Predicting attacks based on probabilistic game-theory

Abstract

Systems for determining cyber-attack target include a network monitor module configured to collect network event information from sensors in one or more network nodes; a processor configured to extract information regarding an attacker from the network event information, to form an attack scenario tree that encodes network topology and vulnerability information including a plurality of paths from known compromised nodes to a set of potential targets, to calculate a likelihood for each of the paths, to calculate a probability distribution for the set of potential targets to determine which potential targets are most likely pursued by the attacker, to calculate a probability distribution over a set of nodes and node vulnerability types already accessed by the attacker, and to determine a network graph edge to remove that minimizes a defender's expected uncertainty over the potential targets; and a network management module configured to remove the determined network graph edge.

Description

RELATED APPLICATION INFORMATION[0001]This application is a Continuation application of pending U.S. patent application Ser. No. 13 / 478,290 filed on May 23, 2012, incorporated herein by reference in its entirety.BACKGROUND[0002]1. Technical Field[0003]The present invention relates to computer security and, more particularly, to modeling instances and targets for in-progress attacks using probabilistic game theory.[0004]2. Description of the Related Art[0005]A large increase in the frequency of cybersecurity attacks has prompted industry and academia to find new ways to respond to the threat. Defensive mechanisms have been proposed in an attempt to detect and prevent attackers from reaching their targets, e.g., servers that store high-value data. In practice, large networks can have hundreds of high-value servers, each one a possible target of attack, thus making it difficult to determine the goal of a targeted attacker and to respond appropriately.[0006]In an enterprise network, whic...

AI Technical Summary

Benefits of technology

The patent describes a method for identifying cyber-attack targets by collecting network information from sensors and using that information to create a tree-based model of the attacker's likely targets. The system calculates the likelihood of the attacker reaching each potential target and removes any edges in the network that would increase the defender's uncertainty over the potential targets. This method helps to improve the accuracy and effectiveness of identifying and protecting against cyber-attack targets.

Problems solved by technology

In practice, large networks can have hundreds of high-value servers, each one a possible target of attack, thus making it difficult to determine the goal of a targeted attacker and to respond appropriately.

At present, however, detection and response systems do not provide adequate insight to system operators as to how best to respond to a strategic attacker.

In real-life networks, targets are numerous and easily reachable, making existing approaches that assume a small target set impractical to use.

Images