Network security modeling system and method

• US 20080222731A1
• Filed: 10/23/2007
• Published: 09/11/2008
• Est. Priority Date: 01/14/2000
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: Secure Computing Corporation (McAfee, LLC)
• Inventors: Foote-Lennox, Tomo, Markham, Thomas R., Lu, Raymond, Dowd, Alan, Apostal, David
• Granted Patent: US 7,996,201 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 41/147 for predicting network behaviour
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A network security modeling system which simulates a network and analyzes security vulnerabilities of the network. The system includes a simulator which includes a network vulnerabilities database and a network configuration module having network configuration data. The simulator determines vulnerabilities of the simulated network based on the network configuration data and the vulnerabilities database.

Claims

1. A network security modeling system comprising:

a network configuration module having network configuration data;

a simulator coupled to the network configuration module to simulate and analyze networks based on the network configuration data, wherein the simulator includes a network vulnerabilities database, and wherein the network vulnerabilities database includes;

a plurality of known network vulnerabilities, wherein each network vulnerability includes a service to which it applies, defense conditions that might close the vulnerability, and resource and state conditions needed to exercise the vulnerability.

2. The system of claim 1, wherein the network vulnerabilities database includes network vulnerability, attack and exploitation data.

3. The system of claim 2, wherein the simulator includes a means for receiving the network vulnerability, attack and exploitation data.

4. The system of claim 1, wherein the simulator includes a defender and an attacker user interface.

5. A network security modeling system comprising:

a network configuration module having network configuration data;

a simulator coupled to the network configuration module for simulating and analyzing networks based on the network configuration, wherein the simulator includes a network vulnerabilities database; and

a mission objectives module coupled to the simulator, wherein the mission objectives module includes critical resource information used to determine network components that are involved in a specific attack scenario.

6. The system of claim 5, wherein the network vulnerabilities database includes network vulnerability, attack and exploitation data.

7. The system of claim 5, wherein the critical resource information includes goals, expectations and constraints for simulating the network.

8. The system of claim 5, wherein the simulator includes a means for receiving the network vulnerability, attack and exploitation data.

9. The system of claim 5, wherein the simulator includes a defender and an attacker interface.

10. A method of analyzing a computer network using a security modeling system, wherein the security modeling system includes a database of network vulnerability information, the method comprising:

receiving a network configuration of a computer network;

simulating the network based on the network configuration; and

determining vulnerabilities of the simulated network using the vulnerability information stored in the database, wherein the database includes a plurality of known network vulnerabilities, wherein each network vulnerability includes;

a plurality of known network vulnerabilities, wherein each network vulnerability includes a service to which it applies, defense conditions that might close the vulnerability, and resource and state conditions needed to exercise the vulnerability.

11. The method of claim 10, wherein receiving a network configuration includes analyzing the network with a network discovery tool.

12. The method of claim 10, wherein simulating the network includes:

receiving mission objectives;

storing the mission objectives; and

simulating the network based on the network configuration and the mission objectives.

13. The method of claim 12, wherein determining vulnerabilities includes modifying the simulation using a graphical user interface.

14. The method of claim 13, wherein modifying the simulation includes dynamically interacting with an attacker.

15. The method of claim 14, wherein modifying the simulation includes dynamically interacting in real time with the security modeling system.

16. The method of claim 13, wherein modifying the simulation includes dynamically interacting in real time with the security modeling system.

17. The method of claim 12, wherein determining vulnerabilities of the simulated network includes updating the vulnerabilities database when vulnerabilities are detected.

18. A machine-readable medium that provides instructions which, when executed by a machine, cause the machine to perform the method of claim 10.

19. A method of opposing attackers of a computer network, comprising:

receiving a network configuration, wherein the network configuration comprises computer hardware and software component information;

receiving mission objectives including critical resource information used to determine network components that are involved in a specific attack scenario;

receiving commands from a network attacker;

simulating the network based on the commands received from the network attacker, wherein simulating the network includes determining results as a function of the network configuration, mission objectives and stored vulnerability data for the described computer hardware and software components; and

responding to the network attacker, wherein responding to the attacker includes responses selected from a group of responses including imposing barriers, providing response messages and protecting the network.

20. The method of claim 19, wherein simulating the network further includes receiving commands from a defender and determining results based on the defender commands.

21. The method of claim 19, wherein receiving configuration includes receiving critical resource information, wherein the critical resource information includes goals, expectation and constraints for simulating the network.

22. The method of claim 21, wherein receiving commands includes receiving attack actions which include commands that simulate service functionality, commands that change services or nodes, and commands that exploit vulnerabilities.

23. A network security modeling system for simulating objective networks comprising:

a simulator having a plurality of databases, wherein the plurality of databases include mission objectives tables including information used to determine network components that are involved in a specific attack scenario, vulnerability tables, and network configuration tables, wherein the network configuration tables include network configuration data; and

a graphical user interface which operates with the simulator to allow input and output to clients.

24. The system of claim 23, wherein the mission objectives tables include mission tables, mission files tables and mission services tables.

25. The system of claim 23, wherein the vulnerability tables include service tables.