Executing enterprise process abstraction using process aware analytical attack graphs

Patent metadata

Field	Value
Publication number	US-11533332-B2
Application number	US-202117358486-A
Country	US
Kind code	B2
Filing date	Jun 25, 2021
Priority date	Jun 25, 2020
Publication date	Dec 20, 2022
Grant date	Dec 20, 2022

Abstract

Methods, systems, and computer-readable storage media for receiving a process aware AAG from computer-readable memory, the process aware AAG having been generated from the AAG, processing the process aware AAG to consolidate asset nodes to group nodes at least partially by providing metadata describing an asset node to a set of properties of a group node and pruning the asset node and any child nodes of the asset node from the process aware AAG, providing the aggregation graph by identifying relationships between group nodes and, for each relationship, inserting an edge between group nodes, and aggregating one or more of a set of node properties and a set of edge properties for each group node or edge, respectively, storing the aggregation graph to computer-readable memory, and executing one or more remedial actions in the enterprise network in response to analytics executed on the aggregation graph.

First claim

What is claimed is:

1. A computer-implemented method for enterprise network security using an aggregation graph based on an analytical attack graph (AAG) representative of potential lateral movement within an enterprise network, the method being executed by one or more processors and comprising:
receiving a process aware AAG from computer-readable memory, the process aware AAG having been generated from the AAG;
processing the process aware AAG to consolidate asset nodes to group nodes at least partially by providing metadata describing an asset node to a set of properties of a group node and pruning the asset node and any child nodes of the asset node from the process aware AAG;
providing the aggregation graph by:
identifying relationships between group nodes, wherein a relationship between group nodes comprises one of a has joint assets relationship and a has lateral movement relationship, wherein the has lateral movement relationship indicates that execution of a first process represented by a first group enables lateral movement within the enterprise network to at least one asset correlated with a second group that represents a second process,
for each relationship, inserting an edge between group nodes, and
aggregating one or more of a set of node properties and a set of edge properties for each group node or edge, respectively;

storing the aggregation graph to computer-readable memory; and
executing one or more remedial actions in the enterprise network in response to analytics executed on the aggregation graph.

2. The computer-implemented method of claim 1 , wherein the has joint assets relationship indicates that two groups are each correlated with an asset.

3. The computer-implemented method of claim 1 , wherein aggregating comprises one or more of sum, maximum, minimum, and average.

4. The computer-implemented method of claim 1 , wherein processing the process aware AAG to consolidate asset nodes to group nodes comprises, for each group node generating a list of assets comprising assets correlated to a respective group node within the process aware AAG.

5. The computer-implemented method of claim 1 , wherein at least one remedial action comprises executing network segmentation to dissociate an asset from at least one process executed within the enterprise network.

6. A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for enterprise network security using an aggregation graph based on an analytical attack graph (AAG) representative of potential lateral movement within an enterprise network, the operations comprising:
receiving a process aware AAG from computer-readable memory, the process aware AAG having been generated from the AAG;
processing the process aware AAG to consolidate asset nodes to group nodes at least partially by providing metadata describing an asset node to a set of properties of a group node and pruning the asset node and any child nodes of the asset node from the process aware AAG;
providing the aggregation graph by:
identifying relationships between group nodes, wherein a relationship between group nodes comprises one of a has joint assets relationship and a has lateral movement relationship, wherein the has lateral movement relationship indicates that execution of a first process represented by a first group enables lateral movement within the enterprise network to at least one asset correlated with a second group that represents a second process,
for each relationship, inserting an edge between group nodes, and
aggregating one or more of a set of node properties and a set of edge properties for each group node or edge, respectively;

storing the aggregation graph to computer-readable memory; and
executing one or more remedial actions in the enterprise network in response to analytics executed on the aggregation graph.

7. The non-transitory computer-readable storage medium of claim 6 , wherein the has joint assets relationship indicates that two groups are each correlated with an asset.

8. The non-transitory computer-readable storage medium of claim 6 , wherein aggregating comprises one or more of sum, maximum, minimum, and average.

9. The non-transitory computer-readable storage medium of claim 6 , wherein processing the process aware AAG to consolidate asset nodes to group nodes comprises, for each group node generating a list of assets comprising assets correlated to a respective group node within the process aware AAG.

10. The non-transitory computer-readable storage medium of claim 6 , wherein at least one remedial action comprises executing network segmentation to dissociate an asset from at least one process executed within the enterprise network.

11. A system, comprising:
a computing device; and
a computer-readable storage device coupled to the computing device and having instructions stored thereon which, when executed by the computing device, cause the computing device to perform operations for enterprise network security using an aggregation graph based on an analytical attack graph (AAG) representative of potential lateral movement within an enterprise network, the operations comprising:
receiving a process aware AAG from computer-readable memory, the process aware AAG having been generated from the AAG;
processing the process aware AAG to consolidate asset nodes to group nodes at least partially by providing metadata describing an asset node to a set of properties of a group node and pruning the asset node and any child nodes of the asset node from the process aware AAG;
providing the aggregation graph by:
identifying relationships between group nodes, wherein a relationship between group nodes comprises one of a has joint assets relationship and a has lateral movement relationship, wherein the has lateral movement relationship indicates that execution of a first process represented by a first group enables lateral movement within the enterprise network to at least one asset correlated with a second group that represents a second process,
for each relationship, inserting an edge between group nodes, and
aggregating one or more of a set of node properties and a set of edge properties for each group node or edge, respectively;

storing the aggregation graph to computer-readable memory; and
executing one or more remedial actions in the enterprise network in response to analytics executed on the aggregation graph.

12. The system of claim 11 , wherein the has joint assets relationship indicates that two groups are each correlated with an asset.

13. The system of claim 11 , wherein aggregating comprises one or more of sum, maximum, minimum, and average.

14. The system of claim 11 , wherein processing the process aware AAG to consolidate asset nodes to group nodes comprises, for each group node generating a list of assets comprising assets correlated to a respective group node within the process aware AAG.

Assignees

• Accenture Global Solutions Ltd

Inventors

• Engelberg Gal
• Klein Dan
• Ram Tomer
• Rochwerger Benny

Classifications

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L41/22

  comprising specially adapted graphical user interfaces [GUI] · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title