Exposure management method and exposure management system

Abstract

To provide an exposure management method that achieves greater accuracy and reliability.SOLUTION: The method comprises: requesting and / or receiving a list of vulnerabilities of at least one host in a network and / or a network and / or setting errors to execute an attack path simulation; when an entry attack vector to the host is detected by an attack path simulator, determining and / or creating at least one attack path related to the host, on the basis of vulnerability and / or setting error information; creating an attack path map on the basis of the attack path simulation; verifying each attack path determined in the attack path map by at least one agent in the attack path; and removing, from the attack path map, the attacks and / or paths determined to be prevented by the agent and not to be executable as simulated.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present invention relates to an exposure management system, a server for the exposure management system, and an exposure management method. [Background technology]

[0002] Computer and computer network security and threat detection systems are used to detect threats and anomalies in computers and computer networks. Examples include endpoint protection platforms (EPPs), endpoint detection and response (EDRs), and managed detection and response (MDR) products and services. Endpoint protection platforms (EPPs) are solutions deployed on endpoint devices to prevent file-based malware attacks and detect malicious activity. EDR systems focus on detecting and monitoring breaches as they occur and help determine the best response method for detected breaches. EDR systems also provide the investigation and remediation capabilities needed to respond to dynamic security incidents and alerts. MDRs are managed cybersecurity services that provide threat detection, response, and remediation services.

[0003] Vulnerability management systems have also become widely used in recent years. These systems primarily focus on identifying and addressing vulnerabilities within an organization's IT infrastructure, applications, and systems. Vulnerability management systems can, for example, systematically scan, assess, and prioritize vulnerabilities to identify those that pose the greatest risk to the organization. Based on this information, vulnerability management systems can reduce the attack surface by, for example, patching existing vulnerabilities and proactively identifying and mitigating vulnerabilities before attackers can exploit them. Risk management and assessment can be further enhanced by exposure management systems that not only analyze vulnerabilities but also consider other factors that affect an organization's risk exposure, such as threat trends, business impact, and the effectiveness of security controls.

[0004] One method available in an exposure management system is attack path mapping. Attack path mapping focuses on identifying potential attack vectors and security weaknesses by understanding the potential paths an attacker could use to compromise an organization's systems and data. Attack path mapping involves identifying and analyzing the various entry points, vulnerabilities, and attack vectors that an attacker could exploit to achieve their objectives. The purpose of attack path mapping is to gain insight into an organization's attack surface and identify potential weaknesses and security gaps that an attacker could exploit.

[0005] Compromise simulations can be leveraged in attack path mapping and exposure management products and services. Vulnerabilities can be assessed based on the simulated attack paths, allowing for a determination of which vulnerabilities should be addressed first. The problem is that without deep knowledge of the target network layout (e.g., routing and firewall rules, local user permissions, browser, AWS, and other cloud credentials, API keys, registry configurations, file write permissions, etc.), compromise simulations are often incomplete and may, for example, represent a situation that is much worse than the actual one. This calls for a more accurate and reliable exposure management system. Summary of the Invention

[0006] The following presents a simplified summary in order to provide a basic understanding of some aspects of various embodiments of the invention. This summary is not an exhaustive overview of the invention, and it is not intended to identify key or critical elements of the invention or to delineate the scope of the invention. The following summary presents some concepts of the invention in a simplified form prior to the more detailed description of exemplary embodiments of the invention.

[0007] In a first aspect, the present invention relates to a method, e.g., a computer-implemented method, for exposure management in a network, the network including at least one host (e.g., an endpoint) and / or at least one server, the at least one host having a security agent installed. The method includes requesting and / or receiving a list of vulnerabilities and / or misconfigurations for at least one host in the network and / or a list of vulnerabilities and / or misconfigurations for the network, and performing an attack path simulation, e.g., in a backend system and / or at least one server, for at least one host in the network and / or the network. If an entry attack vector to the host is detected by the attack path simulator, the method further includes determining and / or creating at least one attack path associated with the host based on the vulnerability and / or misconfiguration information. For example, determining and / or creating an attack path for each identified attack path based on the vulnerability and / or misconfiguration information. The method further includes creating an attack path map based on the attack path simulation. For example, creating the attack path map based on the determined and / or created attack paths. The method further includes verifying each determined attack path in the attack path map with at least one agent in the attack path, e.g., the agent verifying whether the attack or portion of the attack is feasible as simulated, and removing from the attack path map any attack and / or path that the agent determines is not feasible as simulated, e.g., prevented by security controls.

[0008] In one embodiment of the present invention, the method includes receiving a list of known vulnerabilities detected by a vulnerability management service.

[0009] In one embodiment of the present invention, the agent verifies which attacks, vulnerability exploits, and / or misconfigurations in the attack path simulation are usable by, for example, a malicious attacker.

