Systems for network risk assessment including processing of user access rights associated with a network of devices

Patent metadata

Field	Value
Publication number	US-10721263-B2
Application number	US-201815981702-A
Country	US
Kind code	B2
Filing date	May 16, 2018
Priority date	Dec 29, 2014
Publication date	Jul 21, 2020
Grant date	Jul 21, 2020

Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for network risk assessment. One of the methods includes obtaining information describing network traffic between a plurality of network devices within a network. A network topology of the network is determined based on the information describing network traffic, with the network topology including nodes connected by an edge to one or more other nodes, and with each node being associated with one or more network devices. Indications of user access rights of users are associated to respective nodes included in the network topology. User interface data associated with the network topology is generated.

First claim

What is claimed is:

1. A computerized method comprising:
determining, by a system of one or more computers, respective compromise risks of network devices associated with a network;
causing presentation, via an interactive user interface, of visual representations of the network devices, each visual representation being visually adjusted according to one or more of the determined compromise risks,
wherein each visual representation is visually adjusted based on user specified thresholds associated with compromise risks; and
receiving, by the system, user selection of a visual representation, and updating the user interface to present detailed information describing the one or more compromise risks associated with the selected visual representation.

2. The computerized method of claim 1 , wherein each visual representation is associated with one or more network devices, and wherein the visual representation is visually adjusted based on the compromise risks of the network devices.

3. The computerized method of claim 2 , wherein a particular visual representation is visually adjusted based on a highest compromise risk of the one or more network devices associated with the particular visual representation.

4. The computerized method of claim 1 , wherein adjusting a visual representation according to one or more compromise risks comprises:
selecting a color of a plurality of colors based on the compromise risks; and
causing presentation, via the interactive user interface, of the visual representation presented according to the selected color.

5. The computerized method of claim 1 , wherein adjusting a visual representation according to one or more compromise risks comprises:
selecting a pattern of a plurality of patterns based on the compromise risks; and
causing presentation, via the interactive user interface, of the visual representation presented according to the selected pattern.

6. The computerized method of claim 1 , wherein each visual representation is visually adjusted based on user specified thresholds of values of compromise risks.

7. The computerized method of claim 1 , wherein determining the compromise risk for a particular network device is based on aggregated Common Vulnerability Scoring System (CVSS) values associated with the particular network device.

8. The computerized method of claim 1 , wherein each visual representation is associated with one or more network devices belonging to a same subnet.

9. A system comprising one or more computer systems and one or more computer storage media storing instructions that when executed by the computer systems cause the computer systems to perform operations comprising:
determining, by the system configured to be in communication with a network, respective compromise risks of network devices associated with the network;
causing presentation, via an interactive user interface, of visual representations of the network devices, each visual representation being visually adjusted according to one or more of the determined compromise risks,
wherein each visual representation is visually adjusted based on user specified thresholds associated with compromise risks; and
receiving, by the system, user selection of a visual representation, and updating the user interface to present detailed information describing the one or more compromise risks associated with the selected visual representation.

10. The system of claim 9 , wherein each visual representation is associated with one or more network devices, and wherein the visual representation is visually adjusted based on a highest compromise risk of the one or more network devices associated with the visual representation.

11. The system of claim 9 , wherein adjusting a visual representation according to one or more compromise risks comprises:
selecting a color of a plurality of colors based on the compromise risks; and
causing presentation, via the interactive user interface, of the visual representation presented according to the selected color.

12. The system of claim 9 , wherein adjusting a visual representation according to one or more compromise risks comprises:
selecting a pattern of a plurality of patterns based on the compromise risks; and
causing presentation, via the interactive user interface, of the visual representation presented according to the selected pattern.

13. The system of claim 9 , wherein each visual representation is visually adjusted based on user specified thresholds of values of compromise risks.

14. The system of claim 9 , wherein determining the compromise risk for a particular network device is based on aggregated Common Vulnerability Scoring System (CVSS) values associated with the particular network device.

15. The system of claim 9 , wherein each visual representation is associated with one or more network devices belonging to a same subnet.

16. Non-transitory computer storage media storing instruction that when executed by a system of one or more computers, cause the one or more computers to perform operations comprising:
determining, by the system configured to be in communication with a network, respective compromise risks of network devices associated with the network;
causing presentation, via an interactive user interface, of visual representations of the network devices, each visual representation being visually adjusted according to one or more of the determined compromise risks,
wherein each visual representation is visually adjusted based on user specified thresholds associated with compromise risks; and
receiving, by the system, user selection of a visual representation, and updating the user interface to present detailed information describing the one or more compromise risks associated with the selected visual representation.

17. The computer storage media of claim 16 , wherein adjusting a visual representation according to one or more compromise risks comprises:
selecting a color of a plurality of colors based on the compromise risks or selecting a pattern of a plurality of patterns based on the compromise risks; and
causing presentation, via the interactive user interface, of the visual representation presented according to the selected color or according to the selected pattern.

18. The computer storage media of claim 16 , wherein each visual representation is visually adjusted based on user specified thresholds of values of compromise risks.

19. The computer storage media of claim 16 , wherein determining the compromise risk for a particular network device is based on aggregated Common Vulnerability Scoring System (CVSS) values associated with the particular network device.

20. The computer storage media of claim 16 , wherein each visual representation is associated with one or more network devices belonging to a same subnet.

Assignees

• Palantir Technologies Inc

Inventors

• Seiver Miles
• Cohen Stephen

Classifications

• H04L41/12

  Discovery or management of network topologies · CPC title

• H04L45/02

  Topology update or discovery · CPC title

• H04L63/0236

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title