to access the set of data packets comprises the computer system configured to access the set of data packets comprising a first data packet designating a first source address within the second computer network;
wherein the computer system configured to assign a transmission trigger, select a recipient asset, and select a source asset to each data packet in the set of data packet comprises the computer system configured to:
assign a first transmission trigger, in the set of transmission triggers, to the first data packet;
select the second external asset to receive the first data packet;
select the first internal asset to transmit the first data packet to the second external asset according to the first transmission trigger; and
replace the first source address, designated in the first data packet, with a second address of the first internal asset; and
wherein the computer system configured to generate the executable file comprises the computer system configured to generate the executable file comprising the first data packet designating the second address of the first internal asset.

### Claim 6 (depends on 5)

The system of claim 5:
wherein the computer system configured to select the set of assets as actors in the emulation of the malicious attack on the target computer network comprises the computer system configured to select the set of assets comprising:
the first internal asset located within the target computer network exhibiting a network boundary; and
the second asset external to the target computer network and the network boundary; and
wherein the computer system is further configured to:
access a set of network event records generated by a security technology, deployed on the target computer network, during transmission of the set of data packets from source assets to recipient assets, in the set of assets, according to the set of transmission triggers; and
in response to absence of a network event record, in the set of network event records, representing prevention of transmission from the first internal asset to the second external asset:
generate a prompt to reconfigure the security technology to prevent computer network traffic, analogous to the first data packet, across the network boundary of the target computer network.

### Claim 7 (depends on 1)

The system of claim 1:
further comprising a pool of external assets in the set of assets, the pool of external assets comprising the second external asset; and
wherein the computer system configured to select the set of assets as actors in the emulation of the malicious attack on the target computer network comprises the computer system configured to:
in response to execution of the executable file at the first internal asset, select the second external asset, from the pool of external assets, as an actor to emulate the external machine during the emulation of the malicious attack on the target network;
generate a first message indicating a first address of the second external asset in plain text format; and
transmit the first message to the first internal asset.

### Claim 8 (depends on 7)

The system of claim 7, wherein the computer system configured to select the second external asset from the pool of external assets comprises the computer system configured to:
identify a set of characteristics of an external machine, external to the second computer network, involved in the malicious attack on the second computer network based on addresses of source machines and addresses of destination machines associated with data interchanges represented by the set of data packets; and
select the second external asset exhibiting characteristics analogous to the set of characteristics of the external machine.

### Claim 9 (depends on 1)

The system of claim 1:
wherein the computer system configured to assign a transmission trigger, select a recipient asset, and select a source asset to each data packet in the set of data packet comprises the computer system configured to:
assign a first transmission trigger, in the set of transmission triggers, to a first data packet in the set of data packets;
select the first internal asset to receive the first data packet; and
select the second external asset to transmit the first data packet to the first internal asset according to the first transmission trigger; and
wherein the second external asset comprises an agent configured to initiate transmission of the first data packet from the second external asset to the first internal asset according to the first transmission trigger.

### Claim 10 (depends on 9)

The system of claim 9, wherein the computer system is further configured to:
transmit a first command, corresponding to the first transmission trigger, to the second external asset; and
transmit a second command, corresponding to a second transmission trigger in the set of transmission triggers, to the first internal asset in response to receiving a first message, from the first internal asset, indicating receipt of the first data packet.

### Claim 11 (depends on 1)

The system of claim 1, wherein the computer system configured to access a set of data packets comprises the computer system configured to:
access a packet capture file representing packet fragments transmitted between machines in communication with the second network during the malicious attack on the second network; and
recombine packet fragments within the packet capture file based on packet fragment metadata to generate the set of data packets.

### Claim 12 (depends on 1)

The system of claim 1, wherein the computer system is further configured to initiate transmission of the set of data packets from source assets to recipient assets, in the set of assets, according to the set of transmission triggers to emulate the malicious attack on the target network.

