Synthetic Cyber-Risk Model for Vulnerability Determination

Patent metadata

Field	Value
Publication number	US-2018343278-A1
Application number	US-201816036138-A
Country	US
Kind code	A1
Filing date	Jul 16, 2018
Priority date	Nov 11, 2014
Publication date	Nov 29, 2018
Grant date	—

Abstract

A system, method, and device are presented for assessing a target network's vulnerability to a real cyberthreat based on determining policy-based synthetic tests configured to model the behavior of the cyberthreat. Real-time feedback from the target network (e.g., servers, desktops, and network/monitoring hardware and/or software equipment) are received, analyzed, and used to determine whether any modifications to the same or a new synthesized test is preferred. The technology includes self-healing processes that, using the feedback mechanisms, can attempt to find patches for known vulnerabilities, test for unknown vulnerabilities, and configure the target network's resources in accordance with predefined service-level agreements.

First claim

We claim:

1 . A method comprising:
receiving information associated with a cyberthreat, wherein the cyberthreat is associated with an objective; using the information, mapping one or more characteristics of the cyberthreat into instructions for performing steps to simulate an existence of the cyberthreat within a target network without implementing the objective of the cyberthreat in the target network; determining one or more agents to execute the instructions; initiating execution of the instructions by the one or more agents to simulate the existence of the cyberthreat within the target network; receiving feedback including receiving a level of success of the one or more agents in performing the steps; and generating an analysis, based on the feedback, that includes a recommended configuration change for a computing device within the target network to improve detection of or response to the cyberthreat.

2 . The method of claim 1 , wherein the feedback includes:
a number of the steps that were successfully completed; and an indication of whether the computing device detected the cyberthreat or how the computing device responded to the cyberthreat.

3 . The method of claim 1 , wherein mapping one or more of the characteristics of the cyberthreat to instruction includes determining logic that, when executed by the one or more agents, would achieve or approximately achieve the objective of the cyber-threat if the cyberthreat were to execute the objective successfully, wherein the logic is configured to dynamically generate a file, create network communication, or access a user account, system, account, directory, database, or registry.

4 . The method of claim 1 , wherein receiving information associated with the cyberthreat includes:
receiving an indication of the cyberthreat to data security from an external source; and determining the one or more characteristics of the cyberthreat based on information from the external source.

5 . The method of claim 1 , further comprising automatically implementing the recommended configuration change responsive to the analysis.

6 . The method of claim 1 , wherein generating the analysis includes determining whether the target network is at or near a threshold level of vulnerability to the cyberattack, the recommended configuration change being generated responsive to the target network being at or near the threshold.

7 . The method of claim 1 , wherein the recommended configuration change is dynamically generated based on a configurable set of rules.

8 . The method of claim 1 , wherein the recommended configuration change includes at least one of: dynamically terminating network communication ports used by the simulated cyberthreat; enabling a firewall rule; failing the target network so that network traffic is routed to a failover network; or routing traffic to a demilitarized zone for further analysis in a sandbox network.

9 . A non-transitory computer-readable medium storing instructions that, when executed, cause one or more processors to perform operations comprising:
receiving information associated with a cyberthreat, wherein the cyberthreat is associated with an objective; using the information, mapping one or more characteristics of the cyberthreat into instructions for performing steps to simulate an existence of the cyberthreat within a target network without implementing the objective of the cyberthreat in the target network; determining one or more agents to execute the instructions; initiating execution of the instructions by the one or more agents to simulate the existence of the cyberthreat within the target network; receiving feedback including receiving a level of success of the one or more agents in performing the steps; and generating an analysis, based on the feedback, that includes a recommended configuration change for a computing device within the target network to improve detection of or response to the cyberthreat.

10 . The non-transitory computer-readable medium of claim 9 , wherein the feedback includes:
a number of the steps that were successfully completed; and an indication of whether the computing device detected the cyberthreat or how the computing device responded to the cyberthreat.

11 . The non-transitory computer-readable medium of claim 9 , wherein mapping one or more of the characteristics of the cyberthreat to instruction includes determining logic that, when executed by the one or more agents, would achieve or approximately achieve the objective of the cyber-threat if the cyberthreat were to execute the objective successfully, wherein the logic is configured to dynamically generate a file, create network communication, or access a user account, system, account, directory, database, or registry.

12 . The non-transitory computer-readable medium of claim 9 , wherein receiving information associated with the cyberthreat includes:
receiving an indication of the cyberthreat to data security from an external source; and determining the one or more characteristics of the cyberthreat based on information from the external source.

13 . The non-transitory computer-readable medium of claim 9 , wherein the operations further comprise automatically implementing the recommended configuration change responsive to the analysis.

14 . The non-transitory computer-readable medium of claim 9 , wherein generating the analysis includes determining whether the target network is at or near a threshold level of vulnerability to the cyberattack, the recommended configuration change being generated responsive to the target network being at or near the threshold.

15 . The non-transitory computer-readable medium of claim 9 , wherein the recommended configuration change is dynamically generated based on a configurable set of rules.

16 . The non-transitory computer-readable medium of claim 9 , wherein the recommended configuration change includes at least one of: dynamically terminating network communication ports used by the simulated cyberthreat; enabling a firewall rule; failing the target network so that network traffic is routed to a failover network; or routing traffic to a demilitarized zone for further analysis in a sandbox network.

17 . A system comprising:
one or more processors; and one or more computer readable media storing instructions that, when executed, cause the one or more processors to perform operations including:
receiving information associated with a cyberthreat, wherein the cyberthreat is associated with an objective;
using the information, mapping one or more characteristics of the cyberthreat into instructions for performing steps to simulate an existence of the cyberthreat within a target network without implementing the objective of the cyberthreat in the target network;
determining one or more agents to execute the instructions;
initiating execution of the instructions by the one or more agents to simulate the existence of the cyberthreat within the target network;
receiving feedback including receiving a level of success of the one or more agents in performing the steps; and
generating an analysis, based on the feedback, that includes a recommended configuration change for a computing device within the target network to improve detection of or response to the cyberthreat.

18 . The system of claim 17 , wherein mapping one or more of the characteristics of the cyberthreat to instruction includes determining logic that, when executed by the one or more agents, would achieve or approximately achieve the objective of th

Assignees

• Goldman Sachs & Co Llc

Inventors

• Vallone David
• Taylor Peter
• Venables Phil J
• Huang Ruoh-Yann

Classifications

• H04L41/0886

  Fully automatic configuration · CPC title

• H04L41/147

  for predicting network behaviour · CPC title

• H04L41/046

  comprising network management agents or mobile agents therefor · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L41/145

  involving simulating, designing, planning or modelling of a network · CPC title