Analytical attack graph differencing

A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for mitigating risk in an enterprise network based on (AAGs), each AAG representative of potential lateral movement within the enterprise network, the operations comprising:

• receiving data representative of two or more AAGs;
• providing an identifier for each element of each of the two or more AAGs, each identifier being unique within a respective AAG, at least one identifier being non-unique between the two or more AAGs;
• determining an attribute value for each element of each of the two or more AAGs;
• storing attribute value to element mappings in an attribute dictionary;
• providing a differenced AAG based on the attribute value to element mappings in the attribute dictionary;
• determining a set of remedial actions at least partially based on the differenced AAG;
• and
• executing one or more remedial actions in the set of remedial actions to reduce a cyber security risk to the enterprise network.

A system, comprising:

• a computing device;
• and
• a computer-readable storage device coupled to the computing device and having instructions stored thereon which, when executed by the computing device, cause the computing device to perform operations for mitigating risk in an enterprise network based on (AAGs), each AAG representative of potential lateral movement within the enterprise network, the operations comprising:
• receiving data representative of two or more AAGs;
• providing an identifier for each element of each of the two or more AAGs, each identifier being unique within a respective AAG, at least one identifier being non-unique between the two or more AAGs;
• determining an attribute value for each element of each of the two or more AAGs;
• storing attribute value to element mappings in an attribute dictionary;
• providing a differenced AAG based on the attribute value to element mappings in the attribute dictionary;
• determining a set of remedial actions at least partially based on the differenced AAG;
• and
• executing one or more remedial actions in the set of remedial actions to reduce a cyber security risk to the enterprise network.