K-zero day safety

Patent metadata

Field	Value
Publication number	US-9325729-B2
Application number	US-201414324966-A
Country	US
Kind code	B2
Filing date	Jul 7, 2014
Priority date	Jan 11, 2011
Publication date	Apr 26, 2016
Grant date	Apr 26, 2016

Abstract

Systems and methods for determining a safety level of a network vulnerable to attack from at least one origin to at least one target are described. Machines, components, and vulnerabilities in a network may be associated to one another. Degrees of similarity among the vulnerabilities may be determined and subsets of vulnerabilities may be grouped based on their determined degrees of similarity to one another. This data may be used to generate an attack graph describing exploitation of vulnerabilities and grouped vulnerabilities and defining vulnerability exploit condition relationships between at least one origin and at least one target. The attack graph may be analyzed using a k-zero day metric function to determine a safety level.

First claim

What is claimed is:

1. A method for securing a network vulnerable to attack from at least one origin to at least one target, the network including at least one machine having a plurality of components, the method comprising:
(i) causing a present security of the network to be determined, wherein the present security of the network is indicated by a safety level of the network, wherein the safety level is determined by:
associating, with a computer, the at least one machine with the plurality of components, the plurality of components comprising an origin component and a target component;
associating, with the computer, each of the plurality of components with at least one of a plurality of vulnerabilities; generating, with the computer, an attack graph describing exploitation of each of the plurality of vulnerabilities, the attack graph defining exploit condition relationships between the origin component and the target component;
analyzing, with the computer, the attack graph using a k-zero day metric function based on a number of distinct zero day exploits required to compromise the target component in an attack starting from the origin component; and
determining, with the computer, the safety level based on the analysis of the attack graph using the k-zero day metric function; and

(ii) causing hardening to be performed on the network based on the determined safety level.

2. The method of claim 1 , wherein:
the analyzing of the attack graph comprises determining a minimum number of distinct zero day exploits required to compromise the target component by iteratively applying the k-zero day metric function to the attack graph for each of the plurality of vulnerabilities to determine a minimum number of exploitable vulnerabilities required to compromise the target component; and
the safety level comprises a minimum number of distinct zero day exploits required to compromise the target component.

3. The method of claim 1 , wherein:
the analyzing of the attack graph comprises determining whether the target component is unable to be compromised by a specific number of distinct zero day exploits by analyzing the attack graph using a k-zero day metric function to determine whether any number of vulnerabilities required to compromise the target component is less than the specific number; and
the safety level comprises an indication whether the target component is unable to be compromised by the specific number of zero day exploits.

4. The method of claim 1 , wherein each of the plurality of components is any unit of computational processing that can contribute to a network attack vulnerability.

5. The method of claim 1 , further comprising generating with the computer a visual presentation of at least part of the attack graph.

6. The method of claim 1 , wherein the network is a cloud network.

7. A computer system, comprising:
a computer constructed and arranged to determine a safety level of an original network vulnerable to attack from at least one origin to at least one target, the original network including at least one machine having a plurality of components, the computer comprising: a processor constructed and arranged to:
associate the at least one machine with the plurality of components, the plurality of components comprising an origin component and a target component;
associate each of the plurality of components with at least one of a plurality of vulnerabilities;
generate an attack graph describing exploitation of each of the plurality of vulnerabilities, the attack graph defining exploit condition relationships between the origin component and the target component;
analyze the attack graph using a k-zero day metric function based on a number of distinct zero day exploits required to compromise the target component in an attack starting from the origin component; and
determine a safety level based on the analysis of the attack graph using the k-zero day metric function; and

a hardened network created by performing hardening on the original network based on the determined safety level.

8. The computer of claim 7 , wherein:
the processor is constructed and arranged to analyze the attach graph by determining whether the target component is unable to be compromised by a. specific number of distinct zero day exploits by analyzing the attack graph using a k-zero day metric function to determine whether any number of vulnerabilities required to compromise the target component is less than the specific number; and
the safety level comprises an indication whether the target component is unable to be compromised by the specific number of zero day exploits.

9. The computer of claim 7 , wherein:
the processor is constructed and arranged to analyze the attack graph by determining whether the target component is unable to be compromised by a specific number of distinct zero day exploits by analyzing the attack graph using a k-zero day metric function to determine whether any number of vulnerabilities required to compromise the target component is less than the specific number; and
the safety level comprises an indication whether the target component is unable to be compromised by the specific number of zero day exploits.

10. The computer of claim 7 . wherein each of the plurality of components is any unit of computational processing that can contribute to a network attack vulnerability.

11. The computer of claim 7 , further comprising:
a display;
wherein the processor is further constructed and arranged to generate a visual representation of at least part of the attack graph and output the visual representation to the display.

12. The computer of claim 7 , wherein the original network is a cloud network.

13. The computer of claim 7 , wherein:
the processor is in communication with the original network; and
the processor is further constructed and arranged to scan the original network to gather data about the at least one machine, the plurality of components, and/or the at least one of the plurality of vulnerabilities.

14. The computer of claim 7 , wherein;
the processor is in communication with the original network; and
the processor is further constructed and arranged to receive data via the original network about the at least one machine, the plurality of components, and/or the at least one of the plurality of vulnerabilities.

15. A computer network system, comprising:
a hardened network created by performing hardening on an original network based on a safety level of the original network, the original network being vulnerable to attack from at least one origin to at least one target, the original network including at least one machine having a plurality of components, wherein the safety level is determined by:
associating, with a computer, the at least one machine with plurality of components, the plurality of components comprising an origin component and a target component;
associating, with the computer, each of the plurality of components with at least one of a plurality of vulnerabilities;
generating, with the computer, an attack graph describing exploitation of each of the plurality of vulnerabilities, the attack graph defining exploit condition relationships between the origin component and the target component;
analyzing, with the computer, the attack graph using a k-zero day metric function based on a number of distinct zero day exploits required to compromise the target component in an attack starting from the origin component; and
determining, with the computer, the safety level based on the analysis of the attack graph using the k-zero day metric function.

Assignees

• George Mason Res Foundation Inc
• Us Of America As Represented By The Secretary Of Commerce The Nat Inst Of Standards And Technology

Inventors

• Jajodia Sushil
• Wang Lingyu
• Noel Steven
• Singhal Anoop

Classifications

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title