Method for predicting the health status of a distributed network by artificial neural networks

Abstract

To provide a method for predicting health status of a decentralized network with an artificial neural network, which can minimize drawbacks.SOLUTION: A method comprises: identifying one or more sites, one or more assets on a side and links between the assets; assessing the actual health status of each of the identified assets; assessing the actual health status of each of the identified sites; and predicting the subsequent health status of each identified site by an artificial neural network according to a predictive function based on a set of values including actual asset health status rank, actual asset infection risk, actual asset infection factor, actual site health status rank and actual site infection risk.SELECTED DRAWING: None

Description

[Technical field]

[0001] The present invention relates to the field of security methods and systems in the management of distributed networks, with particular reference to distributed networks. In particular, the present invention relates to a method for predicting the health status of a distributed network using an artificial neural network. [Background technology]

[0002] A site represents a physical location where a certain amount of network-reachable assets are located.

[0003] An asset is a physical (or virtual, e.g., virtual machine) network-enabled device that is physically connected within a site's network. An asset can be a computer, a tablet, a printer, or any other type of device that can communicate over a TCP / IP or similar network.

[0004] Furthermore, assets can communicate with other assets or have the possibility to communicate with other assets. In this case, they have a common link that models the fact that an asset can communicate with another asset over a network in some protocol. A computer network can have several components between assets, and there are different equipment types (routers, firewalls, application firewalls, etc.) that can prohibit all or some protocols between two assets. For this, a link needs to have a "from" and a "to" asset, as well as a protocol.

[0005] Due to the nature of networking software, one or more vulnerabilities may affect one or more assets, and therefore are generally subject to attack that compromises their security.

[0006] In the cybersecurity world, it is common to statically assess the security posture of a given asset or system by looking at its current health, vulnerabilities, and the security measures in place to prevent various kinds of disruptions.

[0007] A complex method of assessing the vulnerability of a system is to assess the system as a whole as well as each asset with a CVSS-type scoring system consisting of three metric groups: base, time, and environment. The base group represents the inherent qualities of a vulnerability that are constant over time and across user environments, the time group reflects characteristics of a vulnerability that change over time, and the environment group represents characteristics of a vulnerability that are unique to the user's environment. In summary, the base metric generates a score, which can then be modified by scoring the time and environment metrics.

[0008] In any case, analysing such aspects separately and with a static approach may give a false perception of reality and lead to erroneous conclusions.

[0009] It would therefore be desirable to have a method that can predict the health status of sites in a distributed network. Furthermore, it would be desirable to have a method that can better predict how risks may affect the health status of a system by holistically analyzing the evolution of the system over time. Finally, it would be desirable to have a method that can prevent abnormal health statuses associated with changes in asset vulnerabilities.

[0010] Similarly, it would be desirable to have a device that can better predict how risks may affect a system's health status by holistically analyzing the evolution of the system over time. Summary of the Invention [Problem to be solved by the invention]

[0011] The object of the present invention is to provide a method for predicting the health status of a distributed network by means of an artificial neural network, which makes it possible to minimize the above-mentioned drawbacks. [Means for solving the problem]

[0012] Thus, according to the present invention, a method for predicting a health status of a distributed network by means of an artificial neural network is described, comprising a step of identifying an object in the distributed network, identifying, by a computerized data processing unit operatively connected to the distributed network, one or more sites within the distributed network; identifying, by a computerized data processing unit, one or more assets of each of the identified sites; identifying, by a computerized data processing unit, links between the identified assets, the links being defined by data packets exchanged in the distributed network having a protocol field associated with a sending asset, a protocol field associated with a receiving asset, and a protocol field enabling communication between the sending asset and the receiving asset, and for each of the links, the sending asset and the receiving asset define a node, and a connection between the sending asset and the receiving asset defines a link between the nodes with a direction from the sending asset to the receiving asset; storing the identified sites, the identified assets, and the identified links of the distributed network in a storage unit of a persistent type operatively connected to the data processing unit; Including, The method for predicting the health status is evaluating, by a computerized data processing unit, an actual asset health status rank of each of the identified assets according to a predetermined set of asset health status values ​​ranging from worst asset health status to best asset health status; assessing, by a computerized data processing unit, an actual asset infection risk for each of the identified assets according to a predefined set of asset infection risk values ​​ranging from maximum asset infection risk to no asset infection risk; calculating, by an artificial neural network operated by a computerized data processing unit, an actual asset infectiousness factor for each of the identified assets as a probability that an infection of the asset can spread to other assets according to the identified links; evaluating an actual health status of each of the identified assets in the actual iteration, The method for predicting the health status is evaluating, by a computerized data processing unit, an actual site health status rank of each of the identified sites as equal to a minimum actual asset health status value of the assets within the site; assessing, by a computerized data processing unit, an actual site infection risk for each of the identified sites as being equal to a maximum asset infection risk value of the assets within the site; evaluating an actual health status of each of the identified sites in the actual iteration, The method for predicting the health status further comprises predicting, in subsequent iterations and by an artificial neural network operated by the computerized data processing unit, a subsequent health status of each of the identified sites according to a prediction function based on a set of predictor values ​​including actual asset health status rank, actual asset infection risk, actual asset infectious agent, actual site health status rank, and actual site infection risk.

