Managing attack surface vulnerabilities of a network

Abstract

Embodiments include creating a simplified network tree from information contained in network devices, including load balancers and firewalls, for security analysis. The tree may model relevant security devices or network configuration points in the network to simplify the study of a network for compliance and network anomalies. A list of network devices, including externally exposed devices with externally exposed IP addresses and a plurality of internal network devices may be stored. A graph may be generated which may include a plurality of network tree paths, each network tree path containing nodes representing IP addresses of network devices in the network tree path and links between nodes representing a configuration policy. The graph may be used to detect network vulnerabilities.

Description

PATENT Attorney Docket No.079900-1449399-7039WO01 Client Ref. No.7039WO01 MANAGING ATTACK SURFACE VULNERABILITIES OF A NETWORK CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] The present application claims the benefits of and priority to U.S. Provisional Application No.63 / 586,826, filed on September 29, 2023, which is incorporated by reference in its entirety. BACKGROUND

[0002] Exposure to external IP addresses and the path that an external IP address takes to an internal resource (e.g., such as through an internal network) can create a number of points of failure for a security policy (e.g., a firewall). These threats, potentially leading to compromised sensitive data, disrupted operations, and damaged reputations, underscore the critical need for effective cybersecurity controls.

[0003] Existing tools for modeling network topologies are difficult to configure, computationally demanding, and often limited to specific network appliance vendors or device types. This often results in undiscovered coverage gaps due to the complexity and difficulties in analyzing the resultant models. Furthermore, the use of tools such as load balancers can add an extra layer of complexity to network topology modeling. This extra complexity is more pronounced and less helpful on certain types of on-premises networks, such as for example networks that rely heavily on reuse of IP addresses.

[0004] Additionally, current existing network topology tools, such as traffic routing trees alone, cannot inherently relate to security protocols or controls for devices on the network or security protocols thereof.

[0005] Thus, there is a need for simplified network topologies tailored to security needs and reflective of network or security protocols. BRIEF SUMMARY

[0006] Embodiments of the disclosed technology may allow for the creation of a simplified network tree, which can allow for simplified analysis of the network for network anomalies. A 78859730V.1logical topology of the network can be modeled, rather than a modeling of each and every component of the network and each component of traffic flow. The network tree paths can comprise a graph illustrating paths for an internal network starting at one or more external- facing devices. Embodiments may also include metadata included as part of the network tree, such as for example, security policies.

[0007] Embodiments include methods for managing network vulnerabilities of a network environment. The method may be performed by a computer system. The method may include any combination of the following. A list of network devices may be stored, including a plurality of externally exposed devices with externally exposed IP addresses and a plurality of internal network devices, including internal endpoints. The method may include generating a graph containing a plurality of network tree paths, each network tree path containing nodes representing IP addresses of network devices in the network tree path and links between nodes representing a configuration policy, where generating the graph may include constructing each of the plurality of network tree paths by: (i) translating an externally exposed IP address to an internal IP address corresponding to a root node of an externally exposed network device; (ii) establishing one or more links between the root node to one or more intermediate nodes corresponding to one or more intermediate network devices listed in one or more configuration policies of the root node; (iii) iteratively selecting an intermediate network device and establishing links between a corresponding intermediate node to one or more lower-level nodes corresponding to one or more other network devices listed in one or more intermediate configuration policies of the selected intermediate network device, until an internal endpoint is reached, for each intermediate node. The method may include detecting network vulnerabilities using the graph. Additional aspects of the disclosed technology include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices.

[0008] Embodiments of the disclosed technology include a system of one or more computers that can be configured to perform particular operations or actions by virtue of having software, firmware, hardware, or a combination of them installed on the system that in operation causes or cause the system to perform the actions. One or more computer programs can be configured to perform particular operations or actions by virtue of including instructions that, when executed by data processing apparatus, cause the apparatus to perform the actions. 78859730V.1

