Threat modeling tool using machine learning

• US 10,523,695 B2
• Filed: 07/24/2017
• Issued: 12/31/2019
• Est. Priority Date: 07/24/2017
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP SE
• Inventors: Fach, Peter, El Khoury, Paul
• Primary Examiner(s): King, John B
• Application Number:
  US15/657,782
• Publication Number:
  US 20190028498A1
• Time in Patent Office: 890 Days
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 20/20 Ensemble learning
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Data is received that characterizes a software system. Thereafter, a threat model is generated, using at least one machine learning model, that optimally characterizes cybersecurity threats associated with the software system and provides security measures to counter such threats. The at least one machine learning model is trained using a plurality of historically generated threat models for a plurality of differing software systems. Subsequently, data can be provided that includes or otherwise characterizes the generated threat model.

Claims

1. A method for implementation by at least one computing device comprising:

receiving data comprising actor/dependency information characterizing a software system;

decomposing the software system to define data flow diagrams characterizing interactions of the software system with external entities and networks;

generating a target architecture model (TAM) diagram based on the decomposed software system;

rendering the TAM diagram in a graphical user interface;

receiving-user generated input, via the graphical user interface, modifying the TAM diagram to include additional elements;

identifying, using the at least one machine model, a use case for the modified TAM diagram;

displaying proposed security schemes to add to the threat model based on the identified use case;

generating, by at least one machine learning model using the modified TAM diagram, a threat model that optimally characterizes cybersecurity threats associated with the software system and provides suggestions for security measures to counter such threats prior to deployment of the software system, the at least one machine learning model being trained using a plurality of historically generated threat models for a plurality of differing software systems; and

providing data comprising the generated threat model.

2. The method of claim 1, wherein a first machine learning model of the at least one machine learning model classifies the TAM diagram by actor/dependency pairs.

3. The method of claim 2, wherein a second machine learning model of the at least one machine learning model matches the received data to an optimal use case.

4. The method of claim 1, wherein the at least one machine learning model utilizes random forest for identifying an optimal threat model template and generating the threat model.

5. The method of claim 1, wherein the providing data comprises at least one of:

causing the data comprising the generated threat model to be displayed in an electronic visual display, transmitting the data comprising the generated threat model to a remote computing system, loading the data comprising the generated threat model into memory, or storing the data comprising the generated threat model into physical persistence.

6. The method of claim 1, wherein generating the target architecture model (TAM) diagram comprises reusing a previously generated TAM diagram.

7. The method of claim 1, wherein generating the target architecture model (TAM) diagram comprises generating a plurality of target TAM diagrams for different aspects of the software system.

8. A system comprising:

at least one data processor; and

memory storing instructions which, when executed by the at least one data processor, result in operations comprising;

receiving data comprising actor/dependency information characterizing a software system;

decomposing the software system to define data flow diagrams characterizing interactions of the software system with external entities and networks;

generating a target architecture model (TAM) diagram based on the decomposed software system;

rendering the TAM diagram in a graphical user interface;

receiving-user generated input, via the graphical user interface, modifying the TAM diagram to include additional elements;

identifying, using the at least one machine model, a use case for the modified TAM diagram;

displaying proposed security schemes to add to the threat model based on the identified use case;

generating, by at least one machine learning model using the modified TAM diagram, a threat model that optimally characterizes cybersecurity threats associated with the software system and provides suggestions for security measures to counter such threats prior to deployment of the software system, the at least one machine learning model being trained using a plurality of historically generated threat models for a plurality of differing software systems; and

providing data comprising the generated threat model.

9. The system of claim 8, wherein a first machine learning model of the at least one machine learning model classifies the TAM diagram by actor/dependency pairs.

10. The system of claim 9, wherein a second machine learning model of the at least one machine learning model matches the received data to an optimal use case.

11. The system of claim 8, wherein the at least one machine learning model utilizes random forest for identifying an optimal threat model template and generating the threat model.

12. The system of claim 8, wherein the providing data comprises at least one of:

causing the data comprising the generated threat model to be displayed in an electronic visual display, transmitting the data comprising the generated threat model to a remote computing system, loading the data comprising the generated threat model into memory, or storing the data comprising the generated threat model into physical persistence.

13. The system of claim 8, wherein generating the target architecture model (TAM) diagram comprises reusing a previously generated TAM diagram.

14. The system of claim 8, wherein generating the target architecture model (TAM) diagram comprises generating a plurality of target TAM diagrams for different aspects of the software system.

15. A non-transitory computer program product storing instructions which, when executed by at least one data processor forming part of at least one computing device, result in operations comprising:

receiving data comprising actor/dependency information characterizing a software system;

decomposing the software system to define data flow diagrams characterizing interactions of the software system with external entities and networks;

generating a target architecture model (TAM) diagram based on the decomposed software system;

rendering the TAM diagram in a graphical user interface;

receiving-user generated input, via the graphical user interface, modifying the TAM diagram to include additional elements; and

identifying, using the at least one machine model, a use case for the modified TAM diagram;

displaying proposed security schemes to add to the threat model based on the identified use case;

generating, by at least one machine learning model using the modified TAM diagram, a threat model that optimally characterizes cybersecurity threats associated with the software system and provides suggestions for security measures to counter such threats prior to deployment of the software system, the at least one machine learning model being trained using a plurality of historically generated threat models for a plurality of differing software systems; and

providing data comprising the generated threat model.

16. The computer program product of claim 15, wherein a first machine learning model of the at least one machine learning model classifies the TAM diagram by actor/dependency pairs.

17. The computer program product of claim 16, wherein a second machine learning model of the at least one machine learning model matches the received data to an optimal use case.

18. The computer program product of claim 15, wherein the at least one machine learning model utilizes random forest for identifying an optimal threat model template and generating the threat model.

19. The computer program product of claim 15, wherein the providing data comprises at least one of:

causing the data comprising the generated threat model to be displayed in an electronic visual display, transmitting the data comprising the generated threat model to a remote computing system, loading the data comprising the generated threat model into memory, or storing the data comprising the generated threat model into physical persistence.

20. The computer program product of claim 15, wherein generating the target architecture model (TAM) diagram comprises generating a plurality of target TAM diagrams for different aspects of the software system.