[0013] The method according to the invention thus makes it possible to evaluate a network of real sites with regard to their risk and health status and to provide a prediction as to how it will behave in the near future.By utilizing artificial neural networks, it is possible to define a machine learning approach, where the prediction is based on learned events in real conditions.

[0014] the step of evaluating the actual health status of each of the identified assets and the step of evaluating the actual health status of each of the identified sites are performed for a predetermined learning time interval; The actual asset health status rank of each of the identified assets, the actual asset infection risk of each of the identified assets, the actual asset infection agent of each of the identified assets, the actual site health status rank of each of the identified sites, and the actual site infection risk of each of the identified sites are stored in a storage unit.

[0015] A predefined learning time interval defines a scheduled time for computing the actual iterations so that the artificial neural network can be trained within said learning time interval.

[0016] the step of evaluating the actual health status of each of the identified assets and the step of evaluating the actual health status of each of the identified sites are performed for a predetermined learning time interval; The actual asset health status rank of each of the identified assets, the actual asset infection risk of each of the identified assets, the actual asset infection agent of each of the identified assets, the actual site health status rank of each of the identified sites, and the actual site infection risk of each of the identified sites include a plurality of values ​​defined at a predetermined learning point in time at a predetermined learning time interval.

[0017] In this manner, changes to an asset or site are evaluated at predetermined points in time.

[0018] the step of evaluating the actual health status of each of the identified assets and the step of evaluating the actual health status of each of the identified sites are performed for a predetermined learning time interval; The actual asset health status rank of each of the identified assets, the actual asset infection risk of each of the identified assets, the actual asset infection agent of each of the identified assets, the actual site health status rank of each of the identified sites, and the actual site infection risk of each of the identified sites include a plurality of values ​​defined as changing during a predetermined learning time interval.

[0019] In this way, changes to an asset or site are evaluated as they occur.

[0020] The step of predicting a subsequent health status of each of the identified sites is performed for a predetermined prediction time interval.

[0021] A predefined prediction time interval defines the scheduled time for computing the next iteration, so that the artificial neural network can predict the health status within said prediction time interval.

[0022] the step of evaluating the actual health status of each of the identified assets and the step of evaluating the actual health status of each of the identified sites are performed for a predetermined learning time interval; The step of predicting a subsequent health status of each of the identified sites is performed for a predetermined prediction time interval; The prediction time interval is equal to the training time interval.

[0023] The range of predictions therefore corresponds to the range of training.

[0024] The artificial neural network is of the feedforward type trained by backpropagation.

[0025] In this way, information travels only in one direction, forward, from input nodes to output nodes. There are no cycles or loops in the network. The output values ​​are compared with real values ​​to calculate the value of some predefined error function. The error is then fed back through the network. Using this information, the algorithm adjusts the weights of each connection in order to reduce the value of the error function by some small amount.

[0026] the artificial neural network is a three-hidden layer network having at least as many neurons in the hidden layer as there are sets of predictors; A different artificial neural network is used for each identified site.

[0027] By defining several such layers and neurons, it is possible to approximate any kind of site with its own artificial neural network.

[0028] the set of predictive values ​​also includes an aging frequency value for each of the identified assets within the identified site; By the computerized data processing unit, the temporal frequency values ​​for the next iteration are calculated for each of the assets by applying a predefined decay factor to the infectious agent of the actual asset in the actual iteration.

[0029] Thus, frequency over time allows tracking the frequency of entities and events over time and can be viewed as synapses in an artificial neural network.

[0030] An infection factor is calculated for each of the identified assets by an artificial neural network operated by a computerized data processing unit as the maximum between the asset's actual asset vulnerability factor, which is the probability that a vulnerability will affect the asset, and the asset's actual asset spread factor, which is the probability that a further asset will attack the identified asset following the identified link. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0031] The present invention relates to a method for predicting the health status of a distributed network by means of an artificial neural network.

