SYSTEM, METHOD AND COMPUTER READABLE MEDIUM FOR EVALUATING POTENTIAL ATTACKS OF WORMS

• US 20080005555A1
• Filed: 07/30/2007
• Published: 01/03/2008
• Est. Priority Date: 10/01/2002
• Status: Active Grant

• Current Assignee: Skybox Security, Inc.
• Original Assignee: Skybox Security, Inc.
• Inventors: Horn, Ilan, Lotem, Amnon, Cohen, Gideon, Meiseles, Moshe
• Granted Patent: US 8,359,650 B2
• Time in Patent Office: Days
• US Class Current: 713/150
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A method for evaluating potential attacks of worms, the method includes: associating, in response to information representative of a network and of worm entities, between worm entities and potential worm sources to provide associated worm sources; determining potential worm attacks that start from the associated worm sources; and evaluating at least one potential worm attack security metric associated with the potential worm attacks.

Claims

1-1. The computer program product according to claim 1, wherein the computer readable program when executed on a computer causes the computer to generate information representative of a worm entity by calculating a profile of a group of potential worms;

wherein a profile of a group of potential worms is less detailed than at least one profile of a known worm.

2-2. The computer program product according to claim 1, wherein the computer readable program when executed on a computer causes the computer to generate information representative of potential worms capable of exploiting already published vulnerabilities based upon vulnerability attributes.

3-3. The computer program product according to claim 1, wherein the computer readable program when executed on a computer causes the computer to generate information representative of potential worms capable of exploiting vulnerabilities that are not published.

4-4. The computer program product according to claim 1, wherein the computer readable program when executed on a computer causes the computer to generate information representative of potential worms capable of exploiting vulnerabilities that are not published based upon service attributes.

18. A method for evaluating potential attacks of worms, the method comprising:

associating, in response to information representative of a network and of worm entities, between worm entities and potential worm sources to provide associated worm sources;

determining potential worm attacks that start from the associated worm sources; and

evaluating at least one potential worm attack security metric associated with the potential worm attacks.

19. The method according to claim 18 further comprising generating information representative of a worm entity by calculating a profile of a group of potential worms;

wherein a profile of a group of potential worms is less detailed than at least one profile of a known worm.

20. The method according to claim 18 further comprising identifying security weaknesses in response to the at least one potential worm attack security metric.

21. The method according to claim 20 further comprising prioritizing the identified security weaknesses.

22. The method according to claim 18 wherein the determining of potential worm attacks comprises evaluating a propagation of worm entities through network nodes while using vulnerabilities of these network nodes and evaluating possible infection of target nodes coupled to network nodes through which the worm propagates.

23. The method according to claim 18 wherein a worm source is coupled via multiple intermediate nodes to a target node;

wherein the evaluating is responsive to;

(i) a likelihood of an existence of a worm entity, (ii) a likelihood of a worm source to be infected by a worm entity, (iii) a likelihood of each of the intermediates node to be attacked by a previous node the worm source and be infected by the worm entity, (iv) a likelihood of the target node to be attacked by the intermediate node and be infected by the worm entity.

24. A system for evaluating potential attacks of worms, the system includes:

a memory unit adapted to store information representative of a network and of worm entities; and

a processor adapted to;

associate, in response to the information representative of a network and of worm entities, between worm entities and potential worm sources to provide associated worm sources;

determine potential worm attacks that start from the associated worm entities; and

evaluate at least one potential worm attack security metric associated with the potential worm attacks.

25. The system according to claim 24 wherein the processor is adapted to generate information representative of a worm entity by calculating a profile of a group of potential worms;

wherein a profile of a group of potential worms is less detailed than at least one profile of a known worm.

26. The system according to claim 24 wherein the processor is adapted to identify security weaknesses in response to the at least one potential worm attack security metric.

27. The system according to claim 26 wherein the processor is adapted to prioritize the identified security weaknesses.

28. The system according to claim 24 wherein the processor is adapted to determine of potential worm attacks comprises evaluating a propagation of worm entities through network nodes while using vulnerabilities of these network nodes and evaluating possible infection of target nodes coupled to network nodes through which the worm propagates.

29. The system according to claim 24 wherein a worm source is coupled via multiple intermediate nodes to a target node;

wherein the processor is adapted to evaluate in response to;

(i) a likelihood of an existence of a worm entity, (ii) a likelihood of a worm source to be infected by a worm entity, (iii) a likelihood of each of the intermediates node to be attacked by a previous node the worm source and be infected by the worm entity, (iv) a likelihood of the target node to be attacked by the intermediate node and be infected by the worm entity.