Risk scoring in a connected graph

Patent metadata

Field	Value
Publication number	US-10728272-B1
Application number	US-201414573980-A
Country	US
Kind code	B1
Filing date	Dec 17, 2014
Priority date	Dec 17, 2014
Publication date	Jul 28, 2020
Grant date	Jul 28, 2020

Abstract

A method and apparatus for risk scoring in a graph are disclosed. In the method and apparatus, a graph includes a first node that is connected with a node of a plurality of nodes using a communication link of a plurality of communication links. A plurality of link risk measures are then determined, whereby a link risk measure of the plurality of link risk measures pertains to the communication link of the plurality of communication links. Furthermore, a risk measure associated with the first node is determined based at least in part on the plurality of link risk measures. The risk measure is monitored to determine if one or more conditions placed on the risk measure are met and one or more actions are taken as a result of the one or more conditions being met.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
for a network comprising a plurality of communication links between a first node and a plurality of nodes, obtaining a plurality of link risk measures corresponding to the plurality of communication links by, for each communication link of the plurality of communication links:
determining a first risk measure of the communication link, the first risk measure being associated with a type of access to the first node permissible using the communication link, the type of access associated with a set of permissions that a corresponding node of the plurality of nodes has to the first node over the communication link;
determining a second risk measure of the communication link, the second risk measure being associated with a set of attributes, the set of attributes:
being associated with data that is transmitted between the first node and the corresponding node via the communication link; and
indicating a type of the data and a sensitivity of the data;

determining a first inherent node risk measure associated with the first node and a second inherent node risk measure associated with the corresponding node; and
obtaining a link risk measure of the communication link based at least in part on:
the first risk measure;
the second risk measure;
the first inherent node risk measure; and
the second inherent node risk measure;

computing an overall risk measure associated with the first node based at least in part on the plurality of link risk measures, the overall risk measure indicating an amount of risk of a security breach of the first node or data exfiltration from the first node; and
taking one or more actions as a result of the overall risk measure exceeding a threshold.

2. The computer-implemented method of claim 1 , wherein the one or more actions include at least one of:
ceasing establishment of further communication links with the first node,
validating data exchanged with the first node, or
sending an alert to an administrator of the network indicating that the overall risk measure associated with the first node exceeded the threshold.

3. The computer-implemented method of claim 1 , wherein the set of permissions correspond to one or more access privileges that the corresponding node has to the first node.

4. A system, comprising one or more processors and memory including executable instructions that, if executed by the one or more processors, cause the system to implement one or more services, wherein the one or more services at least:
determine, for a first node that is connected with a second node of a plurality of nodes using a communication link of a plurality of communication links, a plurality of link risk measures, the plurality of link risk measures including:
a first link risk measure of the communication link, the first link risk measure associated with an access type associated with a set of permissions that the second node has to the first node over the communication link; and
a second link risk measure of the communication link, the second link risk measure associated with a set of attributes, the set of attributes:
being associated with data transmitted between the first node and the second node via the communication link; and
indicating a type of the data and a sensitivity of the data;

determine an overall risk measure associated with the first node based at least in part on the plurality of link risk measures, the overall risk measure representing an amount of risk of a security breach of the first node or data exfiltration from the first node; and
cause the overall risk measure associated with the first node to be sent to be evaluated.

5. The system of claim 4 , wherein the one or more services that cause the overall risk measure associated to be sent to be evaluated further cause the overall risk measure to be provided to an administrator of the first node to determine whether to perform one or more actions based at least in part on evaluating the overall risk measure.

6. The system of claim 4 , wherein the plurality of link risk measures further include at least one of:
a first inherent risk measure associated with the first node, or
a second inherent risk measure associated with the second node.

7. The system of claim 6 , wherein the amount of risk indicates a likelihood of a security compromise of the first node.

8. The system of claim 4 , wherein the one or more services further store the overall risk measure associated with the first node.

9. The system of claim 8 , wherein:
the one or more services that store the overall risk measure associated with the first node further store a plurality of versions of risk measures; and
a version of the plurality of versions is updated by another version of the plurality of versions as a result of a change to the overall risk measure.

10. The system of claim 4 , wherein the first node comprises a first cluster of connected computing nodes and the overall risk measure associated with the first node represents a measure of risk of the first cluster of connected computing nodes.

11. A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of execution by one or more processors of a computer system, cause the computer system to at least:
identify a plurality of communication links in a network, a communication link of the plurality of communication links being used to transfer data between a first node a second node of a plurality of nodes;
identify a plurality of link risk measures associated with the plurality of communication links, the communication link being associated with a first link risk measure and a second link risk measure of the plurality of link risk measures, wherein:
the first link risk measure of the communication link indicates a risk of compromise to the first node, the risk of compromise being based at least in part on a set of permissions that the second node of the plurality of nodes has to the first node; and
the second link risk measure of the communication link is associated with a set of attributes, the set of attributes:
being associated with data that is transmitted between the first node and the second node; and
indicating a type of the data and a sensitivity of the data;

determine, based at least in part on the plurality of link risk measures, an overall risk measure associated with the first node; and
perform one or more actions as a result of determining the overall risk measure associated with the first node.

12. The non-transitory computer-readable storage medium of claim 11 , wherein the executable instructions that cause the computer system to take the one or more actions further include instructions that further cause the computer system to audit log entries associated with the first node on a condition that the overall risk measure is within a range of risk measures.

13. The non-transitory computer-readable storage medium of claim 11 , wherein the second link risk measure is based at least in part on at least one of:
a number of applications executed on the first node,
a number of applications executed on the second node,
a type of application executed on the first node, or
a type of application executed on the second node.

14. The non-transitory computer-readable storage medium of claim 11 , wherein the executable instructions that cause the computer system to take the one or more actions further include instructions that further cause the computer system to cease establishment of further communication links with the first node.

15. The non-tra

Assignees

• Amazon Tech Inc

Inventors

• Ranjha Danial Muhammad
• Mcclintock Jon Arron
• Sethi Tushaar
• Van Horenbeeck Maarten

Classifications

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F16/9024

  Graphs; Linked lists (G06F16/9027 takes precedence) · CPC title