Systems for network risk assessment including processing of user access rights associated with a network of devices

Patent metadata

Field	Value
Publication number	US-11438366-B2
Application number	US-202016932341-A
Country	US
Kind code	B2
Filing date	Jul 17, 2020
Priority date	Dec 29, 2014
Publication date	Sep 6, 2022
Grant date	Sep 6, 2022

Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for network risk assessment. One of the methods includes obtaining information describing network traffic between a plurality of network devices within a network. A network topology of the network is determined based on the information describing network traffic, with the network topology including nodes connected by an edge to one or more other nodes, and with each node being associated with one or more network devices. Indications of user access rights of users are associated to respective nodes included in the network topology. User interface data associated with the network topology is generated.

First claim

What is claimed is:

1. A computerized method comprising:
by a system of one or more computer systems,
accessing network device information associated with network devices of one or more networks;
accessing user account information associated with user accounts of the one or more networks;
determining, based on the accessed information and for each network device and/or user account:
a compromise value indicating an importance an attacker would place on compromising the network device and/or user account, and
a compromise vulnerability indicating a likelihood of compromise of the user account and/or network device; and
causing presentation of an interactive user interface, the interactive user interface including a network risk map indicating risks associated with the user accounts and/or network devices, wherein risk associated with a user account or a network device is based on respective compromise value and compromise vulnerability of the user account or the network device,
wherein the interactive user interface responds to search information which filters user accounts and/or network devices.

2. The computerized method of claim 1 , wherein the network risk map comprises a plurality of visual elements each representing one or more user accounts or one or more network devices, and wherein each visual element is positioned in the network risk map according to compromise values and compromise likelihoods of user accounts or network devices represented by the visual element.

3. The computerized method of claim 1 , wherein each visual element is adjusted based on associated risk.

4. The computerized method of claim 3 , wherein adjusting a visual representation according risk comprises:
selecting a color of a plurality of colors based on the risk; and
causing presentation, via the interactive user interface, of the visual element presented according to the selected color.

5. The computerized method of claim 1 , wherein each visual element represents user accounts or network devices that are grouped according to the user accounts' or network devices' positions in the network risk map.

6. The computerized method of claim 1 , wherein the compromise value is based on a plurality of value metrics, and wherein the compromise vulnerability is based on a plurality of vulnerability metrics.

7. The computerized method of claim 6 , wherein the network risk map is configured to update via adjustment of an effect associated with at least one of the value metrics or vulnerability metrics, such that at least one of the visual elements is adjusted in position.

8. A computerized method comprising:
by a system of one or more computer systems accessing network device information associated with network devices of one or more networks, and/or accessing user account information associated with user accounts of the networks; and
causing presentation of an interactive user interface, wherein the interactive user interface:
presents a network risk map indicating risks associated with user accounts and/or network devices of the networks, the network risk map comprising:
a plurality of visual elements, each visual element representing one or more user accounts or one or more network devices, and each visual element being positioned in the network risk map according to a compromise value determined for the visual element and a compromise vulnerability determined for the visual element,
wherein the compromise value indicates an importance an attacker would place on compromising the one or more user accounts or one or more network devices represented by the particular visual element, and
wherein the compromise vulnerability indicates a likelihood of compromise of the one or more user accounts or one or more network devices represented by the particular visual element; and

responds to search information received via presented search user interface elements, wherein in response to received search information, the interactive user interface:
filters user accounts and/or network devices according to information specified in the search information and updates the network risk map based on the filtering, or
modifies the network risk map according to modifications associated with determining compromise values and/or compromise vulnerabilities.

9. The computerized method of claim 8 , wherein the network device information indicates one or more of configuration information of network devices or a network topology indicating communication paths between network devices determined using, at least, monitored network traffic between the network devices, and wherein user account information indicates one or more of user access rights of respective user accounts, profile information of respective user accounts, user account rules enforced on the networks, or network actions associated with the user accounts.

10. The computerized method of claim 8 , wherein a compromise value and/or compromise vulnerability determined for each visual element is based on compromise values and/or compromise vulnerabilities determined for network devices or user accounts represented by the visual element.

11. The computerized method of claim 8 , wherein the compromise value determined for each visual element is based on one or more value metrics, and wherein the compromise value for each visual element is based on one or more vulnerability metrics.

12. The computerized method of claim 11 , wherein modifying the network risk map comprises one or more of:
removing effects of particular value metrics and/or vulnerability metrics from compromise values and/or compromise vulnerabilities determined for the visual elements, or
including effects of particular value metrics and/or vulnerability metrics in compromise values and/or compromise vulnerabilities determined for the visual elements, or
modifying weights associated with vulnerability metrics and/or value metrics utilized in determining compromise values and/or compromise vulnerabilities determined for the visual elements.

13. The computerized method of claim 11 , wherein responding to input associated with a particular visual element comprises:
causing determination of one or more value metrics and/or one or more vulnerability metrics that are affecting the compromise value and/or compromise vulnerability determined for the particular visual element; and
presenting summary information associated with the particular visual element, the summary information specifying value metrics and/or vulnerability metrics associated with greater than a threshold effect.

14. The computerized method of claim 8 , wherein each visual element represents user accounts or network devices that are grouped according to the user accounts' or network devices' positions in the network risk map.

15. The computerized method of claim 8 , wherein the interactive user interface further:
presents a time slider enabling selection of a time period associated with determining compromise values and compromise vulnerabilities, wherein the interactive user interface updates the network risk map based on a selected time period, thereby presenting increases or decreases in compromise value and compromise vulnerability according to time period.

16. Non-transitory computer storage media storing instructions that when executed by a system of one or more computers, cause the computers to perform operations comprising:
causing presentation of an interactive user interface, the interactive user interface causing access to network device information associated with network devices of one or more networks, and/or causing access to user a

Assignees

• Palantir Technologies Inc

Inventors

• Seiver Miles
• Cohen Stephen

Classifications

• H04L41/12

  Discovery or management of network topologies · CPC title

• H04L45/02

  Topology update or discovery · CPC title

• H04L43/12

  Network monitoring probes · CPC title

• H04L2012/5623

  Network design, dimensioning, topology or optimisation · CPC title

• H04L41/0853

  by actively collecting configuration information or by backing up configuration information · CPC title