[0009] Embodiments of the disclosed technology may include one or more of the following. Each network tree path may be created by creating edges between nodes from relationships derived from firewall network address translation (NAT) rules. The plurality of network tree paths may include paths that may pass through a plurality of network components, including routers, network security appliances, firewalls, load balancers, and servers. The graph may be dynamically updated to reflect changes in any of network configuration, IP address assignment, network component addition, network component removal, or network appliance configuration changes. The plurality of network tree paths may contain a routing policy related to respective nodes of the plurality of network tree paths. Relevant security configuration information may include any of IP information, firewall access control list (ACL), firewall NAT, router ACL, load balancer details, WAF enrollment, or IDS enrollment. The method may include evaluating each node and its links for their compliance to appropriate security controls based on a security configuration rule. The method may include identifying one or more attack surface anomalies based on the evaluation and performing remediation measures responsive to identification of at least one attack surface anomalies. The one or more attack surface anomalies may be one of a broken path, public IP / Virtual IP (VIP) reuse, router access control lists exceeding one or more criteria, firewalls allowing a metric related to traffic exceeding one or more criteria, or vulnerabilities in network segmentations. The method may include analyzing an IP address using the graph to determine whether the IP address associated with the network is reusable within the network without creating a network misconfiguration. Analyzing the IP address may include determining whether the IP address is a non-rfc1918 internet address. The analysis may be initiated upon a request for to provision a new node, a new network device, or a new network component. Analyzing may include recursively examining each nodes the graph for one or more criteria related to the IP address. The one or more criteria include (i) whether the IP address is related to a server, (ii) whether the IP address is related to a load balancer, (iii) whether the IP address is related to a member of a load balancer pool, (iv) whether the IP address is associated with an existing NAT rule, or (v) whether the IP address is associated with an existing NAT address. The one or more links may be represented with a positive integer within an array or matrix. The method may include accessing a policy stored for the intermediate network device, and identifying one or more other network devices to which a packet may be routed from the intermediate network device if there is a match in one or more criteria of the accessed policy. 78859730V.1

[0010] Implementations of the described techniques may include hardware, a method or process, or computer software on a computer-accessible medium. Additional aspects of the disclosed technology may include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices.

[0011] These and other embodiments of the disclosure are described in detail below. For example, other embodiments are directed to systems, devices, and computer readable media associated with methods described herein.

[0012] A better understanding of the nature and advantages of embodiments of the present disclosure may be gained with reference to the following detailed description and the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] FIG. 1 illustrates an example network according to aspects of the disclosed technology.

[0014] FIG. 2 illustrates an example network tree with IP addresses according to aspects of the disclosed technology.

[0015] FIG. 3 illustrates an example method to create a network topology from network components according to aspects of the disclosed technology.

[0016] FIG.4 illustrates a network topology with a simplified view, including DNS records, according to aspects of the disclosed technology.

[0017] FIG. 5 illustrates an example method to allow for the addition of security rules or security data with respect to a network tree according to aspects of the disclosed technology.

[0018] FIG.6 illustrates an example method of creating a network tree according to aspects of the disclosed technology.

[0019] FIG.7 illustrates example IP misconfigurations according to aspects of the disclosed technology.

[0020] FIG.8 illustrates a method to safely recycle IP addresses according to aspects of the disclosed technology.

[0021] FIG. 9 illustrates an example computer system according to aspects of the disclosed technology. 78859730V.1TERMS

[0022] Prior to discussing embodiments of the disclosure, some terms can be described in further detail.

[0023] Virtual IP (VIP): A virtual IP (VIP) may be an IP address that does not necessarily correspond to a physical network interface. For example, in one-to-many network address translation (NAT) configurations, a VIP address may be advertised from the NAT device (often a router), and incoming data packets destined to that VIP address may be routed to different actual IP addresses (with address translation). A VIP address may have several variations and implementation scenarios.

[0024] Router: A router can be any combination of hardware and software which can interpret an incoming request and route one or more packets or other information.

[0025] On-Premises Network or Internal Network: An on-premises or internal network can refer to a network which is internally connected through load balancers, web servers, database servers, gateways, firewalls, and other internet components. The on-premises or internal network may only be exposes to an external user or device through one or more access points into the network, such as through a firewall or other device.

[0026] Load Balancer: A load balancer can be any combination of hardware and software, including virtual machines, which can allow for the distribution of incoming network traffic, requests, or access or usage of network resources across one or more backend servers, server pools, virtual machines, or sever farms.

[0027] Network Layer: A network layer may refer to one of multiple network layers. As a non-limiting example, various layers may include the networking infrastructure open system interconnect (OSI) model for layers, where seven layers (L1, L2, L3, .... L7) are described.

[0028] Graph: A graph may refer to a mathematical structure which may be used to model a relationship between multiple objects. A graph may contain vertices or nodes, which can be connected by edges. Graphs may be direct graphs or undirected graphs. Graphs may formally be depicted through the use of ordered pairs, including a set of vertices and edges.

[0029] Tree: A tree may refer to a structure which can contain a set of nodes. A tree may be a hierarchical structure, with a “root” node and other nodes connected to the root node directly or through other nodes. A tree may be non-cyclical, thus ensuring that a unique path exists 78859730V.1between any two nodes. A tree may also have layers, starting at a first layer (e.g., a top layer) and proceed to a final layer (e.g., the bottom layer). A tree is a type of graph.

