Synthetic cyber-risk model for vulnerability determination

Patent metadata

Field	Value
Publication number	US-10574685-B2
Application number	US-201816036138-A
Country	US
Kind code	B2
Filing date	Jul 16, 2018
Priority date	Nov 11, 2014
Publication date	Feb 25, 2020
Grant date	Feb 25, 2020

Abstract

A system, method, and device are presented for assessing a target network's vulnerability to a real cyberthreat based on determining policy-based synthetic tests configured to model the behavior of the cyberthreat. Real-time feedback from the target network (e.g., servers, desktops, and network/monitoring hardware and/or software equipment) are received, analyzed, and used to determine whether any modifications to the same or a new synthesized test is preferred. The technology includes self-healing processes that, using the feedback mechanisms, can attempt to find patches for known vulnerabilities, test for unknown vulnerabilities, and configure the target network's resources in accordance with predefined service-level agreements.

First claim

We claim:

1. A method comprising:
receiving information associated with a cyberthreat at a threat simulation server, wherein the cyberthreat is associated with an objective;
using the information, mapping, by the threat simulation server, one or more characteristics of the cyberthreat into instructions for performing steps to simulate an existence of the cyberthreat within a target network without implementing the objective of the cyberthreat in the target network, the target network comprising a plurality of computing devices;
determining one or more agents to execute the instructions on one or more computing devices from the plurality of computing devices;
initiating execution of the instructions by the one or more agents on the one or more computing devices to simulate the existence of the cyberthreat within the target network;
receiving feedback including receiving a level of success of the one or more agents in performing the steps; and
generating an analysis, based on the feedback, that includes a recommended configuration change to the security response capabilities of a computing device of the plurality of computing devices within the target network which improves the computing device's response to future instances of the cyberthreat.

2. The method of claim 1 , wherein the feedback includes:
a number of the steps that were successfully completed; and
an indication of whether the computing device detected the cyberthreat or how the computing device responded to the cyberthreat.

3. The method of claim 1 , wherein mapping one or more of the characteristics of the cyberthreat to instructions includes determining logic that, when executed by the one or more agents, would achieve the objective of the cyber-threat if the cyberthreat were to execute the objective successfully, wherein the logic is configured to dynamically generate a file, create network communication, or access a user account, system, account, directory, database, or registry.

4. The method of claim 1 , wherein receiving information associated with the cyberthreat includes:
receiving an indication of the cyberthreat to data security from an external source; and
determining the one or more characteristics of the cyberthreat based on information from the external source.

5. The method of claim 1 , further comprising automatically implementing the recommended configuration change responsive to the analysis.

6. The method of claim 1 , wherein generating the analysis includes comparing the target network's level of vulnerability to the cyberattack to a threshold, the recommended configuration change being generated responsive to the comparing.

7. The method of claim 1 , wherein the recommended configuration change is dynamically generated based on a configurable set of rules.

8. The method of claim 1 , wherein the recommended configuration change includes at least one of: dynamically terminating network communication ports used by the simulated cyberthreat; enabling a firewall rule; failing the target network so that network traffic is routed to a failover network; or routing traffic to a demilitarized zone for further analysis in a sandbox network.

9. A non-transitory computer-readable medium storing instructions that, when executed, cause one or more processors to perform operations comprising:
receiving information associated with a cyberthreat at a threat simulation server, wherein the cyberthreat is associated with an objective;
using the information, mapping, by the threat simulation server, one or more characteristics of the cyberthreat into instructions for performing steps to simulate an existence of the cyberthreat within a target network without implementing the objective of the cyberthreat in the target network, the target network comprising a plurality of computing devices;
determining one or more agents to execute the instructions on one or more computing devices from the plurality of computing devices;
initiating execution of the instructions by the one or more agents on the one or more computing devices to simulate the existence of the cyberthreat within the target network;
receiving feedback including receiving a level of success of the one or more agents in performing the steps; and
generating an analysis, based on the feedback, that includes a recommended configuration change to the security response capabilities of a computing device of the plurality of computing devices within the target network which improves the computing device's response to future instances of the cyberthreat.

10. The non-transitory computer-readable medium of claim 9 , wherein the feedback includes:
a number of the steps that were successfully completed; and
an indication of whether the computing device detected the cyberthreat or how the computing device responded to the cyberthreat.

11. The non-transitory computer-readable medium of claim 9 , wherein mapping one or more of the characteristics of the cyberthreat to instructions includes determining logic that, when executed by the one or more agents, would achieve the objective of the cyber-threat if the cyberthreat were to execute the objective successfully, wherein the logic is configured to dynamically generate a file, create network communication, or access a user account, system, account, directory, database, or registry.

12. The non-transitory computer-readable medium of claim 9 , wherein receiving information associated with the cyberthreat includes:
receiving an indication of the cyberthreat to data security from an external source; and
determining the one or more characteristics of the cyberthreat based on information from the external source.

13. The non-transitory computer-readable medium of claim 9 , wherein the operations further comprise automatically implementing the recommended configuration change responsive to the analysis.

14. The non-transitory computer-readable medium of claim 9 , wherein generating the analysis includes comparing the target network's level of vulnerability to the cyberattack to a threshold, the recommended configuration change being generated responsive to the comparing.

15. The non-transitory computer-readable medium of claim 9 , wherein the recommended configuration change is dynamically generated based on a configurable set of rules.

16. The non-transitory computer-readable medium of claim 9 , wherein the recommended configuration change includes at least one of: dynamically terminating network communication ports used by the simulated cyberthreat; enabling a firewall rule; failing the target network so that network traffic is routed to a failover network; or routing traffic to a demilitarized zone for further analysis in a sandbox network.

17. A system comprising:
one or more processors; and
one or more computer readable media storing instructions that, when executed, cause the one or more processors to perform operations including:
receiving information associated with a cyberthreat at a threat simulation server, wherein the cyberthreat is associated with an objective;
using the information, mapping, by the threat simulation server, one or more characteristics of the cyberthreat into instructions for performing steps to simulate an existence of the cyberthreat within a target network without implementing the objective of the cyberthreat in the target network, the target network comprising a plurality of computing devices;
determining one or more agents to execute the instructions on one or more computing devices from the plurality of computing devices;
initiating execution of the instructions by the one

Assignees

• Goldman Sachs & Co Llc

Inventors

• Vallone David
• Taylor Peter
• Venables Phil J
• Huang Ruoh-Yann

Classifications

• H04L43/50

  Testing arrangements · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L41/046

  comprising network management agents or mobile agents therefor · CPC title

• H04L41/145

  involving simulating, designing, planning or modelling of a network · CPC title

• H04L41/0886

  Fully automatic configuration · CPC title