System and method for simulating network attacks

• US 8,160,855 B2
• Filed: 06/26/2008
• Issued: 04/17/2012
• Est. Priority Date: 06/26/2008
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: Q1 Labs, Inc. (International Business Machines Corporation)
• Inventors: Ghorbani, Aliakbar, Onut, Iosif Viorel, Stakhanova, Natalia, Bird, William
• Primary Examiner(s): Jacob, Mary C
• Application Number:
  US12/147,429
• Publication Number:
  US 20090326899A1
• Time in Patent Office: 1,391 Days
• Field of Search: 703/6, 703/13, 703/21
• US Class Current: 703/13
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A method of simulating network activities includes building a model of the network, the model including data retrieved over a predetermined period of time. The method further includes running a plurality of queries against the model to determine their impacts on the network.

Claims

1. A method of simulating network activities, comprising:

building a model of a network based on flow data records comprising application layer data representative of application layer data traffic communicated between applications executing on devices in the network, said model comprising nodes and communication arcs between said nodes representative of source and destination nodes identified in the flow data records; and

running a plurality of queries against the model to determine an impact of one or more actions on the network.

2. The method of claim 1, wherein building a model of the network comprises:

building a basic model, said basic model representing each communication link between nodes in the network; and

building an enhanced model representing information inferred about the network.

3. The method of claim 2, wherein building a basic model comprises:

receiving flow data records comprising application layer data extracted from the network, said flow data representing an information exchange between an application executing on a source device and an application executing on a destination device;

for each flow data record creating a source node representing the source device and a destination node representing the destination device;

creating an arc representing a communication flow between the application executing on the source node and the application executing on the destination node;

storing statistical data describing the communication flow between application executing on the source device and application executing on the destination device in the corresponding nodes and arcs.

4. The method of claim 3, wherein the statistical data is based on number of flows between hosts, number of hosts, and probabilities associated with host behavior, and combinations thereof.

5. The method of claim 3, wherein the statistical data comprises packets in, packets out, bytes in, bytes out, available protocols, open ports, node probability, and combinations thereof.

6. The method of claim 2, wherein building a basic model comprises:

building a flow topology representing a topological view of data flow connections which have been observed in the network;

building a connectivity topology view showing connection arcs for connections which have not been observed but can potentially be made; and

building a vulnerability topology representing an impact of a spread of one or more known vulnerabilities through the network.

7. The method of claim 6, wherein building a flow topology further comprises:

for each node, calculating a node probability representing the probability of a host associated with the node being online.

8. The method of claim 6, wherein building a connectivity topology further comprises:

determining whether any phantom connectivity arcs exist between two nodes, the phantom connectivity arc representing a likely path between two nodes that has not been observed; and

determining whether any phantom port arcs exist, the phantom port arc representing a likely communication between the two nodes on an open port that has not been previously observed.

9. The method of claim 2, wherein the enhanced model comprises inferred arcs not present in the data flow records.

10. The method of claim 1, running a plurality of queries comprises:

receiving a query request;

generating a question model representing the received query; and

computing simulation results for the received query based on the question model.

11. The method of claim 1, wherein the data traffic communicated between devices comprises communication port data.

12. The method of claim 1, wherein the communication arcs comprise an application communication from a source node to a destination node over a communication port.