[0032] The method according to the invention finds useful application in physical or virtual infrastructures or automation systems, in particular industrial automation systems such as industrial processes for production, industrial processes for power generation, infrastructures for the distribution of fluids (water, oil and gas), infrastructures for power generation and / or transmission, infrastructures for transportation management.

[0033] The term "site" as used herein means a physical location where a certain amount of network-reachable assets are located.

[0034] The term "asset" in the present invention means a physical or virtual network-enabled device that is physically connected within a site's network. An asset can be a computer, a tablet, a printer, or any other type of device that can communicate over a TCP / IP or similar network.

[0035] The term "link" in this invention refers to a model that represents communication between two assets on a network with some protocol. An asset can communicate with other assets or has the possibility to communicate with other assets. If an asset can communicate with another asset, they have a common link, as described above. A computer network can have several components between assets, and there are different equipment types (routers, firewalls, application firewalls, etc.) that can prohibit all or some protocols between two assets. For these reasons, an asset a The protocol is used to b The same is true for the asset b From the asset a Since there is no guarantee that what will happen to a given asset is possible, the link needs to have a "from" and a "to" asset, as well as a protocol. Representing links is also useful because it allows a reachability graph of assets to be created, which can then be used to understand how an infection may spread on a network.

[0036] Thus, a distributed network can connect multiple sites, which may comprise one or more assets, the latter of which can create a network of interconnections via links, as described above.

[0037] The method according to the invention makes it possible to identify the aforementioned elements in order to predict the health status of a distributed network by utilizing a prediction function implemented by an artificial neural network through several stages. In particular, the scope of the invention is to predict the health status of a distributed network over two subsequent iterations, namely the actual iteration and the subsequent iteration.

[0038] The term "actual iteration" means, in the present invention, an iteration that is still running and that is used in the training phase of the artificial neural network. In this respect, the term "training time interval" means, in the present invention, a time interval that corresponds to the training phase of the artificial neural network.

[0039] The term "subsequent iteration" means, in the present invention, an iteration that has not yet been performed and that is used in the prediction stage of the artificial neural network. In this respect, the term "prediction time interval" means, in the present invention, a time interval according to the prediction stage of the artificial neural network.

[0040] Due to the nature of networking software, one or more vulnerabilities may affect an asset.

[0041] The term "vulnerability" means in the present invention a potential security problem that a given hardware or software product (or combination thereof) may have in a given version. A given vulnerability can be exploited in several different ways, one of which is via a network with one or more protocols, which are used to initially infect an asset or to spread the infection to more assets (the initial and latter protocols may be different). It is important to note that this expression assumes the existence of vulnerabilities that can be exploited in other ways (e.g., delivery of malware via a USB key), but in that case the protocol set is empty.

[0042] The term "infection" in the present invention means the occurrence of some malware in a network, in particular affecting one (or several) assets, usually due to some form of vulnerability. Another property of an infection is the infectivity factor (I-factor), which is expressed as the probability P that the infection can spread to another asset, assuming that it is also affected by the same vulnerability.

[0043] The method according to the invention makes it possible to evaluate a network of real sites with regard to risk and health status and to provide a prediction as to how it will behave in the near future. By utilizing artificial neural networks, it is possible to define a machine learning approach, where the prediction is based on learned events in real conditions, as described herein.

[0044] The method for predicting the health status of a distributed network by means of an artificial neural network according to the present invention comprises three main stages, in particular a stage of identifying objects in the distributed network, a subsequent stage of evaluating, in an actual iteration, the actual health status of each of the identified assets, a subsequent stage of evaluating, in an actual iteration, the actual health status of each of the identified sites, and finally a stage of predicting, in a subsequent iteration and by means of an artificial neural network, the subsequent health status of each of the identified sites.

[0045] The method is preferably carried out by making use of one or more computerized data processing units, in particular the artificial neural network is operated by one or more of said computerized data processing units.

[0046] The step of identifying objects in the distributed network includes a first step of identifying, by a computerized data processing unit operably connected to the distributed network, one or more sites in the distributed network, and then a second step of identifying, by the computerized data processing unit, one or more assets of each of the identified sites.

[0047] Thus, a distributed network may include one or more sites, which in turn may include one or more assets.

[0048] The step of identifying objects in the distributed network includes a further step of identifying, by the computerized data processing unit, links between the identified assets, the links being defined by data packets exchanged in the distributed network having a protocol field associated with the sending asset, a protocol field associated with the receiving asset, and a protocol field enabling communication between the sending asset and the receiving asset, and for each link, the sending asset and the receiving asset define a node, and a connection between the sending asset and the receiving asset defines a link between the nodes with a direction from the sending asset to the receiving asset.

