Capturing importance in a network using graph theory

Patent metadata

Field	Value
Publication number	US-12335293-B2
Application number	US-202217977621-A
Country	US
Kind code	B2
Filing date	Oct 31, 2022
Priority date	Nov 1, 2021
Publication date	Jun 17, 2025
Grant date	Jun 17, 2025

Abstract

A cyber security system includes an importance node module to compute and use graphs to compute an importance of a node based on factors including a hierarchy and a job title of the user, aggregated account privileges from network domains and a level of shared resource access for the user. The graphs are supplied into an attack path modeling component to understand an importance of the network nodes and determine key pathways within the network that a cyber-attack would use, via a modeling the cyber-attack on a simulated and a virtual device version of the network. The cyber security system provides an intelligent prioritization of remediation action to a remediation suggester module to analyze results of the modeling the cyber-attack for each node and suggest how to perform intelligent prioritization of remediation action on a network node in one of a report and an autonomous remediation action.

First claim

What is claimed is:

1. An apparatus, comprising:
an importance node module configured to compute, via a mathematical function and use of one or more graphs, an importance of a network node in the one or more graphs based on at least two or more factors that at least include a hierarchy of a user in an organization, a job title of the user in the organization, aggregated account privileges from multiple different network domains for the user, and a level of shared resource access for the user, where the importance node module is further configured to supply the one or more graphs as input into an attack path modeling component, where network nodes in a network include both network devices as well as user accounts,
where the attack path modeling component is configured to i) understand the importance of a particular network node in the network compared to other network nodes in the network, and ii) determine key pathways within the network and associated vulnerable network nodes in the network that a cyber-attack would use during the cyber-attack, via a modeling of the cyber-attack with at least one of 1) a cyber threat attack simulator and 2) a clone network created in a virtual machine environment of the network under analysis, where the attack path modeling component is configured to understand the importance of the network nodes in the network compared to the other network nodes in the network based on the supplied graph input from the importance node module;
where the importance node module and the attack path modeling component are configured to cooperate to analyze the importance of the network nodes in the network compared to other network nodes in the network, and the key pathways within the network and the vulnerable network nodes in the network that the cyber-attack would use during the cyber-attack in order to provide an intelligent prioritization of a remediation action to remediate the cyber-attack for a first network node from the network protected by an Artificial Intelligence (AI) based cyber security system;
a remediation suggester module configured to cooperate with the attack path modeling component to analyze results of the modeling the cyber-attack occurrence for each node in the network and suggest how to perform the intelligent prioritization of a remediation action on the first network node based upon at least an importance of the first network node compared to the other network nodes in at least one of a report and an autonomous remediation action initiated by the remediation suggester module to mitigate against the cyber-attack;
one or more processing units configured to execute software instructions associated with the importance node module, the attack path modeling component, and the remediation suggester module; and
one or more non-transitory storage mediums configured to store at least software associated with the importance node module, the attack path modeling component, and the remediation suggester module.

2. The apparatus of claim 1 , further comprising
a graph theory module configured to cooperate with the importance node module to utilize a graph theory to derive multiple domain, risk-prioritized attack paths within the network for cyber-attack path modelling, where the network is a multiple domain network that includes at least two of a cloud network, an information technology network, and an email network, in order to assist in the intelligent prioritization of the remediation action initiated by the remediation suggester module to mitigate against the cyber-attack.

3. The apparatus of claim 1 , wherein the attack path modeling component is further configured to utilize artificial intelligence models to model and the cyber threat attack simulator to simulate the cyber-attack occurrence and to determine and use a user's presence in a simulated cyber-attack analysis, where the user's presence includes at least the importance of the user.

4. The apparatus of claim 3 , where the attack path modeling component and the importance node module are further configured to use a decay algorithm to decide what nodes in the network are of most importance to detect key devices or key users.

5. The apparatus of claim 2 , where the graph theory module is configured to use an active directory that uses an unweighted directed graph.

6. The apparatus of claim 1 , further comprising
a reconciliatory module configured to reconcile different accounts associated with a user in the network into one entity, where each of the different accounts is associated with a corresponding risk, where the reconciliatory module is further configured to compute a device importance for each network device based at least in part on an interactivity of the network device including data received by a first network device, data sent from the first network device, a level of sensitivity of the data accessible within the first network device.

7. The apparatus of claim 6 , where the reconciliatory module is configured to compute an overall importance for each node in the network based on each of the different accounts associated with the user and each device importance of each network device associated with that node.

8. The apparatus of claim 1 , where a graph module is configured to create a graph of nodes that a user in the network i) connects to, ii) move to, and iii) user's network device connects to.

9. The apparatus of claim 1 , where the one or more graphs include at least a subset of a basic undirected graphs, a directed weighted graph, and an unweighted directed graphs from information pulled from domains based on factors that at least include the hierarchy of the user in the organization, the job title of the user in the organization, the aggregated account privileges from the multiple different network domains for the user, and the level of shared resource access for the user.

10. A method for countering a cyber-attack, the method comprising:
configuring an importance node module to compute, via a mathematical function and use of one or more graphs, an importance of a network node in the one or more graphs based on at least two or more factors that at least include a hierarchy of a user in an organization, a job title of the user in the organization, aggregated account privileges from multiple different network domains for the user, and a level of shared resource access for the user, where the importance node module is further configured to supply the one or more graphs as input into an attack path modeling component, where network nodes in a network include both network devices as well as user accounts,
configuring the attack path modeling component to i) understand the importance of a particular network node in the network compared to other network nodes in the network, and ii) determine key pathways within the network and associated vulnerable network nodes in the network that a cyber-attack would use during the cyber-attack, via a modeling of the cyber-attack with at least one of 1) a cyber threat attack simulator and 2) a clone network created in a virtual machine environment of the network under analysis, where the attack path modeling component is configured to understand the importance of the network nodes in the network compared to the other network nodes in the network based on the supplied graph input from the importance node module;
configuring the importance node module and the attack path modeling component to cooperate to analyze the importance of the network nodes in the network compared to other network nodes in the network, and the key pathways within the network and the vulnerable network nodes in the network that the cyber-attack would use during the cyber-attack in order to provide an intelligent priori

Assignees

• Darktrace Holdings Ltd

Inventors

• Marsenic Marko
• Salji Carl Joseph
• Lal Jake
• Dunn Matthew

Classifications

• H04L63/1433 Primary

  Vulnerability analysis · CPC title