Techniques for visualizing network attack paths

Patent metadata

Field	Value
Publication number	US-12476996-B2
Application number	US-202318478973-A
Country	US
Kind code	B2
Filing date	Sep 29, 2023
Priority date	Sep 29, 2023
Publication date	Nov 18, 2025
Grant date	Nov 18, 2025

Abstract

An example method includes using at least one computer hardware processor to perform: identifying one or more vulnerable network resources in a plurality of network resources, each of the one or more vulnerable network resources having at least one respective security vulnerability; accessing at least one portion of a relational representation of a set of network resources in the plurality of network resources, identifying, using the at least one portion of the relational representation, one or more network attack paths between the one or more vulnerable network resources and network resources in the set, generating, using the at least one portion of the relational representation, a graph, and generating a GUI comprising a visualization of the graph and information indicating that the one or more attack paths may be used to exploit one or more security vulnerabilities of the set.

First claim

What is claimed is:

1 . A method for visualizing exploitable security vulnerabilities in a computing environment, the computing environment comprising a plurality of network resources and network connections therebetween, the method comprising:
using at least one computer hardware processor to perform:
identifying one or more vulnerable network resources in the plurality of network resources, each of the one or more vulnerable network resources having at least one respective security vulnerability;
accessing at least one portion of a relational representation of a set of network resources in the plurality of network resources, the relational representation indicating network resources in the set of network resources and network connections among the network resources in the set of network resources, the at least one portion of the relational representation corresponding to the one or more vulnerable network resources;
identifying, using the at least one portion of the relational representation, one or more network attack paths between the one or more vulnerable network resources and at least some network resources in the set of network resources;
generating, using the at least one portion of the relational representation, a graph comprising nodes and edges, the nodes representing the one or more vulnerable network resources and the at least some network resources in the set of network resources along the one or more network attack paths, the edges representing the one or more network attack paths; and
generating a graphical user interface (GUI) comprising a visualization of the graph and information indicating that the one or more attack paths may be used to exploit one or more security vulnerabilities of network resources in the set of network resources,
wherein the method further comprises:
receiving user input indicating a selection of a node in the plurality of nodes, the node displayed in the visualization, the selected node representing one of the one or more vulnerable network resources; and
identifying one or more nodes in the plurality of nodes that have a respective network connection to the selected node, and wherein
generating the GUI comprising the visualization comprises:
displaying at least one GUI element containing content that indicates that the one or more nodes in the plurality of nodes are exploitable based on the one or more nodes having a respective network connection to a node representing a vulnerable network resource.

2 . The method of claim 1 , further comprising:
obtaining metadata indicating the set of network resources in the plurality of network resources and the network connections among the network resources in the set of network resources; and generating, using the metadata, the relational representation of the set of network resources.

3 . The method of claim 2 , further comprising:
generating, using the relational representation, a plurality of network paths between the network resources in the set of network resources; and identifying, from among the plurality of network paths and using the relational representation and information indicating one or more of the plurality of network resources that have the at least one respective security vulnerability, at least the one or more network attack paths.

4 . The method of claim 1 , wherein generating the GUI comprising the visualization comprises generating at least one GUI element containing content indicating an explanation for why the one or more network attack paths are identified as the one more network attack paths.

5 . The method of claim 1 , wherein generating the GUI comprising the visualization comprises generating at least one GUI element containing content indicating one or more operations actionable by a user to at least one of mitigate or resolve the at least one respective security vulnerability of the one or more vulnerable network resources.

6 . The method of claim 5 , wherein generating the at least one GUI element comprises identifying at least one of (i) an update to firmware or software of the one or more vulnerable network resources, (ii) one or more changes to security settings of the one or more vulnerable network resources, or (iii) a reconfiguration of at least one portion of the computing environment as the one or more operations.

7 . A network attack path visualization system comprising:
at least one non-transitory computer readable storage medium storing instructions; and at least one computer hardware processor to execute the instructions to perform a method for visualizing exploitable security vulnerabilities in a computing environment, the computing environment comprising a plurality of network resources and network connections therebetween, the method comprising:
identifying one or more vulnerable network resources in the plurality of network resources, each of the one or more vulnerable network resources having at least one respective security vulnerability;
accessing at least one portion of a relational representation of a set of network resources in the plurality of network resources, the relational representation indicating network resources in the set of network resources and network connections among the network resources in the set of network resources, the at least one portion of the relational representation corresponding to the one or more vulnerable network resources;
identifying, using the at least one portion of the relational representation, one or more network attack paths between the one or more vulnerable network resources and at least some network resources in the set of network resources;
generating, using the at least one portion of the relational representation, a graph comprising nodes and edges, the nodes representing the one or more vulnerable network resources and the at least some network resources in the set of network resources along the one or more network attack paths, the edges representing the one or more network attack paths; and
generating a graphical user interface (GUI) comprising a visualization of the graph and information indicating that the one or more attack paths may be used to exploit one or more security vulnerabilities of network resources in the set of network resources,
wherein the method further comprises:
receiving user input indicating a selection of a node in the plurality of nodes, the node displayed in the visualization, the selected node representing one of the one or more vulnerable network resources; and
identifying one or more nodes in the plurality of nodes that have a respective network connection to the selected node, and wherein
generating the GUI comprising the visualization comprises:
displaying at least one GUI element containing content that indicates that the one or more nodes in the plurality of nodes are exploitable based on the one or more nodes having a respective network connection to a node representing a vulnerable network resource.

8 . The network attack path visualization system of claim 7 , wherein the at least one computer hardware processor is to:
obtain metadata indicating the set of network resources in the plurality of network resources and the network connections among the network resources in the set of network resources; and generate, using the metadata, the relational representation of the set of network resources.

9 . The network attack path visualization system of claim 8 , wherein the at least one computer hardware processor is to:
generate, using the relational representation, a plurality of network paths between the network resources in the set of network resources; and identify, from among the plurality of network paths and using the relational representation and information indic

Assignees

• Rapid7 Inc

Inventors

• Komarov Val
• Riley Thomas

Classifications

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L41/22 Primary

  comprising specially adapted graphical user interfaces [GUI] · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title