System, Method and Computer Readable Medium for Evaluating a Security Characteristic
AssigneeSkybox Security Inc.
InventorsAmnon Lotem, Gideon Cohen, Ilan Horn, Moshe Meiseles
Life of this patent
Estimating the term…
Abstract
A method, system and computer program product for evaluating an IDP entity, the method includes evaluating an effect of at least one IDP rule applied by the IDP entity on legitimate traffic, based upon a network model; evaluating an effect of at least one IDP rule applied by the IDP entity based upon a network model and an attack model; determining an effectiveness of the IDP entity in response to the evaluated effects.
Claims42
A method for evaluating a security characteristic, the method comprising:
- (a) generating a network model representative of a topology of a network and of vulnerabilities of network nodes;
- (b) generating an attack dictionary representative of attack actions on at least one network node;
- (c) determining access and IDP information representative of possible communication paths through the network and of IDP rules applied during the possible communication paths;
- (d) evaluating at least one first result of at least one attack on at least one network node;
- and (g) evaluating a security characteristic in response to the at least one first result.
A method for evaluating a IDP entity, the method comprises:
- evaluating an effect of at least one IDP rule applied by the IDP entity on legitimate traffic, based upon a network model;
- evaluating an effect of at least one IDP rule applied by the IDP entity based upon a network model and an attack model;
- determining an effectiveness of the IDP entity in response to the evaluated effects.
A method comprising:
- performing access and IDP analysis such as to identify remote services that can be accessed from at least one source;
- examining, for the identified remote services, related attacking actions that belong to a selected group of attack actions and identifying the IDP rules which are applied to the packets sent to the identified remote services.
A computer program product comprising a computer usable medium including a computer readable program, wherein the computer readable program when executed on a computer causes the computer to (a) generate a network model representative of a topology of a network and of vulnerabilities of network nodes;
- (b) generate an attack dictionary representative of attack actions on at least one network node;
- (c) determine access and IDP information representative of possible communication paths through the network and of IDP rules applied during the possible communication paths;
- (d) evaluate at least one first result of at least one attack on at least one network node;
- and (g) evaluate a security characteristic in response to the at least one first result.
A computer program product comprising a computer usable medium including a computer readable program, wherein the computer readable program when executed on a computer causes the computer to evaluate an effect of at least one IDP rule applied by the IDP entity on legitimate traffic, based upon a network model;
- evaluate an effect of at least one IDP rule applied by the IDP entity based upon a network model and an attack model;
- and to determine an effectiveness of the IDP entity in response to the evaluated effects.
A computer program product comprising a computer usable medium including a computer readable program, wherein the computer readable program when executed on a computer causes the computer to perform access and IDP analysis such as to identify remote services that can be accessed from at least one source;
- examine, for the identified remote services, related attacking actions that belong to a selected group of attack actions and identify the IDP rules which are applied to the packets sent to the identified remote services.
A system for evaluating a security characteristic, the system comprises:
- at least one data base adapted to store a network model representative of a topology of a network and of vulnerabilities of network nodes, an attack dictionary representative of attack actions on at least one network node;
- and at least one module adapted to:
- determine access and IDP information representative of possible communication paths through the network and of IDP rules applied during the possible communication paths;
- evaluate at least one first result of at least one attack on at least one network node;
- and
- evaluate a security characteristic in response to the at least one first result.
A system for evaluating a IDP entity, the system comprises:
- at least one data base adapted to store a network model;
- and
- at least one module adapted to:
- evaluate an effect of at least one IDP rule applied by the IDP entity on legitimate traffic, based upon the network model;
- evaluate an effect of at least one IDP rule applied by the IDP entity based upon a network model and an attack model;
- and
- determine an effectiveness of the IDP entity in response to the evaluated effects.
A system comprising at least one module adapted to perform access and IDP analysis such as to identify remote services that can be accessed from at least one source;
- examine, for the identified remote services, related attacking actions that belong to a selected group of attack actions and identify the IDP rules which are applied to the packets sent to the identified remote services.
Dependencies are inferred from the claim text.