Method and apparatus for determining a criticality surface of assets to enhance cyber defense

Patent metadata

Field	Value
Publication number	US-2016248794-A1
Application number	US-201414247566-A
Country	US
Kind code	A1
Filing date	Apr 8, 2014
Priority date	Apr 10, 2013
Publication date	Aug 25, 2016
Grant date	—

Abstract

A method and apparatus is provided for determining aggregated value of risk and resilience metrics of critical nodes in a network of computer nodes, comprising determining a status of each node in a plurality of nodes, computing one or more effectiveness attributes for each node in the plurality of nodes, ranking the plurality of nodes based upon at least the one or more effectiveness attributes of each node, determining one or more nodes as critical nodes based on the ranking and computing a criticality surface of the one or more critical nodes as the aggregated value of risk and resilience metrics, wherein the criticality surface is an aggregation of the one or more effectiveness attribute for each of the one or more critical nodes.

First claim

1 . A computer implemented method for determining aggregated value of risk and resilience metrics of critical nodes in a network of computer nodes, comprising:
determining a status of each node in a plurality of nodes; computing one or more effectiveness attributes for each node in the plurality of nodes; ranking the plurality of nodes based upon at least the one or more effectiveness attributes of each node; determining one or more nodes as critical nodes based on the ranking; and computing a criticality surface of the one or more critical nodes as the aggregated value of risk and resilience metrics, wherein the criticality surface is an aggregation of the one or more effectiveness attribute for each of the one or more critical nodes.

2 . The method of claim 1 , wherein determining a status of each node comprises considering an effect of one or more multi-stage attacks on each node.

3 . The method of claim 2 , wherein determining a status of each node further comprises:
determining a probability that a vulnerability of each node is exploitable by a multi-stage attack.

4 . The method of claim 3 , wherein determining a probability comprises:
determining a weighted asset value for each asset in a node of the plurality of nodes by: retrieving weights for all assets from a database of assets and their corresponding weight; determining assets available in a node; and summing the weight of assets available in each node.

5 . The method of claim 1 , computing the effectiveness attributes further comprising:
constructing a probabilistic model based on the status of each node; and determining, using the probabilistic model, a risk assessment for the one or more effectiveness attributes.

6 . The method of claim 5 , wherein the one or more effectiveness attributes comprise at least control effectiveness, resilience effectiveness and intrusion effectiveness.

7 . The method of claim 1 , wherein ranking the plurality of nodes comprises:
selecting an alternative from a plurality of alternatives closed to a positive ideal solution, and as far from a negative ideal solution as a predetermined threshold value, while considering multiple attributes.

8 . The method of claim 7 , further comprising considering multiple weights in distance calculation to maximize a distance from the negative ideal solution.

9 . The method of claim 1 , wherein determining one or more nodes as the critical nodes comprises:
constructing a graph from the plurality of nodes and their connectivity to each other; assigning multiple attributes to each node in the graph; comparing the attributes of a selected node from the plurality of nodes to peer nodes; selecting one of the potential ancestor nodes with a highest attribute value; and determining one or more nodes as the critical nodes after a predetermined number of peer nodes is selecting.

10 . The method of claim 9 , wherein the multiple attributes are ranked against each other.

11 . The method of claim 10 , wherein if equally ranked attributes of the selected node and a peer node have values that are equal or within a predetermined threshold, next lower ranked attributes are compared until an attribute value of one node is at least a predetermined threshold greater than the attribute value of another node.

12 . The method of claim 11 , further comprising:
selecting either the selected node or one of the peer nodes randomly if all equally ranked attributes have equal values.

13 . The method of claim 12 , wherein determining peer attribute values comprises moving a predetermined number of nodes away from the selected node.

14 . The method of claim 9 , wherein the method is performed log 2 N times, where N represents a size of the plurality of nodes.

15 . The method of claim 1 , wherein computing the criticality surface further comprises:
computing an area of a polygon, wherein the polygon comprises vertices formed for each metric considered as an important metric and mapped two-dimensionally.

16 . An apparatus for determining aggregated value of risk and resilience metrics of critical nodes in a plurality of computer nodes, comprising at least one processor having a plurality of modules which include:
a control value module configured for determining a status of each node in the plurality of computer nodes; an effectiveness module configured for computing one or more effectiveness attributes for each node in the plurality of nodes; a ranking module configured for ranking the plurality of nodes based on at least the one or more effectiveness attributes; a criticality module configured for determining one or more nodes as critical nodes based on at least the ranking of the plurality of nodes; and a criticality surface module configured for computing a criticality surface of the one or more critical nodes as the aggregated value of risk and resilience metric, wherein the criticality surface is an aggregation of the one or more effectiveness attribute for each of the one or more critical nodes.

17 . The apparatus of claim 16 , the effectiveness module further configured for:
constructing a probabilistic model based on the status of each node; and determining, using the probabilistic model, a risk assessment for the one or more effectiveness attributes.

18 . The apparatus of claim 16 , the ranking module further configured for:
selecting an alternative from a plurality of alternatives closed to a positive ideal solution, and as far from a negative ideal solution as a predetermined threshold value, while considering multiple attributes.

19 . The apparatus of claim 16 , the critical node module further configured for:
constructing a hierarchically well-separated Tree with attributes (HSTA) from the plurality of nodes and their connectivity to each other; assigning multiple attributes to each node in the HSTA; and comparing the attributes of a selected node from the plurality of nodes to potential peer nodes; selecting one of the peer nodes with a highest attribute value; and determining one or more nodes as the critical nodes after a predetermined number of peer nodes is selecting.

20 . A non-transient computer readable medium for storing computer instructions that, when executed by at least one processor causes the at least one processor to perform a method for determining aggregated value of risk and resilience metrics of critical nodes from a plurality of computer nodes, comprising:
determining a status of each node in a plurality of computer nodes; computing one or more effectiveness attributes of each node in the plurality of nodes; ranking the plurality of nodes based upon at least the one or more effectiveness attributes of each node; determining one or more nodes as critical nodes based on the ranking; and computing a criticality surface of the one or more critical nodes as the aggregated value of risk and resilience metrics, wherein the criticality surface is an aggregation of the one or more effectiveness attribute for each of the one or more critical nodes.

Assignees

• U S Army Res Laboratory Attn: Rdrl-Loc-I

Inventors

• Cam Hasan

Classifications

• H04L63/1433 Primary

  Vulnerability analysis · CPC title