Systems for network risk assessment including processing of user access rights associated with a network of devices

Patent metadata

Field	Value
Publication number	US-10462175-B2
Application number	US-201815877637-A
Country	US
Kind code	B2
Filing date	Jan 23, 2018
Priority date	Dec 29, 2014
Publication date	Oct 29, 2019
Grant date	Oct 29, 2019

Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for network risk assessment. One of the methods includes obtaining information describing network traffic between a plurality of network devices within a network. A network topology of the network is determined based on the information describing network traffic, with the network topology including nodes connected by an edge to one or more other nodes, and with each node being associated with one or more network devices. Indications of user access rights of users are associated to respective nodes included in the network topology. User interface data associated with the network topology is generated.

First claim

What is claimed is:

1. A computerized method comprising:
by a computing device having one or more computer processors and a non-transitory computer readable storage device storing software instruction for execution by the one or more computer processors,
determining a network topology of a network, the network topology comprising a plurality of nodes each connected to one or more of the plurality of nodes, wherein each node is associated with one or more network devices;
accessing information indicating compromise values associated with respective nodes; and
providing, for presentation, an interactive user interface, wherein the interactive user interface presents a graphical depiction of the network topology and compromise values associated with the plurality of nodes.

2. The method of claim 1 , further comprising:
selecting, for each node in the graphical depiction of the network topology, a label of a plurality of labels to be assigned to the node based on the compromise value associated with the node, each label graphically representing a respective range of compromise values; and
presenting, in the interactive user interface, a respective label for each of the nodes in the graphical depiction of the network topology.

3. The method of claim 1 , further comprising:
receiving user input, via the interactive user interface, selecting a particular node included in the graphical depiction of the network topology;
identifying access rights associated with the particular node, the access rights identifying one or more nodes with which the particular node can communicate; and
updating the graphical depiction of the network topology based on the identified access rights.

4. The method of claim 3 , wherein the graphical depiction of the network topology comprises visual representations of the plurality of nodes, and wherein updating the graphical depiction comprises:
updating the visual representations of the identified nodes with which the particular node can communicate, the updated visual representations comprising a same pattern or a same color.

5. The method of claim 1 , further comprising:
accessing information indicating compromise likelihoods associated with respective nodes, each compromise likelihood representing a likelihood of network devices being compromised; and
presenting, in the graphical depiction of the network topology, compromise likelihoods associated with the plurality of nodes.

6. The method of claim 5 , further comprising:
determining compromise risk values for the plurality of nodes, each compromise risk value for a node representing a compromise value associated with the node scaled according to a compromise likelihood associated with the node; and
updating the graphical depiction of the network topology to present the compromise risk values.

7. The method of claim 1 , further comprising:
receiving user input, via the interactive user interface, indicating a particular user account;
determining user account access rights associated with the particular user account, the user account access rights indicating access attempts to one or more nodes of the plurality of nodes; and
updating the graphical depiction of the network topology to identify the one or more nodes.

8. The method of claim 7 , wherein the interactive user interface includes a slider configured to adjust a time period associated with user account access rights.

9. The method of claim 7 , further comprising:
determining a node for which the particular user account is allowed access and has not accessed within a particular period of time; and
updating the graphical depiction of the network topology to identify the determined node.

10. The method of claim 1 , further comprising:
obtaining information indicating a critical area of the network topology, the critical area encompassing one or more nodes of the plurality of nodes;
determining one or more of: a percentage of user accounts allowed access to a node in the critical area or a percentage of nodes configured to communicate with a node in the critical area; and
presenting, in the interactive user interface, summary information associated with the determination.

11. The method of claim 10 , wherein obtaining information indicating a critical area is based on user input identifying the critical area or based on the encompassed one or nodes being associated with comprise risk values greater than a threshold.

12. A computer program product, encoded on one or more non-transitory computer storage media, comprising instructions that when executed by one or more computers cause the one or more computers to perform operations comprising:
determining a network topology of a network, the network topology comprising a plurality of nodes each connected to one or more of the plurality of nodes, wherein each node is associated with one or more network devices;
accessing information indicating compromise values associated with respective nodes; and
providing, for presentation, an interactive user interface, wherein the interactive user interface presents a graphical depiction of the network topology and compromise values associated with the plurality of nodes.

13. The computer program product of claim 12 , wherein the operations further comprise:
receiving user input, via the interactive user interface, selecting a particular node included in the graphical depiction of the network topology;
identifying access rights associated with the particular node, the access rights identifying one or more nodes with which the particular node can communicate; and
updating the graphical depiction of the network topology based on the identified access rights.

14. The computer program product of claim 13 , wherein the graphical depiction of the network topology comprises visual representations of the plurality of nodes, and wherein updating the graphical depiction comprises:
updating the visual representations of the identified nodes with which the particular node can communicate, the updated visual representations comprising a same pattern or a same color.

15. The computer program product of claim 12 , wherein the operations further comprise:
receiving user input, via the interactive user interface, indicating a particular user account;
determining user account access rights associated with the particular user account, the user account access rights indicating access attempts to one or more nodes of the plurality of nodes; and
updating the graphical depiction of the network topology to identify the one or more nodes,
wherein the interactive user interface includes a slider configured to adjust a time period associated with user account access rights.

16. The computer program product of claim 12 , wherein the operations further comprise:
obtaining information indicating a critical area of the network topology, the critical area encompassing one or more nodes of the plurality of nodes; and
determining one or more of: a percentage of user accounts allowed access to a node in the critical area or a percentage of nodes configured to communicate with a node in the critical area; and
presenting, in the interactive user interface, summary information associated with the determination.

17. The computer program product of claim 16 , wherein obtaining information indicating a critical area is based on user input identifying the critical area or based on the encompassed one or nodes being associated with comprise risk values greater than a threshold.

18. A system comprising one or more computers and non-transit

Assignees

• Palantir Technologies Inc

Inventors

• Seiver Miles
• Rosenblum Charles

Classifications

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L43/0876

  Network utilisation, e.g. volume of load or congestion level · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title

• H04L41/12

  Discovery or management of network topologies · CPC title