[0010] In one embodiment of the present invention, verifying the attack path with at least one agent includes sending instructions to an agent in the host where the next potential step on the attack path resides. In one embodiment of the present invention, a (e.g., unverified) step in the attack path is verified as long as the step in the attack path is usable by a malicious attacker.

[0011] In one embodiment of the present invention, verification of a portion of the attack path continues to the next portion of the attack path as long as the verified steps are usable by a malicious attacker, or until the entire attack path is verified as usable by a malicious attacker (e.g., in which case all steps can be executed as simulated by a malicious attacker).

[0012] In one embodiment of the present invention, a simulated attack path is removed from the attack path map if part of the attack path is not available to a malicious attacker based on verification by at least one agent.

[0013] In one embodiment of the present invention, an attack path is retained in the attack path map if at least one agent verifies that all steps and / or all parts of the attack path are implementable and / or usable by a malicious attacker.

[0014] In one embodiment of the present invention, verifying the steps and / or portions of the attack path includes at least one of the following: verifying whether there is proper network connectivity from the host to the next part of the attack path, verifying whether the prerequisites required for privilege escalation are met, verifying whether the host has credentials accessible to a malicious attacker, verifying whether a user can write or execute files in predefined locations including registers, verifying whether a vulnerable application was run on the host, verifying whether there are vulnerabilities suitable for lateral movement to other hosts, verifying domain-level privilege escalation, and verifying available credentials needed to further escalate the attack on internal servers.

[0015] In an embodiment of the invention, the agent or agents use at least one of the following information when validating the attack path: layout of the target network, routing rules, firewall rules, local user permissions, credentials stored in browsers, cloud credentials, API keys, registry settings, file write permissions, a list of running services listening on external network interfaces, and cryptographic authentication keys, including SSH keys.

[0016] In an embodiment of the present invention, the entry attack vector to the host includes at least remote code execution in a public service, and / or a phishing opportunity due to a user having vulnerable client or player software installed, and / or a client software application (e.g., email client, web browser, instant messaging client, etc.) that the user can click to execute the application. In one embodiment of the present invention, the entry attack vector to the host includes EDR / MDR system information and / or process execution logs that indicate an installed application has been used for phishing.

[0017] In one embodiment of the present invention, a server in the network manages the attack path verification process by instructing each of the agents in the hosts to verify a corresponding portion of the attack path.

[0018] In a second aspect, the present invention relates to a server for network exposure management, the network comprising at least one host including an endpoint and at least one server, the at least one host having a security agent installed thereon. The server is configured to request and / or receive a list of vulnerabilities and / or misconfigurations for at least one host in the network and / or a list of vulnerabilities and / or misconfigurations for the network, and to perform an attack path simulation for at least one host in the network and / or the network. When an entry attack vector for the host is detected by the attack path simulator, the server is configured to determine and / or create at least one attack path associated with the host based on the vulnerability and / or misconfiguration information. For example, the server is configured to determine and / or create an attack path for each identified attack path based on the vulnerability and / or misconfiguration information. The server is further configured to create an attack path map based on the attack path simulation. For example, the server is configured to create the attack path map based on the determined and / or created attack paths. The server is further configured to instruct agents in the attack path to verify whether an attack or part of an attack is feasible as simulated, and based on the information received from the agents, remove from the attack path map attacks and / or paths that are determined by the agents to be prevented, for example by security controls, and therefore not feasible as simulated.

[0019] In a third aspect, the present invention relates to an exposure management system comprising at least one endpoint, the endpoint having a security agent installed thereon, and / or at least one server, wherein the server is a server according to any embodiment of the present invention.

[0020] In one embodiment of the present invention, the exposure management system is configured to implement a method according to any embodiment of the present invention.

[0021] In a fourth aspect, the present invention relates to a computer program comprising instructions which, when executed by a computer, cause the computer to carry out the method according to the invention.

[0022] In a fifth aspect, the present invention relates to a computer-readable recording medium comprising a computer program according to the present invention.

[0023] The solution of the present invention makes it possible to provide reliable and realistic attack path mapping in an exposure management system. Because the solution of the present invention can validate simulation results in a real environment, the (finally validated) attack path map is more reliable and realistic than prior art solutions in which the attack path map is created solely based on simulation. Therefore, by utilizing the solution of the present invention, for example, vulnerability prioritization can be performed more reliably, thereby protecting an organization's assets more quickly and reliably than prior art solutions.

[0024] Various exemplary, non-limiting embodiments of the present invention as to its structure and method of operation, together with additional objects and advantages thereof, can best be understood from the following description of specific, exemplary, non-limiting embodiments when read in conjunction with the accompanying drawings.