[0049] Finally, a further step is performed of storing the identified sites, the identified assets and the identified links of the distributed network in a storage unit of a persistent type operatively connected to the data processing unit.

[0050] The aforementioned stage of identifying the objects in the distributed network therefore makes it possible to define the entire structure of the foreseen distributed network, taking into account all the connections between the objects. In particular, these are the main entities and data structures. In computer networks, these entities evolve over time according to several types of events that result in a change in the status of one or more associated entities.

[0051] The cybersecurity information of a site includes two different values: its health status rank and its infection risk. As explained for sites, assets themselves also have cybersecurity information including health status rank and infection risk, which represent the same concept but are focused on a specific asset. In the following, we will explain the main events that affect the development of the cybersecurity posture according to the above values.

[0052] The term "health status rank" means in the present invention a structured value for the health status of an object, i.e. a site or an asset. Preferably, the health status rank is a numerical value selected in a predefined range that allows to represent a structured value of health from the worst to the best value. In particular, in the present invention, the health status rank is a decimal number ranging between the number 0 and the number 10, the number 0 representing a very bad (worst) health status and the number 10 representing a good (best) health status. A bad health status means that there is some infection (usually malware) active on one or more assets in the site or some other form of functional degradation caused by cybersecurity issues.

[0053] Thus, the assessed health status rank for an asset is expressed as an asset health status rank, while the health status rank for a site is consequently expressed as a site health status rank. Furthermore, taking into account the type of iteration, as described above, the health status rank of an asset may be evaluated in the actual iteration as the actual asset health status rank or the actual health asset of the asset, and in the subsequent iteration as the subsequent asset health status rank or the subsequent health asset of the asset. The same applies mutatis mutandis for a site taking into account the actual iteration as the actual site health status rank or the actual health asset of the site, and in the subsequent iteration as the subsequent site health status rank or the subsequent health asset of the site.

[0054] The term "infection risk" means in the present invention a structured value for the risk of an object, i.e. a site or an asset, being infected. Preferably, the infection risk is a numerical value chosen within a predefined range, making it possible to represent a structured value of the infection risk from a maximum to a minimum value. In particular, in the present invention, the infection risk is a decimal number ranging between the number 0 and the number 10, the number 0 representing no risk of infection (best) and the number 10 representing close to the certainty of infection (worst).

[0055] Within the scope of evaluating the aforementioned values, the method according to the invention comprises a step of evaluating, in the actual iteration, the actual health status of each of the identified assets. In particular, such a step comprises a step of evaluating, by the computerized data processing unit, the actual asset health status rank of each of the identified assets according to a predefined set of asset health status values ​​ranging from the worst asset health status to the best asset health status. A further step is performed by the computerized data processing unit of evaluating, by the computerized data processing unit, the actual asset infection risk of each of the identified assets according to a predefined set of asset infection risk values ​​ranging from the maximum asset infection risk to no asset infection risk. Finally, a step is performed by the artificial neural network operated by the computerized data processing unit of calculating, by the identified links, the actual asset infection factor of each of the identified assets as the probability that the infection of the asset can spread to other assets.

[0056] Taking into account the evaluated or calculated values ​​for each asset of the site, the method according to the invention comprises a step of evaluating, in the actual iteration, the actual health status of each of the identified sites. In particular, such step comprises a first step of evaluating, by the computerized data processing unit, an actual site health status rank of each of the identified sites as being equal to the minimum actual asset health status value of the assets within the site, and a second step of evaluating, by the computerized data processing unit, an actual site infection risk of each of the identified sites as being equal to the maximum asset infection risk value of the assets within the site.

[0057] A high infection risk may increase the health status rank in the short term, while a site with a low infection risk may have a good health status rank.

[0058] Based on the aforementioned ranges, when an infection is affecting an asset, the corresponding health status rank is reduced by the infection's health impact value, which is a decimal number between the number 0 and the number 10, with the number 10 representing the maximum disruption to the asset health status rank. The health impact is derived from the vulnerabilities used in the infection by considering their maximum health impact.

[0059] The term "vulnerability" in the present invention means the inability of an object to withstand the effects of a hostile environment. Vulnerability is characterized by a set of conditions (e.g., software versions) that must be present on an asset to make a risk factor available.