[0030] Server: A “server” may include a computer or cluster of computers. For example, the server computer can be a large mainframe, a minicomputer cluster, or a group of servers functioning as a unit. In one example, the server computer may be a database server coupled to a Web server. The server computer may comprise one or more computational apparatuses and may use any of a variety of computing structures, arrangements, and compilations for servicing the requests from one or more client computers.

[0031] Application: An “application” may be computer code or other data stored on a computer readable medium (e.g., memory element or secure element) that may be executable by a processor to complete a task.

[0032] Network Address Translation (NAT): Network address translation can map private IP addresses (whether real or virtual) inside a internal network to a public IP address before transferring information from within the internal network to an external device through the internet. Network address translation (NAT) may map an IP address space into another IP address space through the modification of network address information, such as in the IP header of packets being transmitted in the network, while they are in transit across a traffic routing device. For example, IP packets may have a source IP address and a destination IP address. As one example, packets passing from the private network (e.g. internal or on-premises network) to the public network may have their source address modified, while packets passing from the public network back to the private network will have their destination address modified. As an example, an organization which may use a single IP address, such as a website, but uses multiple devices associated with that IP address may use NAT. NAT may hide IP addresses of network devices on an internal network that may be in a non-public private address range, such as those defined in the RFC 1918 standards created by the Internet Engineering Task Force, to a public IP address. Hiding may be achieved through translation of IP addresses. For example, translation may include replacement of source or destination IP addresses in packets with other IP addresses. NAT rules define how NAT is applied to traffic. Hiding the addresses of protected devices preserves the limited number of IPv4 addresses and is a defense against network reconnaissance since the IP address is hidden from the Internet.

[0033] Firewall: A firewall may be a network security device that monitors incoming and outgoing network traffic and permits or blocks data packets based on a set of security rules. A 78859730V.1firewall can be hardware, software, software-as-a service (SaaS), public cloud, virtual machine, a private cloud, or any combination of the forementioned. Firewalls may also perform basic network level functions such as Network Address Translation (NAT) and routing of packets within a network. A firewall may also contain a firewall configuration file, firewall settings, or other firewall information, any of which may contain rules for NAT.

[0034] Configuration Management Database (CMDB): A configuration management database (CMDB) may be a configuration file which may contain information about an organization’s internal network, including information about hardware and software components and relationships between those components. A CMDB may contain one or more configuration items (CIs). A CI may be any network or infrastructure component, including software, hardware, storage devices, access control rules, other rules (e.g., network rules, forwarding rules, server use rules, server access rules), and relationships between the components. A CMBD may be parsed to obtain metadata and other information about an organization’s internal network. DETAILED DESCRIPTION

[0035] Embodiments can allow for the creation of a simplified network tree, which can allow for simplified analysis of the network for network anomalies. A logical topology of the network can be modeled, rather than a modeling of each and every component of the network and each component of traffic flow. Such a network topology can include “micro” network tree paths that depict paths directing traffic from outside an organization or internal network to the internal network or “on-premises” network. The network tree paths can comprise a graph illustrating paths for an internal network starting at one or more external-facing devices. Embodiments may also include metadata included as part of the network tree, such as for example, security policies.

[0036] The graph can include a set of nodes, each node corresponding to a network device. Each network device can be assigned a unique identifier, such as an IP address, a domain name, or other identifier sourced or derived from one or more configuration files associated with the network. For example, a configuration management database file or configuration item files may be used. The configuration files may be stored at a device controlling the operation of the network or may be distributed at various devices within the network. To track a network path, an externally exposed IP address can be translated to an internal IP address, thereby enabling the linking of nodes of the internal network. Intermediate nodes corresponding to one or more 78859730V.1intermediate network devices can then be identified from one or more configuration policies of the root node, and so on. The nodes can then be linked in a tree, e.g., with each lower layer comprising nodes from configuration policies of a higher node in the tree until a leaf node (final node) of a tree is reached. Each network tree path can correspond to a particular set of policies applied to a given network packet that is received at an externally exposed network device. In this manner, many network tree paths can be formulated and combined to form the graph.