[0025] The verbs "to comprise" and "to include" are used in this document as open limitations which do not exclude or require the presence or absence of any unrecited features. Features recited in the dependent claims are mutually freely combinable unless expressly stated otherwise.

[0026] Furthermore, it should be understood that the use of "a" or "an" (singular) in this document does not exclude a plural. [Brief explanation of the drawings]

[0027] Embodiments of the present invention are illustrated by way of example, and not by way of limitation, in the accompanying drawings.

[0028] [Figure 1] FIG. 1 is a schematic diagram illustrating an example of a network architecture according to an embodiment of the present invention. [Figure 2] FIG. 2 is a schematic diagram illustrating an example of a network architecture according to an embodiment of the present invention. [Figure 3] FIG. 3 illustrates an example method according to one embodiment of the present invention. [Figure 4] FIG. 4 is a diagram illustrating an example of a computing device, such as a server, according to one embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0029] The exposure management system or service of the present invention can be configured as part of a threat detection system or as a standalone system. In embodiments of the present invention, the exposure management system or threat detection system can include a host, such as at least one endpoint, and a backend system including at least one backend server. In this case, information, such as data related to threat detection, can be shared between the hosts (e.g., between the endpoints and / or between the endpoints and the backend system).

[0030] An exposure management system or service can be used in conjunction with other threat detection or prevention systems, such as EPP, EDR, and / or MDR systems. Any of these systems can deploy data collectors or processing units, such as agents or sensors, on selected network endpoints, any element of the IT infrastructure. Typically, agents in EPP systems focus on endpoint protection, i.e., data processing, while agents in EDR systems focus on detection, i.e., data collection. Data collectors monitor activity occurring on endpoints and send the collected data to a central backend system, typically located in the cloud. Once received by the backend, the data is processed (e.g., aggregated and / or augmented) before being analyzed and scanned by the security system provider for signs of security breaches or anomalies.

[0031] FIG. 1 illustrates an example of an environment in which the solution of the present invention can be used. The solution of FIG. 1 illustrates a system configuration in which a local host 101 (e.g., an endpoint) and a remote entity or server 102 are connected via a network 103. Here, the host 101 exemplifies a computer or communication system (including a single device, a network node, or a combination of devices) that performs malware scanning or threat detection-related information collection. The scanning and / or analysis of threat detection-related data can be performed on the endpoint and / or the server. For example, the host 101 may include an endpoint, a personal computer, a personal communication device, a network-enabled device, a client, a firewall, a mail server, a proxy server, a database server, etc. The server 102 exemplifies a computer or communication system (including a single device, a network node, or a combination of devices) that can perform malware scanning or threat detection data analysis on the host 101 (e.g., an endpoint) or provide data necessary for the host 101 (e.g., an endpoint) to perform required operations (e.g., malware scanning, threat detection-related analysis (including risk assessment, reputation data, and / or attack path verification (e.g., for attack path mapping))).

[0032] According to an embodiment of the present invention, malware scanning and / or threat detection data analysis on the host 101 and / or server 102 can be achieved using a malware analysis environment, such as a virtual machine or emulator environment, deployed on the host and / or server. For example, the host 101 can be installed / deployed with an agent or sensor (e.g., antivirus software) used for attack path validation (e.g., attack path mapping) and malware scanning and / or threat detection data analysis. In one embodiment of the present invention, a sensor or agent within a computer can be used to intercept files, system configuration values, and / or network operations invoked by applications. The sensor can be used to monitor the operation of a device, such as a computer, and information collected by the sensor can be used to detect malicious behavior of applications, files, and / or processes.

[0033] In one embodiment of the present invention, the malware scanning environment, service, and / or software can detect application launches and terminations, detect all abnormal processes, and add monitoring to necessary applications and processes. Also, if the service is launched early, it can detect and track most of the user's applications. In one embodiment of the present invention, when the malware scanning software or service is launched, it can perform an inventory of running applications.

[0034] Network 103 exemplifies any computer or communications network, such as a wired or wireless local area network, e.g., a LAN, WLAN, Ethernet, etc., or a wired or wireless wide area network, e.g., WiMAX, GSM, UMTS, LTE, etc. Accordingly, host 101 and server 102 may, but need not, be located in different locations. For example, network 103 may be any TCP / IP-based network. Accordingly, communication between host 101 and server 102 over network 103 may be achieved using standard or proprietary protocols, e.g., carried over TCP / IP, where an agent on host 101 and a malware analysis sandbox or application on server 102 are represented at / as the application layer.