[0060] The aforementioned steps, namely, evaluating the actual health status of each of the identified assets and evaluating the actual health status of each of the identified sites, allow the training (or learning) of the artificial neural network design to carry out the method, as described in more detail below. An artificial neural network (ANN) is a computing system inspired by biological neural networks. Such systems generally learn to perform tasks by considering examples, without being programmed with task-specific rules. ANNs are based on a collection of connected units or nodes called artificial neurons (or simply neurons), which loosely model neurons in a biological brain. Each connection can transmit a signal to other neurons, like a synapse in a biological brain. An artificial neuron receiving a signal can then process it and signal to the neurons connected to it. Typically, neurons are aggregated into layers. Different layers may perform different transformations on their inputs. A signal progresses from the first layer (input layer) to the last layer (output layer), possibly after traversing the layers multiple times.

[0061] In one embodiment, the artificial neural network of the present invention is of the feedforward type trained with backpropagation.

[0062] A feedforward neural network is an artificial neural network in which the connections between nodes do not form cycles and information travels only in one direction, forward, from the input nodes, through the hidden nodes (if there are any), to the output nodes. There are no cycles or loops in the network. The output values ​​are compared with real values ​​to calculate the value of some predefined error function. The error is then fed back through the network. Using this information, the algorithm adjusts the weights of each connection in order to reduce the value of the error function by some small amount.

[0063] In one embodiment, the artificial neural network is a three hidden layer network having at least as many neurons in the hidden layer as there are sets of predictors. In particular, the number or sites to be evaluated defines the number of artificial neural networks to be used, with a different artificial neural network being used for each identified site.

[0064] By defining several such layers and neurons, it is possible to approximate any kind of site with its own artificial neural network.

[0065] In an ANN multi-layer that uses backpropagation, the output values ​​are compared to the correct answer to calculate the value of some predefined error function. Through various techniques, the error is then fed back through the network. Using this information, the algorithm adjusts the weights of each connection in order to reduce the value of the error function by some small amount. After repeating this process for a sufficient number of training cycles, the network usually converges to some state where the calculated error is small, so that the ANN has learned some objective function.

[0066] In one embodiment, the step of evaluating the actual health status of each of the identified assets and the step of evaluating the actual health status of each of the identified sites are performed for a predetermined learning time interval, and the actual asset health status rank of each of the identified assets, the actual asset infection risk of each of the identified assets, the actual asset infection agent of each of the identified assets, the actual site health status rank of each of the identified sites, and the actual site infection risk of each of the identified sites are stored in a storage unit.

[0067] A predefined learning time interval defines a scheduled time for computing the actual iterations so that the artificial neural network can be trained within said learning time interval.

[0068] In particular, the step of evaluating the actual health status of each of the identified assets and the step of evaluating the actual health status of each of the identified sites are performed for a predetermined learning time interval, and the actual asset health status rank of each of the identified assets, the actual asset infection risk of each of the identified assets, the actual asset infection agent of each of the identified assets, the actual site health status rank of each of the identified sites, and the actual site infection risk of each of the identified sites include a plurality of values ​​defined at a predetermined learning point in the predetermined learning time interval.

[0069] In this manner, changes to an asset or site are evaluated at predetermined points in time.

[0070] Alternatively or in combination with the above features, the step of evaluating the actual health status of each of the identified assets and the step of evaluating the actual health status of each of the identified sites are performed for a predetermined learning time interval, and the actual asset health status rank of each of the identified assets, the actual asset infection risk of each of the identified assets, the actual asset infection agent of each of the identified assets, the actual site health status rank of each of the identified sites, and the actual site infection risk of each of the identified sites include a plurality of values ​​defined as changing during the predetermined learning time interval.

[0071] In this way, changes to an asset or site are evaluated as they occur.

[0072] In one embodiment, the set of predicted values ​​also includes a frequency value over time for each of the identified assets in the identified site, and by the computerized data processing unit, a frequency value over time for the next iteration is calculated for each of the assets by applying a predetermined decay factor to the infectious agent of the actual asset in the actual iteration.

[0073] Frequency over time therefore allows the frequency of entities and events to be tracked over time and can be viewed as the synapses of an artificial neural network.

[0074] Frequency over time allows tracking the frequency of entities and events over time and can be seen as the synapse of an artificial neural network. Indeed, this data structure is the basis of learning and prediction algorithms that allow understanding the current and future behavior of a system. Frequency over time can be used to track the frequency of single objects or to calculate correlation matrices. In both situations, the main idea is that this data structure represents knowledge of a given event, whose importance decreases over time. For example, when tracking the probability that one asset infects another, we can represent it as the matrix AgingFrequencyProbabilityOfContagion(Asset i ,Asset j ), whose values ​​can be initialized with some amount, say 0.5. When iterating to the next cycle of aging frequency, each value in the matrix is ​​updated with a decay factor that reduces all probabilities by the value of the decay factor. For a decay factor of 0.01, in each iteration, AgingFrequencyProbabilityOfContagion(Asset i ,Asset j ) is adjusted, so if the previous iteration was 0.5, the new value becomes 0.49. Different temporal frequency structures (for tracking different objects) can use different decay factors.

