Systems for network risk assessment including processing of user access rights associated with a network of devices

Patent metadata

Field	Value
Publication number	US-11757922-B2
Application number	US-202217929272-A
Country	US
Kind code	B2
Filing date	Sep 1, 2022
Priority date	Dec 29, 2014
Publication date	Sep 12, 2023
Grant date	Sep 12, 2023

Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for network risk assessment. One of the methods includes obtaining information describing network traffic between a plurality of network devices within a network. A network topology of the network is determined based on the information describing network traffic, with the network topology including nodes connected by an edge to one or more other nodes, and with each node being associated with one or more network devices. Indications of user access rights of users are associated to respective nodes included in the network topology. User interface data associated with the network topology is generated.

First claim

What is claimed is:

1. A computerized method comprising:
by a system of one or more computer systems, accessing a network risk map being applied to a first network, the network risk map defining a plurality of risk values, wherein an individual risk value is a combination of an individual compromise value and an individual compromise vulnerability which are associated with an individual user account or an individual network device, wherein a compromise value indicates an importance an attacker would place on compromising a network device and/or user account, and wherein a compromise vulnerability indicates a likelihood of compromise of the user account and/or network device; and
determining a second network of a plurality of networks which is to receive the network risk map, the determination being based on at least a subset of the risk values, the subset being determined using common metrics for the first network and the second network; and
providing information associated with the network risk map to the second network, wherein the information includes information usable to determine compromise values and compromise vulnerabilities.

2. The computerized method of claim 1 , wherein the information further includes search information usable to filter user accounts and/or network devices.

3. The computerized method of claim 2 , further comprising determining whether user accounts and/or network devices filtered based on the search information are greater than a threshold in number or percentage.

4. The computerized method of claim 2 , further comprising determining whether user accounts and/or network devices filtered based on the search information are greater than a first threshold in number or percentage and are associated with compromise values greater than a second threshold.

5. The computerized method of claim 1 , wherein the provided information further includes weights associated with computing the compromise values.

6. The computerized method of claim 5 , wherein a compromise value is determined based on a plurality of compromise value metrics, and wherein individual weights are associated with individual compromise values.

7. The computerized method of claim 1 , wherein the provided information further includes weights associated with computing the compromise vulnerabilities.

8. The computerized method of claim 1 , wherein a compromise vulnerability is determined based on a plurality of compromise vulnerability metrics, and wherein individual weights are associated with individual compromise vulnerabilities.

9. A system comprising one or more processors and non-transitory computer storage media storing instructions that when executed by the one or more processors, cause the one or more processors to:
access a network risk map being applied to a first network, the network risk map defining a plurality of risk values, wherein an individual risk value is a combination of an individual compromise value and an individual compromise vulnerability which are associated with an individual user account or an individual network device, wherein a compromise value indicates an importance an attacker would place on compromising a network device and/or user account, and wherein a compromise vulnerability indicates a likelihood of compromise of the user account and/or network device; and
determine a second network of a plurality of networks which is to receive the network risk map, the determination being based on at least a subset of the risk values, the subset being determined using common metrics for the first network and the second network; and
provide information associated with the network risk map to the second network, wherein the information includes information usable to determine compromise values and compromise vulnerabilities.

10. The system of claim 9 , wherein the information further includes search information usable to filter user accounts and/or network devices.

11. The system of claim 10 , wherein the instructions further cause the processors to determine whether user accounts and/or network devices filtered based on the search information are greater than a threshold in number or percentage.

12. The system of claim 11 , wherein the instructions further cause the processors to determine whether user accounts and/or network devices filtered based on the search information are greater than a first threshold in number or percentage and are associated with compromise values greater than a second threshold.

13. The system of claim 9 , wherein the provided information further includes weights associated with computing the compromise values.

14. The system of claim 13 , wherein a compromise value is determined based on a plurality of compromise value metrics, and wherein individual weights are associated with individual compromise values.

15. The system of claim 9 , wherein the provided information further includes weights associated with computing the compromise vulnerabilities.

16. The system of claim 9 , wherein a compromise vulnerability is determined based on a plurality of compromise vulnerability metrics, and wherein individual weights are associated with individual compromise vulnerabilities.

17. Non-transitory computer storage media storing instructions that when executed by a system of one or more processors, cause the one or more processors to:
access a network risk map being applied to a first network, the network risk map defining a plurality of risk values, wherein an individual risk value is a combination of an individual compromise value and an individual compromise vulnerability which are associated with an individual user account or an individual network device, wherein a compromise value indicates an importance an attacker would place on compromising a network device and/or user account, and wherein a compromise vulnerability indicates a likelihood of compromise of the user account and/or network device; and
determine a second network of a plurality of networks which is to receive the network risk map, the determination being based on at least a subset of the risk values, the subset being determined using common metrics for the first network and the second network; and
provide information associated with the network risk map to the second network, wherein the information includes information usable to determine compromise values and compromise vulnerabilities.

18. The computer storage media of claim 17 , wherein the instructions further cause the processors to determine whether user accounts and/or network devices filtered based on the search information are greater than a first threshold in number or percentage and are associated with compromise values greater than a second threshold.

19. The computer storage media of claim 17 , wherein the provided information further includes weights associated with computing the compromise values, and wherein a compromise value is determined based on a plurality of compromise value metrics, and wherein individual weights are associated with individual compromise values.

20. The computer storage media of claim 17 , wherein the provided information further includes weights associated with computing the compromise vulnerabilities, and wherein a compromise vulnerabilities is determined based on a plurality of compromise vulnerability metrics, and wherein individual weights are associated with individual compromise vulnerabilities.

Assignees

• Palantir Technologies Inc

Inventors

• Seiver Miles
• Cohen Stephen

Classifications

• H04L45/02

  Topology update or discovery · CPC title

• H04L41/12

  Discovery or management of network topologies · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L41/0853

  by actively collecting configuration information or by backing up configuration information · CPC title