Systems and methods for implementing and scoring computer network defense exercises

• US 8,250,654 B1
• Filed: 06/26/2009
• Issued: 08/21/2012
• Est. Priority Date: 01/27/2005
• Status: Active Grant

• Current Assignee: Leidos, Inc. (Leidos Holdings, Inc.)
• Original Assignee: Science Applications International Corporation
• Inventors: Kennedy, Scott Cruickshanks, Ayers, Carleton Royse II, Godinez, Javier, Banks, Susan Fichera, Spencer, Myoki Elizabeth
• Primary Examiner(s): BROWN, CHRISTOPHER J
• Application Number:
  US12/492,242
• Time in Patent Office: 1,152 Days
• Field of Search: 726/22, 726/24, 726/25, 713/187, 713/188
• US Class Current: 726/22
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

A process for facilitating a client system defense training exercise implemented over a client-server architecture includes designated modules and hardware for protocol version identification message; registration; profiling; health reporting; vulnerability status messaging; storage; access and scoring. More particularly, the server identifies a rule-based vulnerability profile to the client and scores client responses in accordance with established scoring rules for various defensive and offensive asset training scenarios.

Claims

1. A process for facilitating a client system defense training exercise implemented over a client-server architecture comprising:

sending a protocol version identification message by a client system including at least one computer to a first server for determining a the protocol version common to both the client computer and the first server;

sending a registration request message by the client system to a first server for registering the client computer with the first server;

sending a system identification message by the client system to a first server for tracking the client identity;

sending a profile message by the first server to the client system in response to successful registration by the client system, the profile message including a list of vulnerabilities with associated vulnerability identifiers (IDs) that the client is to monitor;

sending a health message by the client system to the first server at predetermined intervals, the health message including information regarding at least one of client system CPU, memory, hard disk, network and interfaces;

sending a vulnerability fixed message by the client system to the first server each time one of the vulnerabilities on the list of vulnerabilities has been fixed, the vulnerability fixed messages including the associated vulnerability ID for each fixed vulnerability;

sending a list vulnerabilities message by the first server to the client system, requesting a listing of all current client system vulnerabilities by associated vulnerability ID;

sending a list of current vulnerabilities message by the client system to the first server in response to the list vulnerabilities message from the first server;

storing details from the profile message, one or more health messages, one or more vulnerability fixed messages and one or more list of current vulnerabilities messages in at least one database associated with the first server;

accessing the details stored in the at least one database by a second server;

applying a set of scoring rules to the accessed details by the second server to determine an objective score for a client system administrator that is indicative of the client system administrator'"'"'s ability to defend the client system against vulnerabilities.

2. The process according to claim 1, wherein the registration request message includes one or more of the following client name, client network information, operating system information, processor information.

3. The process according to claim 1, further comprising:

changing the predetermined interval at which the client computer sends a health message by sending a throttle message by the server to the client computer indicating a new predetermined interval.

4. The process according to claim 1, wherein the CPU information includes percentage of CPU used, the memory information includes percent of memory used, the interface information includes upload and download usage data.

5. The process according to claim 1, further comprising:

sending a boot message by the client system to the server indicating when the client is shutting down, rebooting or starting up.

6. The process according to claim 1, further comprising:

sending a firewall message by the client system to the server indicating client system firewall changes including firewall up, firewall down or no firewall.

7. The process according to claim 1, further comprising:

sending a services message by the client system to the server indicating when a client service is manually stopped, started or restarted.

8. The process according to claim 1, further comprising:

sending a request for vulnerabilities status message by the server to the client system.

9. The process according to claim 8, further comprising:

sending a vulnerability status message from the client system to the server in response to the request for vulnerabilities status message, the vulnerability status message containing status for all vulnerabilities on the list of vulnerabilities, fixed and unfixed.

10. A process for scoring a client system defense training exercise implemented over a client-server architecture comprising:

sending a profile message by a first server to a client system including at least one computer, the profile message including a list of client system vulnerabilities with associated vulnerability identifiers (IDs);

performing at least one of the following by an administrator of the client system;

identifying client system vulnerabilities;

exploiting client system vulnerabilities;

fixing exploited client system vulnerabilities;

generating a vulnerability fixed message by the administrator and sending to the first server each time one of the vulnerabilities on the list of vulnerabilities has been fixed, the vulnerability fixed messages including the associated vulnerability ID for each fixed vulnerability;

sending a list vulnerabilities message by the first server to the client system, requesting a listing of all current client system vulnerabilities by associated vulnerability ID;

sending a list of current vulnerabilities message by the client system to the first server in response to the list vulnerabilities message from the first server;

storing details from the profile message, one or more vulnerability fixed messages, and one or more list of current vulnerabilities messages in at least one database associated with the first server;

accessing the details stored in the at least one database by a second server; and

applying a set of scoring rules to the accessed details by the second server to determine an objective score for the administrator that is indicative of the administrator'"'"'s ability to identify, exploit or fix client system vulnerabilities.