[0075] Following the learning step, the method for predicting the health status further comprises, in subsequent iterations, predicting by the artificial neural network operated by the computerized data processing unit a subsequent health status of each of the identified sites according to a prediction function based on a set of predictor values ​​including actual asset health status rank, actual asset infection risk, actual asset infectious agent, actual site health status rank, and actual site infection risk.

[0076] Preferably, an infection factor is calculated for each identified asset by an artificial neural network operated by a computerized data processing unit as the maximum between the asset's actual asset vulnerability factor, which is the probability that a vulnerability will affect the asset, and the asset's actual asset spread factor, which is the probability that a further asset will attack the identified asset according to the identified link.

[0077] Therefore, the prediction function uses a machine learning approach, preferably comprising a feed-forward artificial neural network (ANN) trained with back-propagation that is used to build a model to understand the relationships between all considered factors (between them and over time) for each asset.

[0078] Considering some event to be evaluated, an event may be defined by a "connection" that occurs whenever one asset communicates with another asset using a given protocol and application. When this event occurs, a link is created or updated accordingly.

[0079] Further events can be defined by "attacks" that can occur at a given time on the attacker asset or on the target asset by an external attacker, causing new infections to be created. An attack uses one or more vulnerabilities. When an infection is created, it triggers these updates in the following ways: - The health status rank of the infected assets is updated. - Frequency is updated over time ○ Aging Frequency ProbabilityOfBeingExploited(Vulnerability) =1 · There is an increased probability that an asset with a given vulnerability may be affected by it. ○ Aging Frequency Asset(ProbabilityOfBeingAttacked) =1 · High probability of assets being attacked.

[0080] Furthermore, the event "software change" can occur when new software is installed on a system, either completely new software or an update of software already installed. Software updates are sometimes called "patching". A patch, or a series of patches, can result from the intention to remove an infection from an asset. When software is installed or upgraded, the asset may have some vulnerabilities resolved or new vulnerabilities may appear. The risk factor of the asset is updated and its risk is calculated by finding the maximum value of the risks of the vulnerabilities that affect it. If the software change event is removing an infection, these updates are also performed. - Health status ranks of infected assets will be updated as explained. - Frequency over time is updated. ○ Aging Frequency ProbabilityOfBeingExploited(Vulnerability) =0 The event does not leave a single asset vulnerable to a given vulnerability. ○ Aging Frequency ProbabilityOfBeingExploited(Asset) =0 -This issue fixes all vulnerabilities present in the asset.

[0081] Finally, the event "contagion" can occur when an infected asset spreads the infection to another asset. This event is similar to an attack, but is tracked differently to be able to better predict the future evolution of the system. In this way, some updates are triggered, similar to an attack, but differently. - Health status ranks of infected assets will be updated as explained. - Frequency over time is updated. ○ Aging Frequency ProbabilityOfBeingExploited(Vulnerability) =1 · There is an increased probability that an asset with a given vulnerability may be affected by it. ○ Aging Frequency ProbabilityOfContagion(AssetX,AssetY) =1 Asset X asset Y The chances of infection increase. ○ Aging Frequency Asset(ProbabilityOfBeingAttacked) =1 · High probability of assets being attacked.

[0082] The inventive approach makes it possible to calculate a site's health status rank and infection risk (based on the same calculations for the corresponding assets), and the calculation of these two values ​​over time makes it possible to track and predict the cybersecurity posture of complex, geographically distributed and interconnected networks.

[0083] The idea of ​​this method is that the ideal starting situation at time 0 (first iteration), where everything is installed on a site from scratch and has new, secure software, is a perfect situation where all assets have an infection risk equal to 0 and a health status rank equal to 10.

[0084] Starting with the second iteration, this initial ideal situation rapidly deteriorates with assets being infected by external actors, and these events are triggered by the existence and evolution of vulnerabilities and how large their attack surface is, for example, given any defensive measures taken to prevent them.

[0085] Starting from the second iteration, assets can become contaminated by other infected assets. This flow is mainly driven by the I factor of ongoing infection and measures that can be taken to prevent the spread of the infection. Of course, even from the second iteration onwards, the flow of external actor infections remains active.