[0037] The graph can be simplified, or formulated by excluding certain aspects of the network, thereby providing a more efficient mechanism for tracking network vulnerabilities. For example, embodiments may ignore or not include conditional routing, network appliances, or forwarding appliances in the flow of packets to allow for simplified modeling of a network and to allow for a simplified view from a logical topological perspective. Embodiments can also allow for examination of policy enforcement points (e.g., a firewall or a load balancer) within a network tree path. A policy enforcement point can correspond to any node that applies a policy for rejecting or accepting a network packet, adds metadata to a network path, modifies a packet, or a decision about which one of a plurality of subsequent devices to route the packet to. Since the graph of network tree paths is generated using the configuration policies, the operation of the policy enforcement points is built into the graph itself, thereby allowing examination of such points. Such policy enforcement points are conventionally invisible in cases of conventional IP routing detection tools.

[0038] As one advantage, some embodiments can enable detection and remediation of traditionally challenging issues like direct-to-origin detection and remediation and organizational web application exposure to the internet. Organizational web application exposure may include identifying all externally application exposed applications which may be hosted on an internal network. In some embodiments, exposure may be managed by checking and reporting g for missing enrollments to internal on-premises services that can mask an origination IP to external malicious actors. By doing so, the external malicious actors may be prevented from bypassing various security layers and protection mechanisms.

[0039] For instance, to check the integrity or compliance of a network, some embodiments can traverse through each path of a completed network tree (e.g., from the root of the tree to each final “leaf” of the tree) to evaluate whether the endpoint is properly enrolled in all the required controls that would, for example, constitute “direct-to-origin” (DTO) coverage exposure protection. This can be achieved by analyzing relevant firewall configurations, load 78859730V.1balancer configurations, accidental disclosure of origin information, etc. and analyzing how these configurations interact with one another. For example, DTO related detection may be performed by traversing a tree and examining all paths between a root node and any server running a specific application. Once all paths are determined, the configurations associated with each node in those paths may be examined to ensure that the configurations align with required DTO related requirements. The DTO requirements may include for example, determining the proxy configuration status for a network of servers (e.g., CloudFare), the firewall rules that are allowed to determine access to those servers, and an examination of information disclosed in certificates associated with the application.

[0040] Additionally, instead of assuming one IP address per device, embodiments can have multiple nodes, including DNS records and internal application servers, to join the network tree path. Each of such devices can correspond to a different node and have a different identifier, even though they might have the same IP address. This more granular view enables the enforcement of security policies in a more context-aware manner, thus providing a more comprehensive method of assessing and mitigating cybersecurity risks. Unlike existing commercial solutions, embodiments allow for a more specific, tailored understanding of the network’s structure, which is particularly useful for larger enterprises with on-premises networks. I. EXAMPLE FIREWALL AND INTERNAL NETWORK

[0041] As described above, embodiments can be used to manage network vulnerabilities. A network is vulnerable starting at an externally exposed network device that has a public IP address. Such an externally exposed network device can include a firewall. Other network devices may be externally exposed when accessed by or communicating with a device external to the network. Various types of devices can occur after the initial firewall, including other firewalls, load balancers, servers, gateways, etc. An example network with such devices is now described.

[0042] FIG.1 illustrates an example network 100. Network 100 illustrates various possible pathways for traffic through network devices. Network 100 may allow multiple external users 110 to access an internal network 199 through a public domain name or other publicly known access point. The topology illustrated for network 100 includes one or more external users 110, which can access resources at an internal network 199 through a router 120. As 78859730V.1further explained below, the topology of internal network 199 may be modeled using network trees and analyzed for network anomalies. As one example, users 110 may desire to access one or more applications on internal network 199, which may be residing on web servers 170. Although not illustrated, network 100 may also have an associated configuration management database that provides information about the network points.

[0043] Router 120 can receive a website name and perform a domain name system (DNS) lookup to identify a corresponding network address. Router 120 use a DNS resolver to connect with a DNS root name server. Router 120 may then connect to one or more firewalls, such as firewall 130, which has the public network address. The firewall 130 (or other externally exposed network device) can also have an internal network address, also referred to as a virtual IP (VIP) address. One or more VIP addresses may be associated with one or more internal connections of the internal network 199 to other devices, such as a load balancer 141 and a load balancer 142. Load balancers may be any combination of hardware or software, including virtual machines, which may allow for requests to be distributed to one or more resources or applications (e.g., web servers or database servers).

[0044] Load balancer 141 and load balancer 142 are examples of intermediate devices. Each intermediate network device can have a VIP address for incoming network packets, and each intermediate network device can possibly route a packet to one or more other network devices that each have their respective VIP address. A network device, which can be represented as a node in a graph, can include a configuration policy that lists such later network devices in one or more paths from the network device. Such a configuration policy can be used to determine nodes in lower layers in a network tree to which a given network device can route a network packet. Additional examples of intermediate devices include routers, bridges, Web Service Infrastructure (WSI) devices, gateways, and switches.