[0035] FIG. 2 is a schematic diagram illustrating an example of a network architecture in one embodiment of the present invention. FIG. 2 schematically illustrates a portion of a first local computer network 201 on which a computer system (e.g., an exposure management system, an EPP system, or an EDR system) is installed. Also, other computer systems capable of implementing embodiments of the present invention may be used instead of or in addition to the exposure management system, EPP system, or EDR system used in this example. The first local computer network is connected to a security service network (in one embodiment, a security backend system or server 202) via network 203. The network may be similar to network 103 of FIG. 1. The backend system or server 202 may be similar to server 102 of FIG. 1. The backend system or server 202 may form a node on the security service computer network for the first local computer network. The security service computer network may be managed by a threat detection system provider and separated from network 203 via a gateway or other interface (not shown) or other network element suitable for backend 202. The first local computer network 201 may also be separated from the network 203 via a gateway 204 or other interface. Other network configurations may be possible. In one embodiment of the present invention, the server may include a threat detection controller.

[0036] The first local computer network 201 may be comprised of multiple interconnected network nodes 205a-205h, each representing an element within the first local computer network 201, such as a computer, smartphone, tablet, laptop, or other network-enabled hardware. In one embodiment of the present invention, a node is any device on the network, but is not a gateway. Each network node 205a-205h shown in the first local computer network may also represent an endpoint (e.g., an EDR endpoint and / or an EPP endpoint) on which an agent or sensor 206a-206h (which may include a data collector or sensor) is installed. The network nodes 205a-205h may be similar to the local host 101 in the figure. In one embodiment of the present invention, the agent or sensor may also be installed on other elements of the computer network, such as a gateway or other interface. In the example of FIG. 2, the security agent module 204a is installed on the gateway 204. In one embodiment of the present invention, the agent or sensor is a malware scanning agent or sensor. The agents or sensors 206a-206h, 204a can collect various types of data at the nodes 205a-205h or the gateway 204. This data can include, for example, program or file hash values, files stored on the nodes 205a-205h, network traffic logs, process logs, binaries or files extracted from memory (e.g., DLLs, EXEs, or memory forensic artifacts), and / or logs of monitoring actions (e.g., TCP dumps) performed by programs or scripts running on the nodes 205a-205h or the gateway 204. The agents or sensors 206a-206h, 204a can also perform other tasks, such as verifying whether simulated attack paths are usable.The collected data is stored in a database or similar information storage model and retained for future use or transmitted for further analysis. Additionally, various types of threat detection models may be built and stored in a database on the backend / server 202 or on a separate server. The nodes 205a-205h and the server 202 typically include a hard drive, a processor, and RAM.

[0037] During its lifecycle, the agents or sensors 206a-206h, 204a may collect any type of data useful for the task of detecting or monitoring security threats (security breaches or system intrusions) or validating attack paths. The types of data observed and collected may be configured according to rules defined by the threat detection system provider during installation of the threat detection system or distribution of threat detection model components. In one embodiment, suspicious or malicious events among the monitored events are detected by one or more detection mechanisms employed. In one embodiment, the detection mechanisms used to detect suspicious or malicious events and / or validate steps in an attack path may include the use of machine learning models, scanning engines, heuristic rules, statistical anomaly detection, fuzzy logic-based models, and predefined rules.

[0038] In embodiments of the present invention, at least some of the agents or sensors 206a-206h may also have the ability to make their own decisions about the type of data they observe and collect. For example, an agent or sensor 206a-206h, 204a may verify at least one step in an attack path, or collect data about the behavior of programs running on an endpoint and observe that a new program has been started. If appropriate resources are available, the collected data may be permanently or temporarily stored or further transmitted by the agent or sensor 206a-206h, 204a in a suitable storage location on the respective network node or first local computer network 201.

[0039] The agents or sensors 206a-206h, 204a can be configured to transmit information, such as collected data, and to send and receive instructions to the threat detection system backend 202 over a network 203 (e.g., the Internet), allowing the threat detection system provider to remotely manage the system without requiring full-time personnel to be present at the organization managing the first local computer network 201, and to send tasks to the agents, for example, to verify portions of simulated attack paths for the network and / or hosts.

[0040] In one embodiment of the present invention, the agents or sensors 206a-206h, 204a may be configured to establish an internal network (e.g., an internal swarm intelligence network) including agents or sensors of multiple interconnected network nodes 205a-205h of the local computer network 201. The agents or sensors 206a-206h, 204a are further configured to collect data regarding their corresponding network nodes 205a-205h and share information based on the collected data within the established internal network. In one embodiment, the swarm intelligence network is composed of multiple semi-independent security nodes (security agent modules) that can function independently. Therefore, the number of instances in the swarm intelligence network may vary. Multiple connected swarm intelligence networks may also exist within a single local computer network and cooperate with each other.

[0041] The agents or sensors 206a-206h, 204a and / or backend systems may be further configured to use the collected data and information received from the internal network to generate and adapt models related to the respective network nodes 205a-205h and / or their users.