[0086] In one embodiment, the step of predicting the subsequent health status of each of the identified sites is performed for a predefined prediction time interval, in particular the predefined prediction time interval defining a scheduled time for calculating the next iteration, so that the artificial neural network is able to predict the health status within said prediction time interval.

[0087] Preferably, the steps of evaluating the actual health status of each of the identified assets and evaluating the actual health status of each of the identified sites are performed for a predetermined learning time interval, and the step of predicting the subsequent health status of each of the identified sites is performed for a predetermined prediction time interval, the prediction time interval being equal to the learning time interval. Thus, the prediction range corresponds to the training range.

[0088] The prediction function tries to understand what will happen in the subsequent iterations that occur after a predefined prediction time interval. The prediction time interval of the function can be set to, for example, 24 hours, and the method will try to predict the status of the system in the next 24 hours, assuming that all entities and data structures are updated to their current state. It is important to note that if the prediction time interval needs to be changed, the entire learning has to be started from scratch.

[0089] As already explained, the prediction function uses a machine learning approach in which a feed-forward artificial neural network is trained with back-propagation, which is used to build a model to understand the relationships between all considered factors (between them and over time) for each asset. f Asset_a (x)=y Here, "x" is called the pattern for a given feature set of the asset, and "y" is the estimated new health status rank.

[0090] Preferably, the 'x' vector is a pattern of features, as described herein. - asset a The current health status rank of the . - Asset a Aging Frequency ProbabilityOfBeingExploited(Asset_a) . - asset a Affects AgingFrequency ProbabilityOfBeingExploited(Vulnerability) The highest "n" value. - Aging Frequency ProbabilityOfContagion(Asset_b, Asset_a) The highest "n" value of asset b has a link to it a is a neighbor of. - asset b The highest "n" value of I factor active infection above, asset b has a link to it a is a neighbor of.

[0091] f Asset_a The artificial neural network for estimating N is a 3-hidden layer network with at least as many neurons in the hidden layer as there are features, i.e. 3*n+2.

[0092] The method is trained like this: At any given time, asset a For,X,to allow the method to evolve over time and not be biased by,past behavior. a has the most recent "m" entries.

[0093] In the first iteration (actual), behavior is observed and patterns are recorded. This method a To,add a pair (x,y) that computes a feature for,“x”,taking into account its previous health status rank and,taking “y” as its current health status rank.

[0094] The method starts predicting behavior when at least "z" iterations have been performed (the learning phase), where "z" is a parameter set during the learning phase. a I won't go into detail here, but X a Take a random 2 / 3 of f and use the remaining 1 / 3 to validate its performance using some form of metric like overall accuracy. Asset_a If the overall prediction accuracy is above a predefined number, i.e., 0.9, meaning that the prediction error was less than 10% on the test set, the predicted value of the asset health status rank is f Asset_a (x) = y. In any case, at each iteration, the actual observed value of (x,y) is X a to improve future predictions in further iterations.

[0095] In each temporal frequency table, for each entry, a decay factor is applied to the next iteration.

[0096] The above steps make it possible to predict the subsequent health status rank of each asset. The subsequent health status rank of a site is equal to the minimum predicted health status rank of the assets of which it is composed.

[0097] The above approach allows to have a complete, unsupervised operation of the algorithm. If a more complex asset-site combination function is desired, for example to give less weight to mostly isolated assets, several more steps would be required and a human expert would be required to provide knowledge to the system to understand the desired aggregation policy.

[0098] The method according to the invention therefore makes it possible to calculate automatic reports on the status of the network of sites with regard to risk and current health status, and to provide predictions on how it will behave in the near future.

