Security assessment system

Patent metadata

Field	Value
Publication number	US-11909754-B2
Application number	US-201816980313-A
Country	US
Kind code	B2
Filing date	Mar 14, 2018
Priority date	Mar 14, 2018
Publication date	Feb 20, 2024
Grant date	Feb 20, 2024

Abstract

A security assessment system is configured to provide a duplicated environment which duplicates an assessment target system comprising a plurality of physical components. The security assessment system includes a duplicated environment design circuitry and a duplicated environment construction circuitry. The duplicated environment design circuitry is configured to select a duplication level based on constraints specified by a user in order to design the duplicated environment to produce a designed result indicative of a duplicated environment design. The duplication level is indicative of any one of a simulation sub-module, an emulation sub-module, and a physical sub-module which are for reproducing the physical components of the assessment target system. The duplicated environment construction circuitry is configured to construct the duplicated environment based on the designed result. The duplicated environment includes components which are duplicated by one of the duplication level.

First claim

The invention claimed is:

1. A security assessment system configured to provide a duplicated environment which duplicates an assessment target system comprising a plurality of physical components, the security assessment system comprising:
a duplicated environment design circuitry configured to decide a duplication level for each physical component based on constraints specified by a user in order to design the duplicated environment to produce a designed result indicative of a duplicated environment design, the duplication level indicating one of a simulation sub-module, an emulation sub-module, and a physical sub-module which are for reproducing the physical components of the assessment target system, the duplicated environment design circuitry deciding, in accordance with the constraints, which physical component should be assessed by the simulation sub-module, the emulation sub-module, or the physical sub-module, the constraints being requirements of budget, each physical component being associated with a monetary cost, the duplicated environment design circuitry deciding the physical components as the physical sub-module, the emulation sub-module, and the simulation sub-module in ascending order of the monetary cost from cheapest, within the budget; and
a duplicated environment construction circuitry configured to construct the duplicated environment based on the designed result, the duplicated environment comprises components which are duplicated by one of the duplication level.

2. The security assessment system as claimed in claim 1 ,
wherein the simulation sub-module comprises at least one of a specification of the physical component and a behavior model of a function of the physical component,
wherein the emulation sub-module comprises software which reproduces the physical component using a virtual machine, and
wherein the physical sub-module comprises at least one physical machine which is physically similar to the physical component in the assessment target system.

3. The security assessment system as claimed in claim 2 , wherein the security assessment system further comprises:
a document/model database storing documents indicative of specifications and a plurality of behavior models;
a virtual machine pool storing a plurality of virtual machines; and
a physical machine pool storing a plurality of physical machines,
wherein the duplicated environment construction circuitry is configured to:
store at least one document and/or at least one behavior model at the simulation sub-module from the document/model database;
configure and store at least one virtual machine at the emulation sub-module from the virtual machine pool; and
configure at least one network between the virtual machines and the physical machine in the physical machine pool.

4. The security assessment system as claimed in claim 2 , wherein the security assessment system further comprises:
an active scan/pen-test circuitry configured to actively scan and/or pen-test on the virtual machine and/or the physical machine in the duplicated environment to produce a result of an active scan/pen-test,
a vulnerability assessment circuitry configured to extract vulnerabilities of each component in the emulation sub-module and the physical sub-module based on the result of an active scan/pen-test to generate a list indicative of the extracted vulnerabilities; and
an attack graph generation circuitry configured to generate an attack graph based on the result of an active scan/pen-test,
wherein the duplicated environment design circuitry configured to select the duplication level based on at least one of the list and the attack graph.

5. The security assessment system as claimed in claim 2 , wherein the security assessment system further comprises:
an input interface configure to input the constraints, the specification, the behavior model, any signal on channels between the virtual machines, between the virtual machine and the physical machine, and between the physical machines; and
an output interface configured to output a response of the behavior model in response to the input, contents of the specification, and communication information between the virtual machines, between the virtual machine and the physical machine, and between the physical machines.

6. A method, performed by an information processing unit, of providing a duplicated environment which duplicates an assessment target system comprising a plurality of physical components, the method comprising:
deciding a duplication level for each physical component based on constraints specified by a user in order to design the duplicated environment to produce a designed result indicative of a duplicated environment design, the duplication level indicating one of a simulation sub-module, an emulation sub-module, and a physical sub-module which are for reproducing the physical components of the assessment target system, deciding, in accordance with the constraints, which physical component should be assessed by the simulation sub-module, the emulation sub-module, or the physical sub-module, the constraints being requirements of budget, each physical component being associated with a monetary cost, whereby deciding the physical components as the physical sub-module, the emulation sub-module, and the simulation sub-module in ascending order of the monetary cost from cheapest, within the budget; and
constructing the duplicated environment based on the designed result, the duplicated environment comprises components which are duplicated by one of the duplication level.

7. The method as claimed in claim 6 ,
wherein the simulation sub-module comprises at least one of a specification of the physical component and a behavior model of a function of the physical component,
wherein the emulation sub-module comprises software which reproduces the physical component using a virtual machine, and
wherein the physical sub-module comprises at least one physical machine which is physically similar to the physical component in the assessment target system.

8. The method as claimed in claim 7 , wherein the method further comprises:
actively scanning and/or pen-testing on the virtual machine and/or the physical machine in the duplicated environment to produce a result of an active scan/pen-test,
extracting vulnerabilities of each component in the emulation sub-module and the physical sub-module based on the result of an active scan/pen-test to generate a list indicative of the extracted vulnerabilities; and
generating an attack graph based on the result of an active scan/pen-test,
wherein the selecting selects the duplication level based on the list and the attack graph.

9. A non-transitory computer readable recording medium in which a security assessment program is recorded, the security assessment program causing a computer to execute so as to provide a duplicated environment which duplicates an assessment target system comprising a plurality of physical components, the security assessment program causing the computer to execute the steps of:
deciding a duplication level for each physical component based on constraints specified by a user in order to design the duplicated environment to produce a designed result indicative of a duplicated environment design, the duplication level indicating one of a simulation sub-module, an emulation sub-module, and a physical sub-module which are for reproducing the physical components of the assessment target system, deciding, in accordance with the constraints, which physical component should be assessed by the simulation sub-module, the emulation sub-module, or the physical sub-module, the constraints being requirements of budget, each physical component being associated wit

Assignees

• Nec Corp
• B G Negev Technologies And Applications Ltd At Ben Gurion Univ

Inventors

• Inokuchi Masaki
• Ohta Yoshinobu
• Bitton Ron
• Stan Orly
• Shabtai Asaf
• Elovici Yuval

Classifications

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• G06F21/57 Primary

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title