[0045] A gateway 150 is another example of an intermediate network device and may be a network node used to connect different transmission protocols together or subnetworks together. A gateway may serve as an entry and exit point as data must pass through or communicate with the gateway prior to being routed. Gateway 150 may be for example, an IBM® DataPower® Gateway, to allow for a single gateway platform to integrate security and control functions.

[0046] While a simplified topology is illustrated, network 100 may include any number of internal firewalls, load balancers, and components. Network 100 may also have a number of 78859730V.1“endpoints” which can be a final destination for a packet or network traffic to arrive, such as for example, web servers 170 or database servers 160. While not illustrated, web servers 170 may contain one or more applications which can enable interaction between a request and content delivered to an external user. A port address may identify a particular application that a user operating a user device wishes to connect.

[0047] As further explained below, network 100 may be modeled to illustrate the components that are relevant to determining security and compliance of the network. II. EXAMPLE NETWORK GRAPH

[0048] A graph of network tree paths can be generated that correspond to a network, e.g., as shown in FIG. 1. Each node in an example tree can represent any point of interest within a graph which may be relevant from a network security perspective. In some examples, nodes may be determined by a set of rules. For example, a set of firewall rules may be represented as a node in the graph which may be located between a node representing a load balancer and a node representing a server. Nodes may represent an IP address within a network and its associated device. A root node in the tree representing the externally exposed IP. The externally exposed IP address may be the first point of entry into the internal network. Each link or edge between nodes can denote relationships between the nodes and their corresponding devices. Every node, edge, and path between any two nodes can be evaluated to ensure compliance with existing cybersecurity and network controls. In some examples, nodes which are expected to be connected and are not may also lead to an inference of non-compliance with a security policy related to the network. In some examples, all possible routes from a network address translation perspective or from a specific device’s perspective in the network can be illustrated with a tree.

[0049] FIG. 2 illustrates a tree 200 according to embodiments of the disclosed technology. Tree 200 may be one example visualization of a network. Tree 200 may be a hierarchical tree. Tree 200 may illustrate a network in a simplified view where certain network components are not included and the network is represented from a logical perspective. Tree 200 may contain a number of nodes and a number of edges connecting the nodes. Nodes 210, 220, 231, 232, 241–244, and 251–258 are illustrated in FIG. 2. Edges E1–E15 are illustrated in FIG. 2. Each node may have a corresponding IP address or virtual IP address. Each edge may represent a connection between two nodes, which may be established when rules related to the network are met. Layers 1 to 5 are illustrated in FIG.2. 78859730V.1

[0050] Tree 200 may be described or viewed from the perspective of multiple layers. Each layer in the network may correspond to a particular type of network component (e.g., a firewall, a security component, a load balancer, or a server). Layer 1 may be the first layer of the tree from which an external IP may access the internal network. Layer 1 may be a firewall layer or externally exposed lawyer. Tree 200 contains node 210 which may be a firewall. Layer 2 may be a second layer which connects to the nodes contained in layer 1. Layer 2 may correspond to a load balancer layer which contains one or more load balancers, such as node 220 which is a load balancer. In FIG. 2, node 210 in layer 1 connected to node 220 in layer 2 through edge E1. Other layers may similarly correspond to a specific functionality or component within a network, such as web services interfaces, secondary load balancers, servers, or applications.

[0051] Layer 3 may be a web service interface layer which contains nodes 231 and 232 which connect to node 220 in layer 2 via edges E2–E3. Layer 3 also connects to nodes 241– 244 in layer 4 via edges E4–E7. Nodes 241–244 in layer 4 also connects to nodes 251–258 in layer 5 via edges E8–E15. Layer 5 may contain all the nodes which are the final nodes of tree 200 to which packets from node 210 may be directed.

[0052] Tree 200 may also be viewed from the perspective of nodes and edges which connect the nodes. Node 210 may be a “root node” or a starting node for the tree to which other nodes are attached via edges. Node 210 may be an access point to the internal network and have an externally exposed IP address. Thus, node 210 may be the first node that is reached by a network packet when a user attempts to communicate with a network device downstream of node 210. Node 210 may correspond to a firewall, e.g., firewall 130 described with respect to FIG. 1. Node 210 may connect to node 220 via edge E1. Edge E1 may be created when a predetermined rule is met regarding connection of nodes, as explained further below.

