Assessing Threat to at Least One Computer Network

• US 20120096558A1
• Filed: 05/19/2010
• Published: 04/19/2012
• Est. Priority Date: 05/27/2009
• Status: Active Grant

• Current Assignee: Quantar Solutions Limited
• Original Assignee: Quantar Solutions Limited
• Inventors: Evrard, Phillipe
• Granted Patent: US 9,363,279 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Apparatus configured to determine predicted threat activity based on stochastic modelling of threat events capable of affecting at least one computer network in which a plurality of systems operate.

Claims

1. Apparatus configured to determine predicted threat activity based on stochastic modelling of threat events capable of affecting at least one computer network in which a plurality of systems operate.

2. Apparatus according to claim 1, wherein the apparatus is further configured to determine expected downtime of each of said systems in dependence upon said predicted threat activity and to determine loss for each of a plurality of operational processes dependent on the downtimes of each of said systems and to add losses for said plurality of processes so as to obtain a combined loss arising from the threat activity.

3. Apparatus according to claim 1, wherein the apparatus is configured to model a set of threat events so as to obtain at least one model parameter.

4. Apparatus according to claim 3, wherein the apparatus is configured to model the set of threat events using regression.

5. Apparatus according to claim 4, wherein the apparatus is configured to model the set of threat events using weighted regression.

6. Apparatus according to claim 5, wherein the apparatus is configured to model the set of threat events using linear regression.

7. Apparatus according to claim 6, wherein the apparatus is configured to model the set of threat events using exponential regression.

8. Apparatus according to claim 7, wherein the apparatus is configured to model the set of threat events using at least two different models and to obtain at least two different sets of model parameters.

9. Apparatus according to claim 8, wherein the apparatus is the at least one model parameter includes at least one parameter indicating goodness of fit of the model.

10. Apparatus according to claim 9, further comprising a user interface which is configured to present at least one model parameter to a user.

11. Apparatus according to claim 10, wherein the apparatus is configured to predict threat events using at least one model parameter and a stochastic model using said at least one model parameter.

12. Apparatus according to claim 11, wherein the apparatus is configured to randomly draw at least one variable according to a predefined distribution and to use said at least one variable in the stochastic model.

13. Apparatus according to claim 12, wherein the apparatus is configured to predict a distribution of threat events by repeating a simulation.

14. Apparatus according to a claim 13, wherein the apparatus is configured to allow for parameter uncertainty.

15. Apparatus according to claim 14, further comprising a user interface which is configured to present an outcome of stochastic modelling to a user.

16. Apparatus according to claim 15, wherein the apparatus is configured to determine said predicted threat activity using a Monte Carlo method.

17. Apparatus according to claim 16, wherein the apparatus is configured to store at least one of the losses and the combined loss in a storage device.

18. Apparatus according to claim 17, wherein the apparatus is configured to display at least one of the losses and the combined loss on a display device.

19. Apparatus according to claim 18, wherein the apparatus is configured to retrieve a list of observed threats and to determine the predicted threat activity based upon the list of observed threats.

20. Apparatus according to claim 19, wherein the observed list of threats includes, for each threat, information identifying at least one system.

21. Apparatus according to claim 20, wherein the observed list of threats includes, for each threat, information identifying frequency of occurrence of the threat.

22. Apparatus according to claim 21, wherein the frequency of occurrence of the threat includes at least one period of time and corresponding frequency of occurrence for the at least one period of time.

23. Apparatus according to claim 22, wherein the plurality of systems include a plurality of software systems.

24. Apparatus according to claim 1, comprising:

at least one computer system,

wherein the or each computer system comprises at least one processor and memory.

25. Apparatus according to claim 24, wherein loss is value at risk.

26. Apparatus according to claim 25, comprising at least two modules including a first module configured to determine the predicted threat activity and to output the predicted threat activity to a second module.

27. A method comprising:

determining predicted threat activity based on stochastic modelling of threat events capable of affecting at least one computer network in which a plurality of systems operate.

28. A method according to claim 27, further comprising:

determining expected downtime of each system in dependence upon said predicted threat activity;

determining loss for each of a plurality of operational processes dependent on the downtimes of the systems;

adding losses for the plurality of processes to obtain a combined loss arising from the threat activity.

29. A method according to claim 28, wherein the determining of predicted threat activity based on stochastic modelling of threat events comprises:

modelling a set of threat events so as to obtain at least one model parameter.

30. A method according to claim 29, wherein the determining of predicted threat activity based on stochastic modelling of threat events includes:

predicting threat events using at least one model parameter and a stochastic model using said at least one model parameter.

31. A computer readable medium having a computer program thereon, which when executed by a computer system, causes the computer system to perform a method according to claim 30.

32. (canceled)