Back to results
US 7,627,900 B1Granted
Attack graph aggregation
AssigneeGeorge Mason Intellectual Properties, Inc.
InventorsSteven E. Noel, Sushil Jajodia
Life of this patent
Estimating the term…
Abstract
Disclosed is framework for aggregating network attack graphs. A network may be represented as a dependency graph. Condition set(s), exploit set(s) and machine set(s) may be generated using information from the dependency graph. Exploit-condition set(s) may be generated using the condition set(s) and the exploit set(s). Machine-exploit set(s) may be generated using the exploit-condition set(s) and machine set(s).
Claims20
A tangible computer readable storage medium storing a computer program that when executed by one or more processors, causes the one or more processors to perform the steps of:
- a) inputting a dependency graph for a network that maps interdependencies among a multitude of exploits with respect to a multitude of conditions on a multitude of processing machines in said “network,” at least one of said “multitude of exploits” including at least one precondition mapped to at least one postcondition, said “multitude of conditions” including at least one of said “at least one precondition” and at least one of said “at least one postcondition”;
- b) generating at least one condition set, each of said “at least one condition set” associated to one of said “multitude of exploits” by:
- c) aggregating at least two of said “multitude of conditions” that have preconditions mapped to the same at least one of said “multitude of exploits”;
- and
- d) aggregating at least two of said “multitude of conditions” that have postconditions mapped from the same at least one of said “multitude of exploits”;
- e) generating an exploit set by aggregating at least one of said “multitude of exploits” that all have at least one of said “at least one precondition” mapped from a common one of said “multitude of processing machines” and have at least one of said “at least one postcondition” mapped to a common one of said “multitude of processing machines”;
- f) generating at least one exploit-condition set, each of said “at least one exploit-condition set” generated by aggregating at least one of said “at least one condition set” that is associated to said “exploit set”;
- and
- g) generating at least one machine set, each of said “at least one machine set” generated by aggregating at least one of said “at least one condition set” that is associated to at least one of said “multitude of processing machines”.
6 more elements
A computer readable storage medium storing a computer program comprising:
- a) a dependency graph inputter configured to input a dependency graph for a network that maps interdependencies among a multitude of exploits with respect to a multitude of conditions on a multitude of processing machines in said “network,” at least one of said “multitude of exploits” including at least one precondition mapped to at least one postcondition, said “multitude of conditions” including at least one of said “at least one precondition” and at least one of said “at least one postcondition”;
- b) a condition set generator configured to generate at least one condition set, each of said “at least one condition set” associated to one of said “multitude of exploits” by:
- i) aggregating at least two of said “multitude of conditions” that have preconditions mapped to the same at least one of said “multitude of exploits”;
- and
- ii) aggregating at least two of said “multitude of conditions” that have postconditions mapped from the same at least one of said “multitude of exploits”;
- c) an exploit set generator configured to generate an exploit set by aggregating at least one of said “multitude of exploits” that all have at least one of said “at least one precondition” mapped from a common one of said “multitude of processing machines” and have at least one of said “at least one postcondition” mapped to a common one of said “multitude of processing machines”;
- d) an exploit-condition set generator configured to generate at least one exploit-condition set, each of said “at least one exploit-condition set” generated by aggregating at least one of said “at least one condition set” that is associated to said “exploit set”;
- and
- e) a machine set generator configured to generate at least one machine set, each of said “at least one machine set” generated by aggregating at least one of said “at least one condition set” that is associated to at least one of said “multitude of processing machines”.
6 more elements
Dependencies are inferred from the claim text.