[0053] Node 220 may be a load balancer, which may direct traffic which is received from node 210 to other nodes, such as nodes 231 and 232. Node 220 may be identified by parsing information available to or stored at firewall 210, such as for example a configuration file. The configuration file need not be stored at the firewall 210 but may be accessible by the firewall 210. Node 220 may be a network load balancer, which may make routing decisions to distribute network traffic across multiple network resources (e.g., virtual machines or servers) to avoid overloading a single point on the network. In some examples, the network load balancer makes routing decisions on the level of a transport layer (e.g., TCP / SSL) to forward requests it receives. 78859730V.1

[0054] Nodes 231 and 232 may be a Web Service Infrastructure (WSI) node. A WSI node may allow software applications to exchange data over the network by using standards like XML and HTTP and thus provide interoperability and extensibility. A WSI node may also provide integrated solutions for load balancing, routing, and security. A WSI node may be an IBM™ DataPower Gateway. Nodes 231 and 232 may be connected to nodes 241-242 and nodes 243-244 respectively. A particular packet may be routed to node 231 or 232 from node 220 based on a configuration policy enforced at node 220. Node 220 may attempt to balance the traffic being transmitted to node 231 and to node 232 to increase the efficiency, reliability, or other performance metric of the network. In some examples, a particular packet may be routed to node 231 or 232 based on the type or category of an incoming packet at node 220. In some examples, downstream information from nodes 231 or nodes 232, such as the availability of servers, may be used in determining how traffic is transmitted.

[0055] Nodes 241–244 may be secondary load balancers. Secondary load balancers may be making routing decisions at an application layer (HTTP / HTTPS) to distribute requests to an available application or server to avoid overloading one instance of an application or a particular server. Nodes 241–244 may be connected to nodes 251–258 as illustrated in FIG.2 via edges E8–E15.

[0056] Nodes 251–258 may be the end points or final nodes of the tree. Nodes 251–258 may illustrate servers which contain resources or applications which are requested by a device external to the network illustrated by tree 200. For example, the nodes annotated with “Application 1” in FIG.2 may be a first server and nodes annotated with “Application 2” may be a second server which are load-balanced and accessed from previous layers. The various nodes in layer 5 of FIG.2 may correspond to unique pathways through which the first server or second server may be accessed.

[0057] The tree paths contained in tree 200 contain any set of nodes connected by a set of edges. For example, one tree path may be formed from node 231, edge E4, node 241, edge E9, and ending in node 252. Another example of a tree path may include node 220, edge E3, node 232, edge E6, node 243, edge E13, and node 256. A tree path may also be represented by an ordered set, such as {Node 231, Edge E4, Node 241, Edge E9, Node 252}. In other examples, a tree path may be represented by an ordered set which does not include the edges as tree 200 only contains a single edge connecting any two nodes. Thus, the previously mentioned example tree path may be represented as {Node 231, Node 241, Node 252}. The 78859730V.1maximum depth or a tree path of tree 200 is limited to the number of layers of tree 200. In the example illustrated in FIG.2, a tree path may have a maximum of 5 nodes. In some examples, traffic may be assumed to return using the same pathway that it reached a final node in a path. For example, if traffic from node 210 to node 252 was transmitted through node 220, 231, and node 241, it may be assumed in some examples that the traffic will return back from node 252 to node 210 via nodes 241, 231, and 220.

[0058] Tree 200 may be a binary tree in that each node from layer 2 to layer 5 connects to a maximum of two other nodes. However, it is to be understood that any arbitrary network topology, with any number of layers and nodes may be illustrated through a tree structure. As further explained herein, tree 200 allows for any path or sub-path of the network represented by tree 200 to be evaluated for security, compliance, or other policy. Tree 200 models not simply the routing of packets, but all possible paths through which traffic may be routed in the network. In turn, the tree allows for a complete evaluation of business rules, compliance, or security. Additionally, any subset of the tree or any node within the tree can be chosen arbitrarily for analysis. For example, the tree 200 can be evaluated from the bottom most node and the network evaluated upwards. III. CONSTRUCTING A NETWORK GRAPH

[0059] The construction of a network graph or network tree may be based on information available in configuration files, such as a Configuration Management Database (CMDB) , which can include configuration policies, such as network translation rules. An administrator can provision one or more configuration files of a first network device with policies to define what other network devices the first network device can send packets. Each policy can define one or more criteria (e.g., sender information, destination information, port numbers, service request, quality of service requested, etc.) along with a subsequent network device to send a packet when the criteria is matched. A configuration file can be provisioned at various points in the network, such as in load balancers, firewalls, or other network devices. This process is explained below. A. Example Uses of Configuration files, ASNs, and NAT rules to generate a Network Tree

[0060] Network information may be distributed at various components in the network, such as at firewalls, load balancers, and other points within the network. In order to create a tree, 78859730V.1such as tree 200, information contained within the network must be obtained, parsed, and processed to identify which network components may be represented as nodes, and which nodes may be connected with edges. In some examples, such as when information about the entire network is available within a single configuration file (e.g., a CMBD), the file may be obtained and analyzed to create a mapping.

