System and Method for Cyber Security Analysis and Human Behavior Prediction

• US 20160205122A1
• Filed: 03/21/2016
• Published: 07/14/2016
• Est. Priority Date: 04/10/2013
• Status: Active Grant

• Current Assignee: Gabriel Bassett
• Original Assignee: Gabriel Bassett
• Inventors: Bassett, Gabriel
• Granted Patent: US 10,425,429 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

An improved method for analyzing computer network security has been developed. The method first establishes multiple nodes, where each node represents an actor, an event, a condition, or an attribute related to the network security. Next, an estimate is created for each node that reflects the ease of realizing the event, condition, or attribute of the node. Attack paths are identified that represent a linkage of nodes that reach a condition of compromise of network security. Next, edge probabilities are calculated for the attack paths. The edge probabilities are based on the estimates for each node along the attack path. Next, an attack graph is generated that identifies the easiest conditions of compromise of network security and the attack paths to achieving those conditions. Finally, attacks are detected with physical sensors on the network, that predict the events and conditions. When an attack is detected, security alerts are generated in response to the attacks.

Claims

1. A method for analyzing computer network security, comprising:

establishing multiple nodes, where each node represents an actor, an event, a condition, or an attribute related to the network security;

creating an estimate for each node that estimates the ease of realizing the event, condition, or attribute of the node;

identifying attack paths based on attack vectors that may be used by actor, where the attack paths represent a linkage of nodes that reach a condition of compromise of network security;

calculating edge probabilities for the attack paths based on the estimates for each node along the attack path, where the node estimates and edge probabilities are determined by calculating a probability of likelihood for the nodes based on Markov Monte Carlo simulations of paths from an attacker to the nodes;

generating an attack graph that identifies the easiest conditions of compromise of network security and the attack paths to achieving those conditions of compromise based on combined estimates of the ease of the attack paths and the application of actor attributes;

where events and conditions on the attack graph are connected to observable nodes associated with physical sensors on the network, where the physical sensors predict the events and conditions;

detecting attacks on the computer network through a correlation of the observable nodes with the physical sensors;

where security alerts are generated in response to detected attacks;

where benign actors are modeled in addition to threat actors, generating a benign action graph and associated benign paths; and

where the benign paths are compared to an attack graph and associated attack paths to generate alerts by differential analysis of benign v. threat actor scores.

2. The method of claim 1, where the attack graph is used to identify which sensors would generate security alerts related to one or more attack paths in which the sensor events associated with one or more attack paths are simulated to train security staff.

3. The method of claim 1, where the actors, events, conditions, and attributes are not network security related and, instead, represent predictions of the behavior of the actor.

4. The method of claim 1, where the attack graph or subsets thereof are shared among organizations, using a graph exchange format.

5. The method of claim 1, in which the generated attack graph is used to automate penetration testing by allowing a computer system conducting the testing to progress between events and conditions.