Computer attack model management
AssigneeHewlett Packard Enterprise Development LP
InventorsPhilipp Reinecke, Marco Casassa Mont, Yolanta Beresna
Life of this patent
Estimating the term…
Abstract
Examples relate to computer attack model management. In one example, a computing device may: identify a first set of attack models, each attack model in the first set specifying behavior of a particular attack on a computing system; obtain, for each attack model in the first set, performance data that indicates at least one measure of attack model performance for a previous use of the attack model in determining whether the particular attack occurred on the computing system; and update the first set of attack models based on the performance data.
Claims20
A computing device for computer attack model management, the computing device comprising:
- a hardware processor;
- and
- a data storage device storing instructions that, when executed by the hardware processor, cause the hardware processor to:
- identify a first set of attack models, each attack model in the first set specifying behavior of a particular attack on a computing system;
- obtain, for each attack model in the first set, performance data that indicates at least one measure of attack model performance for a previous use of the attack model in determining whether the particular attack occurred on the computing system;
- and
- update the first set of attack models based on the performance data.
A method for computer attack model management, implemented by a hardware processor, the method comprising:
- identifying a first set of attack models, each attack model in the first set specifying behavior of a particular attack on a computing system;
- obtaining, for each attack model in the first set, performance data that indicates at least one measure of attack model performance for a previous use of the attack model in determining whether the particular attack occurred on the computing system, the performance data including:
- resource usage measurements that indicate computing resources used to execute actions specified by the corresponding attack model;
- and
- analytics results data that indicates whether the corresponding attack model successfully detected the particular attack;
- and
- in response to a triggering event, update the first set of attack models based on the performance data.
A non-transitory machine-readable storage medium encoded with instructions executable by a hardware processor of a computing device for computer attack model management, the machine-readable storage medium comprising instructions to cause the hardware processor to:
- identify a first set of attack models, each attack model in the first set specifying behavior of a particular attack on a computing system;
- obtain, for each attack model in the first set, performance data that indicates at least one measure of attack model performance for a previous use of the attack model in determining whether the particular attack occurred on the computing system;
- and
- in response to a triggering event, update the first set of attack models based on the performance data.
Dependencies are inferred from the claim text.