[0061] However, when a single source of information for the network is not available, information which may be distributed across various network components may be collected, parsed, and formatted. For example, the information may be contained within multiple files such as load balancer configuration files, load balancer pool files, firewall configuration files, or other files related to the network. This information may optionally be amalgamated into a single file. For example, as a firewall may be expected to be the first point within an internal network when accessed from an external source, data related to the firewall configuration (e.g., a firewall configuration file) may be accessed. This data may refer to other network components (e.g., load balancers or server pools). These network components may contain data (e.g., a load balancer configuration file) which may point to other potential network components and provide information about a relationship between these additional network components. This process may occur recursively until a network component which may be an endpoint (e.g., a server, a server pool, or an inert or deprecated network component) is reached. This endpoint may later be mapped to a leaf within a network tree.

[0062] In some examples, information to generate a network tree can be based on an identified Autonomous System Number (ASN). An ASN is assigned or provided for an organization or network. An Autonomous System (AS) is a group of one or more IP prefixes (lists of IP addresses accessible on a network) run by one or more network operators that maintain a single routing policy. Network operators require ASNs to route information within their networks and exchange routing information with Internet Service Providers. The ASN can then be used to lookup or generate one or more subnets within the network based on IP prefixes related to the ASN.

[0063] For each subset identified based on the ASN, a list of IP addresses, may be computed. Each IP address may be a potential node for a network tree, as explained further below. For the list of each IP address, a related network policy to the IP address may be examined for at least (i) routing information from a router; (ii) NAT information from a firewall, (iii) NAT information from a load balancer, (iv) server information from a CMDB , and (v) application 78859730V.1information from a CMDB. A network tree may be created by using this information through mapping.

[0064] Mapping may occur to convert the information obtained above into a network tree. Mapping may be a process through which the obtained network information can be transformed into a graph. Mapping may refer to a set of operations which may take elements of a given set (e.g., a set of network information) and associate those elements to a second set (e.g., a set of information such as nodes and edges representing a graph).

[0065] FIG. 3 illustrates an example mapping 300. Mapping 300 may occur between components of a network 310 to a network tree 320. The process of creating network 320 may include obtaining information contained within one or more configuration files. In some examples, such as the example illustrated with respect to FIG. 3, the information required to perform a mapping between network 310 and a network tree 320 may be distributed across the various components of network 310.

[0066] A firewall may be accessed from an external source through a public IP 311. The public IP may allow traffic to be directed to a network through firewall 312. Firewall 312 may contain firewall NAT rules within a firewall configuration file. This information may be mapped to node 330, representing firewall 312, along with the associated public IP. The associated IP address may be metadata associated with node 330. In some examples, additional metadata may also be associated with node 330, such as specific security rules or forwarding rules. Edge E335 may be generated based on the NAT rule to indicate that node 340, discussed below, may be reached from node 330.

[0067] A configuration file associated with firewall 312 may direct traffic to load balancer 314 through VIP address 313. Load balancer 314 may have a load balancer configuration file. Information from the load balancer configuration file may be used to map the load balancer 314 to node 340. The VIP address of the load balancer may also be associated with node 340. The load balancer configuration file may further contain information about server IPs (SIP) 315. This information may be used to generate edges E345 and edge E355 which are linked to nodes 350 and 360 respectively. Stated alternatively, the configuration policies for load balancer 314 are accessed to determine that at least policy allows for routing to one SIP and at least one policy will allow routing to another SIP. A node corresponding to each SIP, and corresponding edges will be created. 78859730V.1

[0068] The generation of network tree 320 may terminate upon reaching a network component which does not further have a configuration file indicating additional downstream components. In other examples, certain network components (e.g., an application or server) may be predetermined to be endpoints of the tree.