[0042] The solution of the present invention can be used, for example, in exposure management to determine the exposure of resources, where data collected from multiple sources can be processed to create and maintain an asset inventory, and the data can be further analyzed to address awareness perspectives, such as asset inventory dynamics, collection of general asset characteristics, definition of vulnerability scope and status, reputation scoring of public assets, supply chain providers, AI providers, etc.

[0043] The solution of the present invention uses attack path mapping and / or attack path simulation to determine possible attack paths against a network and / or hosts within the network. This may include, for example, identifying and analyzing various entry points, vulnerabilities, and attack vectors that an attacker may exploit to achieve their objectives, threat modeling, vulnerability analysis, and path analysis. The attack path simulation may be performed, for example, on a back-end system and / or at least one server.

[0044] In the solution of the present invention, a list of vulnerabilities and / or misconfigurations of at least one host in a network and / or a list of vulnerabilities and / or misconfigurations of the network are identified. This can be done by analyzing the host or by requesting this information from a service (e.g., an internal or external vulnerability management service). In one embodiment of the present invention, the host and / or network vulnerabilities may be received from or analyzed by a vulnerability management service.

[0045] If an entry attack vector to a host is detected by the attack path simulator, at least one attack path associated with the host can be determined and / or created in an attack path map based on vulnerability and / or misconfiguration information. Based on the attack path simulation, an attack path map can be created that includes available attack paths based, for example, on host and / or network vulnerabilities and / or misconfigurations.

[0046] Each attack path identified in the attack path map may be verified by at least one agent in the attack path. The agent may verify whether the attack or part of the attack is feasible as simulated. For example, the agent may verify which attacks, vulnerability exploits, and / or misconfigurations in the attack path simulation could be used by a malicious attacker. If the agent's verification determines that at least one attack in the attack path cannot be simulated, the associated attack and / or path may be removed from the attack path map because it is an attack or attack path that the agent has determined to be prevented (e.g., by a security control) and therefore cannot be simulated.

[0047] Verifying an attack path using at least one agent may include sending instructions to an agent in a host where the next potential step on the attack path is located and / or verifying those steps as long as the step is executable by a malicious attacker. In one embodiment of the present invention, verification of a portion of the attack path continues to the next portion as long as the verified step is usable by a malicious attacker or as long as the entire attack path is verified as usable by a malicious attacker (e.g., in this case, all steps are executable by a malicious attacker as simulated). In one embodiment of the present invention, verification of a portion of the attack path is performed at / by a host, such as an endpoint, and / or at / by multiple hosts (e.g., two hosts). For example, in the case of a lateral movement, verification of a portion of the attack path may be performed by the source host and the destination host. In one embodiment of the present invention, a server in the network may manage the attack path verification process by instructing individual agents on hosts to verify the attack path. An attack path may include a path that includes multiple hosts within the attack path.

[0048] If a part of a path cannot be used by a malicious attacker based on the verification result by at least one agent, the attack path may be removed from the attack path map because the path cannot be used by a malicious attacker in a real system. On the other hand, if all steps and / or parts of the attack path are verified by at least one agent as being implementable and / or usable by a malicious attacker, the attack path is retained in the attack path map.

[0049] To verify whether a simulated attack path is available to a host and / or network, the simulated actions can be verified and / or analyzed to see if they can be performed by, for example, the host, a user of the host (e.g., a user account), and / or a network or system. The following list provides examples of tests that can be performed to verify parts or steps of an attack path:

[0050] - Test and / or verify whether the host can establish network connectivity with a target (e.g., a host or system) that represents the next step in the attack path.

[0051] - Check whether the host or user policy (such as the web browser policy) allows saving passwords, authentication cookies, tokens, etc.

[0052] - Check whether the host or user's web browser has a master password enabled for saving passwords, cookies, and other authentication information.

[0053] - Request and / or receive a list of Company services for which the User has stored passwords, cookies, and / or other authentication information in their browser.

[0054] - Check which locations the host and / or user has write access to on the local system (e.g., endpoint) to analyze for potential privilege escalation based on file location, for example, potential DLL side-loading.

[0055] - Check which registry branches (e.g. Windows Registry) the user has write access to, for example in case of potential registry-based privilege escalation.

[0056] - Review operating system process execution logs, prefetch caches, and / or forensic artifacts (e.g., to see if there are any vulnerable application(s)).

[0057] - Examining operating system process execution logs, prefetch caches, and / or forensic artifacts, such as whether a user executed a vulnerable application found on the user's system, or whether the application is associated as a reader and / or application for a file type that a malicious attacker could use to trick the user into executing a malicious payload in the vulnerable application.

[0058] - Analyze and / or enumerate local user accounts, the local groups to which they belong, and the privileges they have.

