Systems for network risk assessment including processing of user access rights associated with a network of devices

Patent metadata

Field	Value
Publication number	US-12250243-B2
Application number	US-202318449590-A
Country	US
Kind code	B2
Filing date	Aug 14, 2023
Priority date	Dec 29, 2014
Publication date	Mar 11, 2025
Grant date	Mar 11, 2025

Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for network risk assessment. One of the methods includes obtaining information describing network traffic between a plurality of network devices within a network. A network topology of the network is determined based on the information describing network traffic, with the network topology including nodes connected by an edge to one or more other nodes, and with each node being associated with one or more network devices. Indications of user access rights of users are associated to respective nodes included in the network topology. User interface data associated with the network topology is generated.

First claim

What is claimed is:

1. A computerized method comprising:
by a system of one or more computer systems,
accessing a network risk map being applied to a network, the network risk map defining a plurality of compromise values and a plurality of compromise vulnerabilities which are associated with user accounts or network devices, wherein a compromise value indicates an importance an attacker would place on compromising a network device and/or user account, and wherein a compromise vulnerability indicates a likelihood of compromise of the user account and/or network device; and
identifying an external event associated with an effect on the network, wherein the compromise values and/or compromise vulnerabilities are modified based on the external event, and wherein modifying compromise vulnerabilities associated with user accounts compromises identifying that the external event affects particular network devices utilized by a subset of the user accounts and increasing compromise vulnerabilities associated with the subset; and
providing, for presentation via an interactive user interface, information describing the external event.

2. The method of claim 1 , wherein the interactive user interface further presents the modified compromise values and/or compromise vulnerabilities.

3. The method of claim 1 , wherein the external event is associated with user accounts, and wherein identifying the external event comprises analyzing information associated with a compromised server which includes personal information associated with the user accounts.

4. The method of claim 1 , wherein the external event is associated with network devices, and wherein identifying the external event comprises analyzing information describing software or hardware affected by the external event.

5. The method of claim 1 , wherein modifying compromise vulnerabilities comprises identifying user accounts or network devices affected by the external event and increasing the associated compromise vulnerabilities.

6. The method of claim 1 , further comprising communicating with agents executing on particular network devices affected by the external event and stopping affected applications or hardware.

7. A system comprising one or more processors and non-transitory computer storage media storing instructions that when executed by the one or more processors, cause the one or more processors to:
access a network risk map being applied to a first network, the network risk map defining a plurality of compromise values and a plurality of compromise vulnerabilities which are associated with user accounts or network devices, wherein a compromise value indicates an importance an attacker would place on compromising a network device and/or user account, and wherein a compromise vulnerability indicates a likelihood of compromise of the user account and/or network device; and
identify an external event associated with an effect on the network, wherein the compromise values and/or compromise vulnerabilities are modified based on the external event, and wherein to modify compromise vulnerabilities associated with user accounts the system is configured to identify that the external event affects particular network devices utilized by a subset of the user accounts and increase compromise vulnerabilities associated with the subset; and
provide, for presentation via an interactive user interface, information describing the external event.

8. The system of claim 7 , wherein the interactive user interface further presents the modified compromise values and/or compromise vulnerabilities.

9. The system of claim 7 , wherein the external event is associated with user accounts, and wherein to identify the external event the system is configured to analyze information associated with a compromised server which includes personal information associated with the user accounts.

10. The system of claim 7 , wherein the external event is associated with network devices, and wherein to identify the external event the system is configured to analyze information describing software or hardware affected by the external event.

11. The system of claim 7 , wherein to modify compromise vulnerabilities the system is configured to identify user accounts or network devices affected by the external event and increase the associated compromise vulnerabilities.

12. The system of claim 7 , wherein the one or more processors are further configured to communicate with agents executing on particular network devices affected by the external event and stopping affected applications or hardware.

13. Non-transitory computer storage media storing instructions that when executed by a system of one or more computers cause the one or more computers to:
access a network risk map being applied to a first network, the network risk map defining a plurality of compromise values and a plurality of compromise vulnerabilities which are associated with user accounts or network devices, wherein a compromise value indicates an importance an attacker would place on compromising a network device and/or user account, and wherein a compromise vulnerability indicates a likelihood of compromise of the user account and/or network device; and
identify an external event associated with an effect on the network, wherein the compromise values and/or compromise vulnerabilities are modified based on the external event, and wherein to modify compromise vulnerabilities associated with user accounts the system is configured to identify that the external event affects particular network devices utilized by a subset of the user accounts and increase compromise vulnerabilities associated with the subset; and
provide, for presentation via an interactive user interface, information describing the external event.

14. The computer storage media of claim 13 , wherein the interactive user interface further presents the modified compromise values and/or compromise vulnerabilities.

15. The computer storage media of claim 13 , wherein the external event is associated with user accounts, and wherein to identify the external event the system is configured to analyze information associated with a compromised server which includes personal information associated with the user accounts.

16. The computer storage media of claim 13 , wherein the external event is associated with network devices, and wherein to identify the external event the system is configured to analyze information describing software or hardware affected by the external event.

17. The computer storage media of claim 13 , wherein to modify compromise vulnerabilities the system is configured to identify user accounts or network devices affected by the external event and increase the associated compromise vulnerabilities.

18. The computer storage media of claim 13 , wherein the one or more computers are further configured to communicate with agents executing on particular network devices affected by the external event and stopping affected applications or hardware.

Assignees

• Palantir Technologies Inc

Inventors

• Seiver Miles
• Cohen Stephen

Classifications

• H04L45/02

  Topology update or discovery · CPC title

• H04L41/12

  Discovery or management of network topologies · CPC title

• H04W84/005

  Moving wireless networks · CPC title

• H04W12/08

  Access security · CPC title

• H04L2012/5623

  Network design, dimensioning, topology or optimisation · CPC title