SYSTEM AND METHOD FOR SIMULATING NETWORK ATTACKS

• US 20090326899A1
• Filed: 06/26/2008
• Published: 12/31/2009
• Est. Priority Date: 06/26/2008
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: Q1 Labs, Inc. (International Business Machines Corporation)
• Inventors: Bird, William, Onut, Iosif Viorel, Ghorbani, Aliakbar, Stakhanova, Natalia
• Granted Patent: US 8,160,855 B2
• Time in Patent Office: Days
• US Class Current: 703/13
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A method of simulating network activities includes building a model of the network, the model including data retrieved over a predetermined period of time. The method further includes running a plurality of queries against the model to determine their impacts on the network.

Claims

1. A method of simulating network activities, comprising:

building a model of the network, said model including data retrieved over a predetermined period of time; and

running a plurality of queries against the model to determine the impact of one or more actions on the network.

2. The method of claim 1, wherein building a model of the network comprises:

building a basic model, said basic model representing each communication link between nodes in the network; and

building an enhanced model representing information inferred about the network.

3. The method of claim 2, wherein building a basic model comprises:

receiving flow data records extracted from the network, said flow data representing an information exchange between a source device and a destination device;

for each flow data record creating a node representing the source device and a node representing the destination device;

creating an arc representing the communication flow between the source node and the destination node; and

storing statistical data describing the observed communication flow between the source device and the destination device in the corresponding nodes and arcs.

4. The method of claim 2, wherein building an enhanced model comprises:

building a flow topology representing the topological view of data flow connections which have been observed in the network;

building a connectivity topology representing connections which have not been observed but can potentially be made; and

building a vulnerability topology representing the impact of the spread of one or more known vulnerabilities through the network.

5. The method of claim 1, running one or more queries comprises:

receiving a query request;

generating a question model representing the received query; and

computing a simulation results for the received query based on the question model.

6. The method of claim 5, wherein generating a flow topology further comprises:

for each node, calculating a node probability representing the probability of a host associated with the node being online.

7. The method of claim 5, wherein generating a connectivity topology further comprises:

determining whether any phantom connectivity arcs exist between two nodes, the phantom connectivity arc representing a likely path between two nodes that has not been observed; and

determining whether any phantom port arcs exist, the phantom port arc representing a likely communication between the two nodes on an open port that has not been previously observed.