[0059] - Analyze and / or enumerate firewall rules (e.g., local firewall rules on an endpoint).

[0060] - Analyzing and / or listening on network interfaces, such as external network interfaces, and analyzing and / or enumerating running services.

[0061] In one embodiment of the present invention, verifying the steps and / or portions of the attack path may include at least one of the following: verifying whether there is proper network connectivity from the host to the next part of the attack path, verifying whether the prerequisites required for privilege escalation are met, verifying whether the host has credentials accessible to a malicious attacker, verifying whether a user can write or execute files in predefined locations such as registers, verifying whether a vulnerable application was run on the host, verifying whether there are vulnerabilities suitable for lateral movement to other hosts, verifying domain-level privilege escalation, verifying available credentials needed to further escalate the attack on internal servers.

[0062] The agent(s) may use at least one of the following information when validating the attack path: target network layout, routing rules, firewall rules, local user permissions, credentials stored in browsers, cloud credentials, API keys, registry configuration, file write permissions, a list of running services listening on external network interfaces, and cryptographic authentication keys such as SSH keys.

[0063] Entry attack vectors into a host that can be used and / or analyzed for attack vectors may include, for example, some of the following misconfiguration and / or vulnerability related information: remote code execution in public-facing services, and / or phishing opportunities due to a user having vulnerable client or player software installed, and / or client software applications (email clients, web browsers, instant messaging clients, etc.) that allow a user to click to run an application. Attack vectors that can be used and / or analyzed for attack vectors into a host may include, for example, the following misconfiguration or vulnerability related information: EDR / MDR system information and / or process execution logs (e.g., indicating an installed application was used for phishing).

[0064] The solution of the present invention may utilize a threat detection service or system for, for example, a host and / or a network. The threat detection system and / or service may include different components, including, for example, a processing or analysis service, an external data source, and / or an internal data source. The processing or analysis service may include at least one of the following: static parsers, dynamic parsers, an antivirus engine, an EDR / MDR rule engine, and an EDR / MDR AI-based engine. The external data source may include at least any of the following: a domain lookup database, a virus database, and a virus information source. The internal data source may include at least any of the following: a threat intelligence information source, an incident information source, and an asset information source. The threat detection component may include at least one of the following components in addition to or instead of the above components: a data source, a data collection agent, a data aggregation and normalization component, data storage, an analysis engine, an alert and notification component, a user interface component, a reporting and logging component, an incident response tool, an integration tool, a machine learning algorithm, an AI algorithm, a rule engine, a scalability and / or redundancy unit, and a threat intelligence feed.

[0065] These components are specialized machines for performing various types of actions, including (but not limited to): querying reputation services and metadata search databases, parsing complex objects (e.g., installer packages, emails, web pages, documents), analyzing retrieved content (e.g., executables, process dumps, text, images), obtaining behavioral data (through emulation and sandboxing), determining collected facts, enriching awareness summaries by threat landscape information, image tagging, sentiment analysis, machine translation, spell checking, identifying obfuscated data, and summarizing analysis results.

[0066] 3 illustrates an example method according to an embodiment of the present invention. The exemplary method includes requesting and / or receiving a list of vulnerabilities and / or misconfigurations for at least one host in a network and / or a list of vulnerabilities and / or misconfigurations for the network, and performing an attack path simulation in a backend system and / or at least one server for at least one host in the network and / or the network. If an entry attack vector to the host is detected by the attack path simulator, the method further includes determining and / or creating an attack path associated with the host based on the vulnerability and / or misconfiguration information for each identified attack path, creating an attack path map based on the attack path simulation, verifying each determined attack path in the attack path map with at least one agent in the attack path, e.g., by verifying whether the attack or portion of the attack is feasible as simulated, and removing from the attack path map any attacks and / or paths that are prevented (e.g., by security controls) and determined by the agent to be infeasible as simulated.

[0067] Figure 4 illustrates an example of a computing device, such as a host, endpoint, and / or server, in accordance with an embodiment of the present invention. Computing device 410 may represent, for example, a local entity, i.e., host 1, in Figure 1, or may represent a remote entity, i.e., server 2, in Figure 1. Computing device 410 may be configured to perform the procedures or exhibit the functionality described in any of Figures 1-3.

