Automated prioritization of process-aware cyber risk mitigation

Patent metadata

Field	Value
Publication number	US-12284200-B2
Application number	US-202217675330-A
Country	US
Kind code	B2
Filing date	Feb 18, 2022
Priority date	Feb 18, 2021
Publication date	Apr 22, 2025
Grant date	Apr 22, 2025

Abstract

Implementations are directed to receiving graph data representative of a process-aware AAG that is representative of potential lateral movement of adversaries within a computer network, receiving risk profile data representative of a risk profile of an enterprise with respect to two or more risk aspects, generating, by a process-aware risk assessment module, a risk assessment based on the process-aware AAG and the risk profile, and generating, by a mitigation simulator module, a mitigation list based on the process-aware AAG, the risk profile, and the risk assessment, the mitigation list comprising a prioritized list of two or more facts of the process-aware AAG. Other implementations of this aspect include corresponding systems, apparatus, and computer programs, configured to perform the actions of the methods, encoded on computer storage devices.

First claim

What is claimed is:

1. A computer-implemented method for prioritizing mitigation in enterprise networks, the method being executed by one or more processors and comprising:
receiving graph data representative of a process-aware analytical attack graph (AAG) that is representative of potential lateral movement of adversaries within a computer network;
receiving risk profile data representative of a risk profile of an enterprise with respect to two or more risk aspects;
generating, by a process-aware risk assessment module, a risk assessment based on the process-aware AAG and the risk profile;
generating, by a mitigation simulator module, a mitigation list based on the process-aware AAG, the risk profile, and the risk assessment, wherein the mitigation list comprises a prioritized list of two or more facts of the process-aware AAG;
prioritizing, by the mitigation simulator module, a set of remediation actions to mitigate the prioritized list of the two or more facts of the process-aware AAG; and
executing at least one remediation action in the set of remediation actions based on the prioritization of the set of remediation actions.

2. The method of claim 1 , wherein nodes of the process-aware AAG are associated with process attributes, a process attribute maps a node to at least a portion of a process that is at least partially executed within the computer network.

3. The method of claim 2 , wherein edges of the process-aware AAG represent relationships between processes.

4. The method of claim 3 , wherein, for an edge between a first node and a second node of the process-aware AAG, the edge is associated with an importance vector representing a risk dependency between a process mapped to the first node and a process mapped to the second node.

5. The method of claim 1 , wherein the risk profile comprises a set of risk acceptance scores, each risk acceptance score representing a tolerance of the enterprise to a respective risk aspect.

6. The method of claim 1 , wherein a risk aspect of the two or more risk aspects comprises one of a safety, availability, integrity, and confidentiality.

7. The method of claim 1 , the mitigation list is generated based on one of minimizing a risk aspect of the two or more risk aspects and minimizing a total score that is determined based on all of the two or more risk aspects.

8. The method of claim 1 , wherein generating the risk assessment comprising generating a set of risk scores for contexts of each of process, crown-jewel, and attack goals.

9. The method of claim 8 , wherein each set of risk scores represents risk of one of the two or more risk aspects.

10. One or more non-transitory computer-readable storage media coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for prioritizing mitigation in enterprise networks, the operations comprising:
receiving graph data representative of a process-aware analytical attack graph (AAG) that is representative of potential lateral movement of adversaries within a computer network;
receiving risk profile data representative of a risk profile of an enterprise with respect to two or more risk aspects;
generating, by a process-aware risk assessment module, a risk assessment based on the process-aware AAG and the risk profile;
generating, by a mitigation simulator module, a mitigation list based on the process-aware AAG, the risk profile, and the risk assessment, wherein the mitigation list comprises a prioritized list of two or more facts of the process-aware AAG;
prioritizing, by the mitigation simulator module, a set of remediation actions to mitigate the prioritized list of the two or more facts of the process-aware AAG; and
executing at least one remediation action in the set of remediation actions based on the prioritization of the set of remediation actions.

11. The one or more non-transitory computer-readable storage media of claim 10 , wherein nodes of the process-aware AAG are associated with process attributes, a process attribute maps a node to at least a portion of a process that is at least partially executed within the computer network.

12. The one or more non-transitory computer-readable storage media of claim 11 , wherein edges of the process-aware AAG represent relationships between processes.

13. The one or more non-transitory computer-readable storage media of claim 12 , wherein, for an edge between a first node and a second node of the process-aware AAG, the edge is associated with an importance vector representing a risk dependency between a process mapped to the first node and a process mapped to the second node.

14. The one or more non-transitory computer-readable storage media of claim 10 , wherein the risk profile comprises a set of risk acceptance scores, each risk acceptance score representing a tolerance of the enterprise to a respective risk aspect.

15. The one or more non-transitory computer-readable storage media of claim 10 , wherein a risk aspect of the two or more risk aspects comprises one of a safety, availability, integrity, and confidentiality.

16. The one or more non-transitory computer-readable storage media of claim 10 , the mitigation list is generated based on one of minimizing a risk aspect of the two or more risk aspects and minimizing a total score that is determined based on all of the two or more risk aspects.

17. The one or more non-transitory computer-readable storage media of claim 10 ,
wherein generating the risk assessment comprising generating a set of risk scores for contexts of each of process, crown-jewel, and attack goals, and
wherein each set of risk scores represents risk of one of the two or more risk aspects.

18. A system, comprising:
one or more processors; and
a computer-readable storage device coupled to the one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for prioritizing mitigation in enterprise networks, the operations comprising:
receiving graph data representative of a process-aware analytical attack graph (AAG) that is representative of potential lateral movement of adversaries within a computer network;
receiving risk profile data representative of a risk profile of an enterprise with respect to two or more risk aspects;
generating, by a process-aware risk assessment module, a risk assessment based on the process-aware AAG and the risk profile;
generating, by a mitigation simulator module, a mitigation list based on the process-aware AAG, the risk profile, and the risk assessment, wherein the mitigation list comprises a prioritized list of two or more facts of the process-aware AAG;
prioritizing, by the mitigation simulator module, a set of remediation actions to mitigate the prioritized list of the two or more facts of the process-aware AAG; and
executing at least one remediation action in the set of remediation actions based on the prioritization of the set of remediation actions.

Assignees

• Accenture Global Solutions Ltd

Inventors

• Engelberg Gal
• Klein Dan
• Ram Tomer

Classifications

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• G06N5/04

  Inference or reasoning models · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title