Systems for network risk assessment including processing of user access rights associated with a network of devices

Patent metadata

Field	Value
Publication number	US-9882925-B2
Application number	US-201615267589-A
Country	US
Kind code	B2
Filing date	Sep 16, 2016
Priority date	Dec 29, 2014
Publication date	Jan 30, 2018
Grant date	Jan 30, 2018

Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for network risk assessment. One of the methods includes obtaining information describing network traffic between a plurality of network devices within a network. A network topology of the network is determined based on the information describing network traffic, with the network topology including nodes connected by an edge to one or more other nodes, and with each node being associated with one or more network devices. Indications of user access rights of users are associated to respective nodes included in the network topology. User interface data associated with the network topology is generated.

First claim

What is claimed is:

1. A computerized method comprising:
by a computing device having one or more computer processors and a non-transitory computer readable storage device storing software instruction for execution by the one or more computer processors,
obtaining information describing network traffic between a plurality of network devices within a network;
determining, based on the information describing network traffic, a network topology of the network, the network topology comprising a plurality of nodes each connected to one or more of the plurality of nodes, wherein each node is associated with one or more network devices, and wherein the network topology is associated with indications of user access rights of a plurality of user accounts to respective nodes included in the network topology;
determining, for each of the plurality of user accounts, a risk associated with the user account being compromised with respect to the network, the risk being based on:
user access rights of the user account to nodes included in the network topology, and
information informing vulnerability of the user account being compromised; and

generating user interface data describing the risks associated with the user accounts, the user interface data including indications of user accounts organized according to respective risk.

2. The computerized method of claim 1 , wherein an indication of user access rights of a particular user account to a particular node comprises one or more of:
information indicating that a user associated with the particular user account is permitted access to a space that includes at least one network device associated with the particular node,
information indicating that the particular user account can provide information to, or receive information from, at least one network device associated with the particular node, or
information indicating that the particular user account is permitted to access, or has actually attempted to access, at least one network device associated with the particular node.

3. The method of claim 1 , wherein information informing vulnerability of a particular user account being compromised comprises one or more of a complexity of a password associated with the particular user account, a location from which a user associated with the particular user account logs in, a length of time the user has been associated with the network, or information associated with an importance of the particular user account.

4. The method of claim 1 , further comprising:
determining, for each of the plurality of nodes, a risk associated with the node being compromised, wherein the risk associated with each user account being compromised is based, at least in part, on risks associated with nodes that are associated with user access rights of the user account.

5. The method of claim 4 , further comprising:
receiving information identifying nodes indicated as being important, wherein the risk associated with each user account is based, at least in part, on user access rights of the user account that are associated with the indicated nodes.

6. The method of claim 1 , wherein a generated user interface is configured to receive a selection of a user account, and wherein upon receiving a selection of a particular user account the generated user interface is configured to present the network topology with particular nodes that are associated with user access rights of the particular user account being shaded or colored.

7. The method of claim 6 , wherein the generated user interface is configured to present a total risk associated with the particular nodes that are associated with user access rights of the particular user account, the total risk being determined based on risks associated with each of the particular nodes.

8. A system comprising one or more computer systems and one or more computer storage media storing instructions that when executed by the system of one or more computers cause the one or more computers to perform operations comprising:
obtaining information describing network traffic between a plurality of network devices within a network;
determining, based on the information describing network traffic, a network topology of the network, the network topology comprising a plurality of nodes each connected to one or more of the plurality of nodes, wherein each node is associated with one or more network devices, and wherein the network topology is associated with indications of user access rights of a plurality of user accounts to respective nodes included in the network topology;
determining, for each of the plurality of user accounts, a risk associated with the user account being compromised with respect to the network, the risk being based on:
user access rights of the user account to nodes included in the network topology, and
information informing vulnerability of the user account being compromised; and

generating user interface data describing the risks associated with the user accounts, the user interface data including indications of user accounts organized according to respective risk.

9. The system of claim 8 , wherein an indication of user access rights of a particular user account to a particular node comprises one or more of:
information indicating that a user associated with the particular user account is permitted access to a space that includes at least one network device associated with the particular node,
information indicating that the particular user account can provide information to, or receive information from, at least one network device associated with the particular node, or
information indicating that the particular user account is permitted to access, or has actually attempted to access, at least one network device associated with the particular node.

10. The system of claim 8 , wherein information informing vulnerability of a particular user account being compromised comprises one or more of a complexity of a password associated with the particular user account, a location from which a user associated with the particular user account logs in, a length of time the user has been associated with the network, or information associated with an importance of the particular user account.

11. The system of claim 8 , wherein the operations further comprise:
determining, for each of the plurality of nodes, a risk associated with the node being compromised, wherein the risk associated with each user account being compromised is based, at least in part, on risks associated with nodes that are associated with user access rights of the user account.

12. The system of claim 11 , wherein the operations further comprise:
receiving information identifying nodes indicated as being important, wherein the risk associated with each user account is based, at least in part, on user access rights of the user account that are associated with the indicated nodes.

13. The system of claim 8 , wherein a generated user interface is configured to receive a selection of a user account, and wherein upon receiving a selection of a particular user account the generated user interface is configured to present the network topology with particular nodes that are associated with user access rights of the particular user account being shaded or colored.

14. Non-transitory computer storage media storing instructions that when executed by a system of one or more computers cause the one or more computers to perform operations comprising:
obtaining information describing network traffic between a plurality of network devices within a network;
determining, based on the information describing network tra

Assignees

• Palantir Technologies Inc

Inventors

• Seiver Miles
• Rosenblum Charles

Classifications

• H04L63/101

  Access control lists [ACL] · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L43/0876

  Network utilisation, e.g. volume of load or congestion level · CPC title

• H04L41/12

  Discovery or management of network topologies · CPC title