[0068] The computing device includes at least one processor 411 and at least one memory 412 (and, optionally, at least one interface 413), which may be operatively connected or coupled to each other, for example, by a bus 414. The processor 411 of the computing device 410 is configured to read and execute computer program code stored in the memory 412. The processor may be represented by a CPU (Central Processing Unit), an MPU (Microprocessing Unit), etc., or a combination thereof. The memory 412 of the computing device 410 is configured to store programs, computer / processor-executable instructions, macros, applets, etc., or portions thereof. Such computer program code, when executed by the processor 411, causes the computing device 410 to operate in accordance with embodiments of the present invention. The memory 412 may be represented by a RAM (Random Access Memory), a ROM (Read Only Memory), a hard disk, a secondary storage device, or a combination of two or more thereof. The interface 413 of the computing device 410 is configured to interface with another computing device and / or a user of the computing device 410. That is, the interface 413 may represent a communication interface (including, for example, a modem, antenna, transmitter, receiver, transceiver, etc.) and / or a user interface (including, for example, a display, touch screen, keyboard, mouse, signal lights, speakers, etc.).

[0069] The solution of the present invention can be utilized, for example, in an endpoint protection (EPP) system. In one embodiment of the present invention, a host or computer can be protected by a threat detection system, such as an endpoint protection (EPP) system or an EDR system. These systems can include endpoint-side security controls that perform local and distributed decision-making, with some functional elements, such as those that facilitate the attack detection process, being hosted remotely. The local decision-making process can rely on specific and simple (and therefore often prone to false negatives) security controls aimed at quickly and reliably preventing known attacks and their variants. In uncertain situations, ambiguous objects, such as previously unseen, untrusted executable files and their occurrence contexts, are analyzed by a remote service that provides more extensive and complex detection and analysis tools than tools on the local host or endpoint. The remote service can, for example, leverage machine learning models to probe the target object through deep static and dynamic analysis. In one embodiment of the present invention, electronic files can be analyzed for malware detection. Electronic files, for example, can refer to any electronic file (e.g., any type of application file) that contains an executable part. As can be seen, embodiments of the present invention are applicable to any electronic file, including, for example, an Android Application Package (APK), a Portable Executable (PE), a Microsoft Windows Installer (MSI), or any other file format capable of distributing and / or installing application software or middleware on a computer.

[0070] The solution of the present invention can be utilized, for example, in EDR or MDR systems. In an EDR / MDR system, an EDR / MDR agent receives data from the EDR / MDR sensor component and performs an initial analysis to determine whether a particular activity (e.g., a series of events) matches an initial definition of malicious (suspicious, information-rich) behavior. If so, the agent forwards the information to the EDR / MDR backend. This information is collected by the agent component and provided as context, allowing for informed decisions regarding the actions to be taken. The EDR / MDR backend can further analyze the information received from the agents deployed in the environment. EDR / MDR sensors can operate passively by intercepting data passing through system processes, but because sensors often need to be deployed inline within processes, they must operate quickly. The EDR / MDR backend can use various methods, such as heuristics and rule databases, to pass the data to decision logic to determine whether the activity is normal, meets a threshold to be logged, or is highlighted as suspicious or malicious.

[0071] In one embodiment of the present invention, actions can be taken regarding prioritizing possible responses to identified threats and improving security posture. In one embodiment of the present invention, the output of the threat detection component relates to at least one of the following: identified vulnerabilities, identified critical assets, prioritization of identified vulnerabilities, prioritization of critical assets, business risk values ​​for identified assets and / or vulnerabilities, attack path mapping, visualization and reporting artifacts.

[0072] The data collected by the solution of the present invention can be stored in a database or similar information storage model for further use.

[0073] In one embodiment, if a threat, vulnerability, misconfiguration, malicious file, application, and / or activity is detected, additional actions may be taken to protect the computer or computer network. Actions may also be taken to modify the configuration of the computer or other network node. Configuration modifications may include, for example, preventing one or more nodes (which may be computers or other devices) from being powered off to preserve information in RAM, enabling a firewall on one or more nodes to immediately block attackers, slowing or blocking network connectivity for one or more network nodes, deleting or quarantining suspicious files, collecting logs from the network nodes, executing a series of commands on the network nodes, alerting users of one or more nodes that a threat or anomaly has been detected and that their workstations are under investigation, and sending a system update or software patch to the node from the security backend. In one embodiment of the present invention, one or more of these actions may be initiated automatically.

[0074] Although the present invention has been described based on the preferred embodiments described above, it should be understood that these embodiments are merely examples and that the scope of the claims is not limited to these embodiments. Based on the disclosure, those skilled in the art may devise modifications and alternatives that are deemed to be within the scope of the appended claims. Each feature disclosed or illustrated in this specification can be incorporated into the present invention alone or in any appropriate combination with other features disclosed or illustrated in this specification. The lists and groups of examples provided in the above description are not exhaustive unless expressly stated otherwise.