### Claim 13

A non-transitory computer-readable medium storing an executable file comprising instructions that, when executed by a processor of a first internal asset in a set of assets and within a target computer network, cause the processor to:
access a set of data packets from the executable file, the set of set of data packets representing data transmitted between machines in communication with a second computer network during a malicious attack on the second computer network, each data packet in the set of data packets:
associated with a transmission trigger, in a set of transmission triggers, based on transmission of corresponding data during the malicious attack on the second computer network;
defining a recipient asset, in the set of assets, to receive the data packet; and
defining the source asset, in the set of assets, to transmit the data packet to the recipient asset according to the transmission trigger;
store the set of data packets in local memory of the first internal asset, the set of data packets comprising a first data packet to which the first internal asset and a second external asset, in the set of assets, are assigned;
initiate transmission of the first data packet from the first internal asset to the second external asset according to a first transmission trigger, in the set of transmission triggers, during a target time period; and
generate a set of network event records during transmission of the set of data packets from source assets to recipient assets, in the set of assets, according to the set of transmission triggers during the target time period.

### Claim 14 (depends on 13)

The non-transitory computer-readable medium of claim 13, wherein the executable file further comprises instructions that, when executed by the processor, cause the processor to:
detect a first digital signature within a second data packet, in the set of data packets, received from the second external asset, the first internal asset and the second external asset assigned to the first internal asset assigned to the second data packet; and
discard the second data packet in response to detecting the first digital signature.

### Claim 15 (depends on 14)

The non-transitory computer-readable medium of claim 14, wherein the executable file further comprises instructions that, when executed by the processor, cause the processor to:
generate a first message indicating receipt of the second data packet from the second external asset; and
transmit the first message to a computer system.

### Claim 16 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the executable file further comprises instructions that, when executed by the processor, cause the processor to:
in response to receiving a second message, at the first internal asset and from the computer system, representing a second transmission trigger in the set of transmission triggers:
initiate transmission of a third data packet, in the set of data packets, from the first internal asset to the second external asset according to the second transmission trigger.

### Claim 17 (depends on 13)

The non-transitory computer-readable medium of claim 13, wherein the executable file further comprises instructions that, when executed by the processor, cause the processor to:
query a computer system for a target address of a recipient asset to receive the first data packet, the first data packet designating a first destination address; and
in response to receiving a second address of the second external asset assigned to the first data packet, replace the first destination address, designated in the first data packet, with the second address of the second external asset.

### Claim 18 (depends on 13)

The non-transitory computer-readable medium of claim 13, wherein the executable file further comprises instructions that, when executed by the processor, cause the processor to remove the set of data packets from local memory of the first internal asset during the second time period succeeding the target time period.

### Claim 19

A system for emulating a known attack on a computer network, the system comprising:
a computer system configured to:
access a set of data packets representing behaviors of machines in communication with a second computer network during a malicious attack on the second computer network;
select a set of assets as actors in an emulation of the malicious attack on a target computer network, the set of assets comprising:
a first internal asset within the target computer network; and
a second external asset external to the target computer network;
for each data packet in the set of data packets:
assign a behavior trigger, in a set of behavior triggers, to the data packet based on a corresponding behavior during the malicious attack on the second computer network;
select a recipient asset, in the set of assets, to receive the data packet; and
select a source asset, in the set of assets, to transmit the data packet to the recipient asset according to the transmission trigger;
generate an executable file:
populated with the set of data packets and the set of behavior triggers; and
configured to selectively initiate transmission of the data packets, in the set of data packets, from the first internal asset to recipient assets in the set of assets, according to behavior triggers in the set of behavior triggers, responsive to execution of the executable file at the first internal asset; and
store the executable file for loading onto the first internal asset.

### Claim 20 (depends on 19)

The system of claim 19:
wherein the computer system is further configured to:
initiate transmission of the set of data packets from source assets to recipient assets, in the set of assets, according to the set of behavior triggers to emulate the malicious attack on the target network during a target time period;
access a set of network event records generated by a security technology, deployed on the target computer network, during the target time period; and
in response to absence of a network event record, in the set of network event records, indicating the malicious attack:
generate a prompt to reconfigure the security technology to detect the malicious attack at the target computer network.