System and method for emulating a multi-stage attack on a node within a target network

A method comprising:

• accessing an attack record defining a sequence of actions executed on a machine in a second computer network;
• for each action in the sequence of actions:
• based on the attack record, deriving an effect of the action on the machine in the second computer network;
• based on the attack record, defining a set of behaviors analogous to the action and executable by a target asset to emulate the effect of the action on the machine in the second computer network;
• and
• storing the set of behaviors in a node in a set of nodes in an attack graph;
• connecting the set of nodes in the attack graph according to the sequence of actions representing a known attack on the second computer network;
• and
• scheduling the target asset connected to a target network to automatically execute analogous behaviors stored in the set of nodes in the attack graph.

A method comprising:

• scheduling a target asset connected to a target network to automatically execute analogous behaviors stored in an attack graph comprising a set of nodes connected according to a sequence of actions representing a known attack on a second computer network, each node in the set of nodes:
• corresponding to an action in the sequence of actions;
• and
• storing a set of behaviors analogous to the action and executable by the target asset to emulate an effect of the action on a machine in the second computer network;
• and
• characterizing a vulnerability of the target network based on presence of alerts in a set of alerts, generated by a set of security tools deployed on the target network, indicating detection and prevention of analogous behaviors executed by the target asset.