Application of advanced cybersecurity threat mitigation to rogue devices, privilege escalation, and risk-based vulnerability and patch management

Patent metadata

Field	Value
Publication number	US-10609079-B2
Application number	US-201715725274-A
Country	US
Kind code	B2
Filing date	Oct 4, 2017
Priority date	Oct 28, 2015
Publication date	Mar 31, 2020
Grant date	Mar 31, 2020

Abstract

A system for mitigation of cyberattacks employing an advanced cyber decision platform which uses a time series data store, a directed computational graph module, an action outcome simulation module, and observation and state estimation module, wherein the state of a network is monitored and used to produce a cyber-physical graph representing network resources, simulated network events are produced and monitored, and the network events and their effects are analyzed to produce security recommendations.

First claim

What is claimed is:

1. An advanced cyber decision platform for mitigation of cyberattacks, the advanced cyber decision platform comprising:
a computing device comprising a memory and a processor;
a time series data module comprising a first plurality of programming instructions stored in a memory of, and operating on a processor of, a computing device, wherein the first plurality of programming instructions, when operating on the processor, cause the computing device to:
monitor a plurality of connected resources on a network to obtain a plurality of network events;
produce and store time-series data comprising at least a record of a network event and a time at which the network event occurred;

an observation and state estimation module comprising a second plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the second plurality of programming instructions, when operating on the processor, cause the computing device to:
produce a cyber-physical graph representing at least a portion of the plurality of connected resources on the network, the cyber-physical graph comprising the logical relationships between the portion of the plurality of connected resources on the network and the physical relationships between any of the connected resources that comprise a hardware device;

a directed computational graph module comprising a third plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the third plurality of programming instructions, when operating on the processor, cause the computing device to:
receive simulated time series data from an action-outcome simulation module;
produce a directed computational graph by performing a plurality of transformation operations on the simulated time-series data and the cyber-physical graph, wherein;
each transformation operation sends a message output to subsequent transformation operations;
the directed computational graph comprises nodes and edges, the nodes representing the transformation operations and the edges representing message outputs between the nodes; and
one or more of the transformation operations are linearization of non-linear operations that are created when they are ready to be computed; and

obtain a result of the transformation operations from the production of the directed computational graph; and
transmit the result to an action-outcome simulation module; and

an action-outcome simulation module comprising a fourth plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the fourth plurality of programming instructions, when operating on the processor, cause the computing device to:
retrieve at least a portion of the time series data;
produce a simulated cyberattack on the cyber-physical graph, the simulated cyber-attack comprising simulated time-series data based on the cyber-physical graph and the at least a portion of the time series data;

send the simulated time-series data to the directed computational graph module;
receive the result from the directed computational graph module; and
produce a plurality of security recommendations based at least in part on the result of the transformation operations from the directed computational graph module.

2. The advanced cyber decision platform of claim 1 , wherein the plurality of analysis and transformation operations performed on at least a portion of the cyber-physical graph comprise a calculation of an impact assessment score for each of a portion of the connected resources in the cyber-physical graph.

3. The advanced cyber decision platform of claim 2 , wherein the plurality of analysis and transformation operations performed on at least a portion of the time-series data comprise a calculation of the overall impact of a cyberattack, wherein the calculation is based at least in part on the impact assessment score for each resource affected by the cyberattack.

4. The advanced cyber decision platform of claim 1 , wherein the plurality of analysis and transformation operations performed on at least a portion of the cyber-physical graph comprise a comparison of relationships between resources against known security vulnerabilities.

5. The advanced cyber decision platform of claim 4 , wherein the security recommendations produced by the action-outcome simulation module are based at least in part on the results of the comparison of relationship between resources against known security vulnerabilities.

6. The advanced cyber decision platform of claim 1 , wherein the observation and state estimation module is further configured to produce a visualization based at least in part on at least a portion of the time-series data, wherein the visualization illustrates changes to the data over time.

7. A method for mitigation of cyberattacks employing an advanced cyber decision platform comprising the steps of:
monitoring a plurality of connected resources on a network to obtain a plurality of network events;
producing and storing time-series data comprising at least a record of a network event and a time at which the network event occurred;
producing, using an observation and state estimation module, a cyber-physical graph representing at least a portion of the plurality of connected resources, the cyber-physical graph comprising at least the logical relationships between the portion of the plurality of connected resources on a network and the physical relationships between any of the connected resources that comprise at least a hardware device;
producing a simulated cyber-attack on the cyber-physical graph, the simulated cyber-attack comprising simulated time-series data based on the cyber-physical graph and the at least a portion of the time series data;
producing a directed computational graph by performing a plurality of transformation operations on the simulated time-series data and the cyber-physical graph, wherein;
each transformation operation sends a message output to subsequent transformation operations;
the directed computational graph comprises nodes and edges, the nodes representing the transformation operations and the edges representing message outputs between the nodes; and
one or more of the transformation operations are linearization of non-linear operations that are created when they are ready to be computed;

obtaining a result of the transformation operations from the production of the directed computational graph; and
producing a plurality of security recommendations for mitigation of cyberattacks on the connected resources of the network based at least in part on the result of the transformation operations from the directed computational graph module.

Assignees

• Fractal Ind Inc
• Qomplx Inc

Inventors

• Crabtree Jason
• Sellers Andrew
• Fricano Daniel
• Gupta Rajat
• Macleod Ian

Classifications

• G06N5/045

  Explanation of inference; Explainable artificial intelligence [XAI]; Interpretable artificial intelligence · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/1466

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• G06N5/022

  Knowledge engineering; Knowledge acquisition · CPC title