Systems for network risk assessment including processing of user access rights associated with a network of devices

Patent metadata

Field	Value
Publication number	US-9985983-B2
Application number	US-201715481842-A
Country	US
Kind code	B2
Filing date	Apr 7, 2017
Priority date	Dec 29, 2014
Publication date	May 29, 2018
Grant date	May 29, 2018

Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for network risk assessment. One of the methods includes obtaining information describing network traffic between a plurality of network devices within a network. A network topology of the network is determined based on the information describing network traffic, with the network topology including nodes connected by an edge to one or more other nodes, and with each node being associated with one or more network devices. Indications of user access rights of users are associated to respective nodes included in the network topology. User interface data associated with the network topology is generated.

First claim

What is claimed is:

1. A computerized method comprising:
determining, by a system of one or more computers configured to be in communication with a network comprising a plurality of network devices, a network topology of the network based on information describing network traffic, the network topology comprising a plurality of nodes each connected by an edge to one or more of the plurality of nodes, and each node being associated with one or more network devices;
determining, by the system and for each node, respective compromise risks of network devices associated with the node;
providing, by the system and for presentation in a user interface, visual representations of the plurality of nodes and associated compromise risks, wherein the visual representations are colored according to associated compromise risks, and wherein the colors are selected according to user specified thresholds of values of comprises risks; and
receiving, by the system, user selection of a visual representation of a node, and updating the user interface to present detailed information describing the compromise risks associated with the selected node.

2. The computerized method of claim 1 , wherein determining the compromise risk for a particular network device is based on aggregated Common Vulnerability Scoring System (CVSS) values associated with the particular network device.

3. The computerized method of claim 1 , wherein determining the compromise risk for a particular network device is based on a highest Common Vulnerability Scoring System (CVSS) value associated with the particular network device.

4. The computerized method of claim 1 , wherein each node of the network topology is associated with one or more network devices belonging to a same subnet.

5. The computerized method of claim 1 , wherein a determined compromise risk for a particular network device is based on information indicating exploitability of the particular network device and information indicating value associated with the particular network device.

6. The computerized method of claim 1 , wherein a determined compromise risk associated with a node is based on a highest compromise risk of a network device associated with the node.

7. The computerized method of 1 , wherein the visual representations comprise circles.

8. A system comprising one or more computer systems and one or more computer storage media storing instructions that when executed by the computer systems cause the computer systems to perform operations comprising:
determining, by the system configured to be in communication with a network comprising a plurality of network devices, a network topology of the network based on information describing network traffic, the network topology comprising a plurality of nodes each connected by an edge to one or more of the plurality of nodes, and each node being associated with one or more network devices;
determining, by the system and for each node, respective compromise risks of network devices associated with the node;
providing, by the system and for presentation in a user interface, visual representations of the plurality of nodes and associated compromise risks, wherein the visual representations are visually differentiated according to associated compromise risks, and wherein the visual differentiations are selected according to user specified thresholds of values of compromise risks; and
receiving, by the system, user selection of a visual representation of a node, and updating the user interface to present detailed information describing the compromise risks associated with the selected node.

9. The system of claim 8 , wherein determining the compromise risk for a particular network device is based on aggregated Common Vulnerability Scoring System (CVSS) values associated with the particular network device.

10. The system of claim 8 , wherein determining the compromise risk for a particular network device is based on a highest Common Vulnerability Scoring System (CVSS) value associated with the particular network device.

11. The system of claim 8 , wherein each node of the network topology is associated with one or more network devices belonging to a same subnet.

12. The system of claim 8 , wherein a determined compromise risk for a particular network device is based on information indicating exploitability of the particular network device and information indicating value associated with the particular network device.

13. The system of claim 8 , wherein a determined compromise risk associated with a node is based on a highest compromise risk of a network device associated with the node.

14. The system of claim 8 , wherein the visual representations comprise circles.

15. Non-transitory computer storage media storing instruction that when executed by a system of one or more computers, cause the one or more computers to perform operations comprising:
determining, by the system configured to be in communication with a network comprising a plurality of network devices, a network topology of the network based on information describing network traffic, the network topology comprising a plurality of nodes each connected by an edge to one or more of the plurality of nodes, and each node being associated with one or more network devices;
determining, by the system and for each node, respective compromise risks of network devices associated with the node;
providing, by the system and for presentation in a user interface, visual representations of the plurality of nodes and associated compromise risks, wherein the visual representations are visually differentiated according to associated compromise risks, and wherein the visual differentiations are selected according to user specified thresholds of values of compromise risks; and
receiving, by the system, user selection of a visual representation of a node, and updating the user interface to present detailed information describing the compromise risks associated with the selected node.

16. The non-transitory computer storage media of claim 15 , wherein determining the compromise risk for a particular network device is based on aggregated Common Vulnerability Scoring System (CVSS) values associated with the particular network device.

17. The non-transitory computer storage media of claim 15 , wherein determining the compromise risk for a particular network device is based on a highest Common Vulnerability Scoring System (CVSS) value associated with the particular network device.

18. The non-transitory computer storage media of claim 15 , wherein each of the network topology node is associated with one or more network devices belonging to a same subnet.

19. The non-transitory computer storage media of claim 15 , wherein a determined compromise risk for a particular network device is based on information indicating exploitability of the particular network device and information indicating value associated with the particular network device.

20. The non-transitory computer storage media of claim 15 , wherein a determined compromise risk associated with a node is based on a highest compromise risk of a network device associated with the node.

Assignees

• Palantir Technologies Inc

Inventors

• Seiver Miles
• Cohen Stephen

Classifications

• H04L41/12

  Discovery or management of network topologies · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L2012/5609

  Topology · CPC title

• H04L63/1466

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• H04W12/08

  Access security · CPC title