System and method for risk detection and analysis in a computer network

• US 6,952,779 B1
• Filed: 10/01/2002
• Issued: 10/04/2005
• Est. Priority Date: 10/01/2002
• Status: Expired due to Term

• Current Assignee: Skybox Security, Inc.
• Original Assignee: Eran Reshef, Gideon Cohen, Moshe Meiseles
• Inventors: Reshef, Eran, Cohen, Gideon, Meiseles, Moshe
• Primary Examiner(s): Morse, Gregory
• Assistant Examiner(s): Nalven, Andrew L.
• Application Number:
  US10/262,648
• Time in Patent Office: 1,099 Days
• Field of Search: 713/201, 713/200, 709/225
• US Class Current: 726/22
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

The present invention provides systems and methods for risk detection and analysis in a computer network. Computerized, automated systems and methods can be provided. Raw vulnerability information and network information can be utilized in determining actual vulnerability information associated with network nodes. Methods are provided in which computer networks are modeled, and the models utilized in performing attack simulations and determining risks associated with vulnerabilities. Risks can be evaluated and prioritized, and fix information can be provided.

Claims

1. A method for performing risk assessment in a computer network, the method comprising:

generating a network topology model for the computer network, the network topology model including a set of network nodes, a set of actual vulnerabilities associated with the network nodes, and a set of access rules associated with the network nodes;

determining, among the set of network nodes, one or more start points, by analyzing a set of access control lists and filtering rules from one or more network devices, the set of access control lists and filtering rules collected by a network discovery agent to determine the start points, and one or more end points of one or more potential attack paths through the network topology model;

generating an attack graph comprising a set of graph nodes wherein each graph node represents a state of a single service in the network;

simulating one or more attacks from one or more start points to one or more end points using the attack graph; and

storing the results of the attack simulation in a computer memory.

2. The method of claim 1, wherein the one or more network devices comprise one or more network firewalls.

3. The method of claim 1, wherein the one or more network devices comprise one or more network routers.

4. The method of claim 1, wherein analyzing a set of access control lists and filtering rules comprises concatenating a plurality of network addresses associated with the set of access control lists and filtering rules to calculate a range of inbound and outbound network addresses that represent possible start points for the potential attack paths.

5. The method of claim 1, wherein determining the one or more start points comprises determining the start points according to a user input.

6. The method of claim 1, wherein generating an attack graph comprises generating an attack graph using a moving front-line algorithm.

7. The method of claim 1, the method further comprising associating consequence data with endpoints.

8. The method of claim 4, wherein concatenating a plurality of network addresses associated with the set of access control lists and filtering rules comprises concatenating lists of IP ranges from the set of access control lists and filtering rules.

9. The method of claim 6, wherein generating an attack graph using a moving front-line algorithm comprises:

simulating an attack from a first node in the attack graph;

determining whether a set of constraints associated with at least a second graph node that has not yet been reached by the simulated attack satisfies a set of attack criteria; and

adding an edge connecting the starting point node to the at least a second graph node if the set of constraints satisfies the set of attack criteria.

10. The method of claim 7, wherein the consequence data comprises numerical consequence data.

11. The method of claim 10, wherein the consequence data is calculated at least in part according to the potential damage caused by an attacker reaching an endpoint.

12. The method of claim 11, the method further comprising calculating probability data associated with attacks on endpoints.

13. The method of claim 12, the method further comprising ranking vulnerabilities using at least the consequence data and the probability data.