Claims

1. 1. A method for predicting a health status of a distributed network by an artificial neural network, comprising identifying an object in the distributed network, identifying, by a computerized data processing unit operatively connected to the distributed network, one or more sites within the distributed network; identifying, by said computerized data processing unit, one or more assets of each of said identified sites; identifying, by the computerized data processing unit, links between the identified assets, the links being defined by data packets exchanged in the distributed network having a protocol field associated with a sending asset, a protocol field associated with a receiving asset, and a protocol field enabling communication between the sending asset and the receiving asset, and for each of the links, the sending asset and the receiving asset define a node, and a connection between the sending asset and the receiving asset defines the link between the nodes with a direction from the sending asset to the receiving asset; storing the identified sites, the identified assets, and the identified links of the distributed network in a storage unit of a persistent type operatively connected to the data processing unit; Including, The method for predicting a health status includes: evaluating, by said computerized data processing unit, an actual asset health status rank of each of said identified assets according to a predetermined set of asset health status values ​​ranging from worst asset health status to best asset health status; assessing, by said computerized data processing unit, an actual asset infection risk for each of said identified assets according to a predefined set of asset infection risk values ​​ranging from maximum asset infection risk to no asset infection risk; calculating, by the artificial neural network operated by the computerized data processing unit, an actual asset infectiousness factor for each of the identified assets as a probability that an infection of the asset can spread to other assets according to the identified links; evaluating the actual health status of each of the identified assets in an actual iteration, The method for predicting a health status includes: evaluating, by said computerized data processing unit, an actual site health status rank of each of said identified sites as equal to a minimum actual asset health status value of said assets within said site; assessing, by said computerized data processing unit, an actual site infection risk for each of said identified sites as being equal to a maximum asset infection risk value of said assets within said site; evaluating the actual health status of each of the identified sites in the actual iteration, The method for predicting a health status further comprises predicting, by the artificial neural network operated by the computerized data processing unit, in a subsequent iteration, a subsequent health status of each of the identified sites according to a prediction function based on a set of prediction values ​​including the actual asset health status rank, the actual asset infection risk, the actual asset infection agent, the actual site health status rank, and the actual site infection risk. A method for predicting the health status of a distributed network via an artificial neural network.

2. the step of evaluating the actual health status of each of the identified assets and the step of evaluating the actual health status of each of the identified sites are performed for a predetermined learning time interval; the actual asset health status rank of each of the identified assets, the actual asset infection risk of each of the identified assets, the actual asset infection agent of each of the identified assets, the actual site health status rank of each of the identified sites, and the actual site infection risk of each of the identified sites are stored in the storage unit; 2. A method for predicting a health status of a distributed network by an artificial neural network according to claim 1.

3. the step of evaluating the actual health status of each of the identified assets and the step of evaluating the actual health status of each of the identified sites are performed for a predetermined learning time interval; the actual asset health status rank of each of the identified assets, the actual asset infection risk of each of the identified assets, the actual asset infection agent of each of the identified assets, the actual site health status rank of each of the identified sites, and the actual site infection risk of each of the identified sites include a plurality of values ​​defined at a predetermined learning point in the predetermined learning time interval; 2. A method for predicting a health status of a distributed network by an artificial neural network according to claim 1.

4. the step of evaluating the actual health status of each of the identified assets and the step of evaluating the actual health status of each of the identified sites are performed for a predetermined learning time interval; the actual asset health status rank for each of the identified assets, the actual asset infection risk for each of the identified assets, the actual asset infection agent for each of the identified assets, the actual site health status rank for each of the identified sites, and the actual site infection risk for each of the identified sites include a plurality of values ​​defined as changing during the predetermined learning time interval; 2. A method for predicting a health status of a distributed network by an artificial neural network according to claim 1.

5. 2. The method for predicting the health status of a distributed network by an artificial neural network as recited in claim 1, wherein the step of predicting the subsequent health status of each of the identified sites is performed for a predetermined prediction time interval.

6. the step of evaluating the actual health status of each of the identified assets and the step of evaluating the actual health status of each of the identified sites are performed for a predetermined learning time interval; the step of predicting the subsequent health status of each of the identified sites is performed for a predetermined prediction time interval; The prediction time interval is equal to the training time interval.

2. A method for predicting a health status of a distributed network by an artificial neural network according to claim 1.

7. 2. A method for predicting a health status of a distributed network by an artificial neural network as claimed in claim 1, wherein said artificial neural network is of the feedforward type trained with backpropagation.

8. the artificial neural network is a three-hidden layer network having at least as many neurons in the hidden layer as there are sets of predictors; A different artificial neural network is used for each of the identified sites.

2. A method for predicting a health status of a distributed network by an artificial neural network according to claim 1.

9. the set of predictive values ​​also includes a frequency value over time for each of the identified assets within the identified site; The computerized data processing unit calculates the frequency values ​​over time for the next iteration for each of the assets by applying a predetermined decay factor to the infectious agent of the actual asset in the actual iteration.

2. A method for predicting a health status of a distributed network by an artificial neural network according to claim 1.

10. 2. The method for predicting the health status of a distributed network by an artificial neural network as claimed in claim 1, wherein the infection factor is calculated for each of the identified assets by the artificial neural network operated by the computerized data processing unit as the maximum between the asset's actual asset vulnerability factor, which is the probability that a vulnerability will affect the asset, and the asset's actual asset spread factor, which is the probability that a further asset will attack the identified asset following the identified link.