Techniques for determining network security

• US 20060021046A1
• Filed: 07/22/2004
• Published: 01/26/2006
• Est. Priority Date: 07/22/2004
• Status: Abandoned Application

• Current Assignee: Black Dragon Software
• Original Assignee: Black Dragon Software
• Inventors: Cook, Chad L.
• Application Number:
  US10/896,628
• Publication Number:
  US 20060021046A1
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

The invention features a method and related computer program product and apparatus for assessing the security of a computer network.

Claims

1. A modular system architecture comprising:

an analysis unit configured to;

receive information related to a computer network;

generate at least one attack tree based on the information; and

generate at least one time-to-defeat algorithm based on the information;

a simulation engine unit configured to;

calculate from the time-to-defeat algorithm time-to-defeat values for the network; and

an output processing unit configured to output the time-to-defeat values.

2. The modular system architecture of claim 1 further comprising an input translation layer.

4. The modular system architecture of claim 1 further comprising a metric pathway layer.

5. The modular system architecture of claim 4 wherein the metric pathway layer is configured to process the time-to-defeat values.

6. The modular system architecture of claim 4 wherein the metric pathway layer is configured to generate cost values based on the time-to-defeat values.

7. The modular system architecture of claim 4 wherein the metric pathway layer is configured to generate an exposure indication based on the time-to-defeat values.

8. The modular system architecture of claim 4 wherein the metric pathway layer is configured to generate an asset assessment based on the time-to-defeat values.

9. The modular system architecture of claim 4 wherein the metric pathway layer is configured to generate a service level agreement based on the time-to-defeat values.

10. The modular system architecture of claim 1 wherein the analysis engine layer is configured to include an attack database.

3. The modular system architecture of claim 3 wherein input translation layer is configured to:

receive input from a plurality of sources, and

translate the received input into a common format.

11. A computer program product, tangibly embodied in an information carrier, for executing instructions on a processor, the computer program product being operable to cause a machine to:

receive information related to a computer network;

generate at least one attack tree based on the information;

generate at least one time-to-defeat algorithm based on the information;

calculate from the time-to-defeat algorithm time-to-defeat values for the computer network; and

output the time-to-defeat values.

12. The computer program product of claim 11 further comprising instructions to cause a machine to:

receive input from a plurality of sources, and

translate the received input into a common format.

13. The computer program product of claim 11 further comprising instructions to cause a machine to process the time-to-defeat values.

14. The computer program product of claim 11 further comprising instructions to cause a machine to generate cost values based on the time-to-defeat values.

15. The computer program product of claim 11 further comprising instructions to cause a machine to generate at least one of an exposure indication, an asset assessment, a service level agreement, and cost values based on the time-to-defeat values.

16. A method comprising:

receiving information related to a network;

generating at least one attack tree based on the information;

generating at least one time-to-defeat algorithm based on the information;

calculating from the time-to-defeat algorithm time-to-defeat values for the network; and

outputting the time-to-defeat values.

17. The method of claim 16 further comprising:

receiving input from a plurality of sources, and

translating the received input into a common format.

18. The method of claim 16 further comprising processing the time-to-defeat values.

19. The method of claim 16 further comprising generating cost values based on the time-to-defeat values.

20. The method of claim 16 further comprising generating at least one of an exposure indication, an asset assessment, a service level agreement, and cost values based on the time-to-defeat values.