Network security modeling system and method

A network security modeling system comprising:

• a network configuration module having network configuration data;
• a simulator coupled to the network configuration module for simulating and analyzing networks based on the network configuration, wherein the simulator includes a network vulnerabilities database;
• and
• a mission objectives module coupled to the simulator, wherein the mission objectives module includes critical resource information used to determine network components that are involved in a specific attack scenario.

A method of analyzing a computer network using a security modeling system, wherein the security modeling system includes a database of network vulnerability information, the method comprising:

• receiving a network configuration of a computer network;
• simulating the network based on the network configuration;
• and
• determining vulnerabilities of the simulated network using the vulnerability information stored in the database, wherein the database includes a plurality of known network vulnerabilities, wherein each network vulnerability includes:
• a plurality of known network vulnerabilities, wherein each network vulnerability includes a service to which it applies, defense conditions that might close the vulnerability, and resource and state conditions needed to exercise the vulnerability.

A method of opposing attackers of a computer network, comprising:

• receiving a network configuration, wherein the network configuration comprises computer hardware and software component information;
• receiving mission objectives including critical resource information used to determine network components that are involved in a specific attack scenario;
• receiving commands from a network attacker;
• simulating the network based on the commands received from the network attacker, wherein simulating the network includes determining results as a function of the network configuration, mission objectives and stored vulnerability data for the described computer hardware and software components;
• and
• responding to the network attacker, wherein responding to the attacker includes responses selected from a group of responses including imposing barriers, providing response messages and protecting the network.