Ai-driven defensive cybersecurity strategy analysis and recommendation system
AssigneeQomplx LLC
InventorsJason Crabtree, Richard Kelley, Jason Hopper, David Park
Life of this patent
Estimating the term…
Abstract
A system and method for automated cybersecurity defensive strategy analysis that predicts the evolution of new cybersecurity attack strategies and makes recommendations for cybersecurity improvements to networked systems based on a cost/benefit analysis. The system and method use machine learning algorithms to run simulated attack and defense strategies against a model of the networked system created using a directed graph. Recommendations are generated based on an analysis of the simulation results against a variety of cost/benefit indicators.
Claims16
A system for automated cybersecurity defensive strategy analysis and recommendations, comprising:
- a computing system comprising a processor, a memory, and a network interface;
- an attack implementation subsystem comprising a first plurality of programming instructions that, when operating on the processor, cause the computing system to:
- execute a cyberattack on a network under test;
- and
- gather operational information during the cyberattack;
- a machine learning simulator subsystem comprising a second plurality of programming instructions that, when operating on the processor, cause the computing system to:
- use the operational information to generate a plurality of simulated attack outcomes using iterative simulations of a plurality of cyberattack strategy sequences each comprising a simulated attack on a model of the network under test and a simulated defense against the simulated attack, each simulated attack being generated by a first machine learning algorithm;
- and
- determine a probability of success of the attack and a probability of success of the defense in each cyberattack strategy sequence;
- and
- a recommendation engine subsystem comprising a third plurality of programming instructions that, when operating on the processor, cause the computing system to:
- compare the simulated attack outcomes against one or more cost factors and one or more benefit factors;
- and
- determine a cybersecurity improvement recommendation for the network under test based on the comparison.
A method for automated cybersecurity defensive strategy analysis and recommendations, comprising the steps of:
- executing a cyberattack on a network under test;
- gathering operational information during the cyberattack;
- using the operational information to generate a plurality of simulated attack outcomes using iterative simulations of a cyberattack strategy sequences each comprising a simulated attack on a model of the network under test and a simulated defense against the simulated attack, each simulated attack being generated by a first machine learning algorithm;
- determining a probability of success of the attack and a probability of success of the defense in each cyberattack strategy sequence;
- comparing the simulated attack outcomes against one or more cost factors and one or more benefit factors;
- and
- determining a cybersecurity improvement recommendation for the network under test based on the comparison.
Dependencies are inferred from the claim text.