Claims

1. 1. A method for managing exposure in a network, comprising: The network comprises at least one host including an endpoint (101, 205a-205h) and / or a server (102, 202), and the at least one host has a security agent (206a-206h, 204a) installed thereon; requesting and / or receiving a list of vulnerabilities and / or misconfigurations of said at least one host in said network (201) and / or a list of vulnerabilities and / or misconfigurations of said network (201); performing an attack path simulation on the at least one host in the network and / or the network (201), for example in a backend system and / or the at least one server (102, 202); determining and / or creating at least one attack path associated with the host based on the vulnerability and / or misconfiguration information when an entry attack vector to the host is detected by the attack path simulator; creating an attack path map based on the attack path simulation; verifying each of the determined attack paths in the attack path map with the at least one agent (206a-206h, 204a) in the attack path, for example by verifying with the agent (206a-206h, 204a) whether the attack or part of the attack is feasible as simulated; removing from the attack path map the attacks and / or paths that are determined by the agents (206a-206h, 204a) to be prevented, for example, by security controls, and therefore not feasible as simulated; A method comprising:

2. The method of claim 1 , comprising receiving a list of known vulnerabilities detected, for example, by a vulnerability management service.

3. The method of claim 1 or claim 2, wherein the agents (206a-206h, 204a) verify which attacks, exploits of vulnerabilities, and / or misconfigurations in the attack path simulation can be used, for example, by a malicious attacker.

4. 4. The method of claim 1, wherein verifying the attack path by the at least one agent (206a-206h, 204a) includes sending instructions to an agent in a host where a next potential step on the attack path exists, and / or verifying a step on the attack path to the extent that the step is executable by a malicious attacker.

5. 5. The method of claim 1, wherein a simulated attack path is removed from the attack path map if, based on the verification by the at least one agent (206a-206h, 204a), some of the attack paths cannot be utilized by a malicious attacker.

6. 6. The method of claim 1, wherein an attack path is retained in the attack path map if at least one agent (206a-206h, 204a) verifies that all steps and / or all parts of the attack path are implementable and / or usable by a malicious attacker.

7. Verifying the steps and / or portions of the attack path includes: verifying whether there is proper network connectivity from the host to the next part of the attack path; Verifying whether the prerequisites required for privilege escalation are met; verifying whether the host has authentication information accessible to a malicious attacker; Verifying whether a user can write or execute files to predefined locations, including registers; verifying whether a vulnerable application was executed on said host; Verify whether there are any vulnerabilities suitable for lateral movement to other hosts; Verifying domain-level privilege escalation; and Verifying available credentials on internal servers required to further escalate the attack; The method according to any one of claims 1 to 6, comprising at least one of:

8. 8. The method of claim 1, wherein the agent (206a-206h, 204a) or agents use at least one of the following information when verifying the attack path: target network layout, routing rules, firewall rules, local user permissions, browser-stored credentials, cloud credentials, API keys, registry settings, file write permissions, a list of running services listening on external network interfaces, and cryptographic authentication keys, including SSH keys.

9. The entry attack vector to the host includes at least remote code execution on a public service, and / or a phishing opportunity due to a user having vulnerable client or player software installed, and / or a client software application that a user can click to run the application, including an email client, a web browser, an instant messaging client, and / or The entry attack vector to the host includes EDR / MDR system information and / or process execution logs that indicate that an installed application is being used for phishing.

9. The method according to any one of claims 1 to 8.

10. 10. The method according to claim 1, wherein the server (102, 202) of the network manages the attack path verification process by instructing each of the agents (206a-206h, 204a) in the host to verify a corresponding part of the attack path.

11. A server for network exposure management, comprising: The network (201) comprises at least one host including an endpoint (101, 205a-205h) and at least one server (102, 202), and the at least one host has a security agent (206a-206h, 204a) installed thereon; The server requesting and / or receiving a list of vulnerabilities and / or misconfigurations of said at least one host in said network (201) and / or a list of vulnerabilities and / or misconfigurations of said network (201); performing an attack path simulation on the at least one host in the network and / or the network (201); determining and / or creating at least one attack path associated with the host based on the vulnerability and / or misconfiguration information when an entry attack vector to the host is detected by the attack path simulator; Create an attack path map based on the attack path simulation, Instructing the agents (206a-206h, 204a) in the attack path to verify whether the attack or part of the attack is feasible as simulated; Based on the information received from the agents (206a-206h, 204a), remove from the attack path map the attacks and / or paths that are determined to be prevented by, for example, security controls and therefore not feasible as simulated. The server is configured as follows:

12. At least one endpoint (101, 205a-205h), wherein a security agent is installed on said endpoint; and / or At least one server, said server being a server (102, 202) according to claim 11; an exposure management system, including:

13. 13. An exposure management system according to claim 12, configured to carry out a method according to any one of claims 2 to 10.

14. When executed by a computer, A computer program comprising instructions for causing a computer to carry out the method of any one of claims 1 to 10.

15. A computer-readable recording medium containing the computer program of claim 14.

Images