[0069] While an example process with illustrated with respect to FIG. 3, the process of creating a network tree can include additional steps. Whether two components with IP addresses can be “linked” or joined by an edge may be determined by a policy, such as a NAT rule. For example, a policy can specify one or more criteria and one or more network devices corresponding to the one or more criteria. The one or more criteria can include a particular web service, and if a network packet includes the particular web service, then the network packet would be routed to the corresponding one or more network devices. These policies may indicate the possible allowable paths between the nodes identified. Based on such policies, it can be determined that a possible path can be to the one or more network device identified in the policies. It is unknown whether a particular packet might ever be encountered in real life, but a critical aspects is that the possibility can be measured, thereby allowing testing of all possibilities. As one example a Web Application Firewall (WAF) enrollment may be required for a load balancer which is connected to a pool of servers (also referred to as a server pool) which are hosting instances of a web application. Regardless of whether or not a packet traverses through that specific load balancer to the servers, the rule may be required as the load balancer is intended to be associated with servers containing web applications.

[0070] As one example, as the first node from an external path is a firewall containing NAT rules, and a second node may be a load balancer, the first node and the second node may be joined when the private IP of the NAT rule of the firewall matches the IP of the load balancer. The generation of this edge is contextual as a firewall and a load balancer are the two nodes being examined to join with an edge. However, a different rule (e.g., one that does not rely on a match between IP addresses) may be used when two load balancers are being examined to join with an edge. Similarly, another function could be applicable to join a DNS node or a load balancer to an external IP with an edge.

[0071] In some examples, the nodes illustrated in Fig. 3 may be generated in isolation from one another. Stated alternatively, the nodes may be collected. Then, paths between the nodes may be generated based on information related to the network. For example, all NAT rules 78859730V.1contained within the network may be iterated across to see if a path may be formed between two nodes and whether those two nodes may be joined by an edge.

[0072] While a limited number of nodes are illustrated with respect to Fig.3 for simplicity, the process can be generalized for creation of a network tree. B. Example generated network trees

[0073] An externally registered DNS record is an identifier that allows external devices how to connect to a network. A DNS record may point to a particular IP address, which in turn may allow a network environment controlled by a particular entity, such as an owner of a particular website. A DNS record may also be associated with a specific ASN as discussed above. In specific cases, creating a network tree may also include mapping a domain name to an IP address (such as in the case of an “A record), or a domain name to a CNAME record (which in turn can be mapped to an IP address.).

[0074] FIG. 4 illustrates a network with multiple layers or levels to the tree. Stated alternatively, Fig. 4 illustrates multiple internal networks, each of which correspond to a domain name. Each internal network may have a different network graph and network topology.

[0075] Illustrated in Fig.4 is a tree 400 with multiple internal networks, such as internal network 410 and internal network 420. Tree 400 may have been generated using the techniques described above. For one or more domain names, a DNS record can be mapped to an external IP address. For instance, for the first domain name (Domain1), External IP1 may be determined.

[0076] With respect to internal network 410, Domain1 may be translated into external IP address1 associated with firewall 431. Packets sent to node 431 may be routed to other network components by a firewall. The firewall may contain a list of NAT rules which can be parsed to identify a list of devices to which the firewall may send packets. For example, packets may be sent to a load balancer 432 (associated with Primary VIP1) or load balancer 433 (associated with Primary VIPn). Although only load balancers 432 and 433 are labeled, the first level VIPs (labeled as “Primary”) can include ‘n’ VIP addresses (i.e., Primary VIP1to Primary VIPn). Similarly, a load balancer NAT rule can be used to map into “secondary” VIPs, which can include a finite number of addresses. Following this, additional layers or levels of the tree can be mapped using additional information from load balancer pools, and 78859730V.1information on the servers from the corresponding configuration items in CMDB. In this manner, the tree can include nodes up to the “application” level, labeled “App” in Fig.4. The application or the server may be an externally exposed endpoint, which is accessed by an external IP address or external user.

[0077] With respect to internal network 420, Domain2 may be translated into external IP2 associated with firewall 451. Internal network 420 may similarly use NAT rules to send packets directly to any of Server1452 to Servern 453.

[0078] An edge between two nodes, which represents an association or link between two nodes of the tree, may be determined based on rules discussed above. C. Adding Metadata to a Network Tree

[0079] A network tree may be annotated or otherwise associated with metadata. For instance, a VIP address related to the node may be considered metadata for that node. However, additional metadata related to the node may be added. By providing a network tree as an input, information related to network components represented by that node within the tree can be obtained and added to a particular node. An output may be a network tree where the nodes and edges contain additional data. In some examples, metadata may be added to the edges when such metadata may be useful to store information calculated regarding the relationship between those nodes. For example, an edge between an external IP and subsequent nodes (e.g., a load balancer node) may contain information regarding which ports are involved in traversing that edge. As another example, a relationship between a WSI node and a server node may contain information regarding which domain names may be routed down a path between those nodes. Another example may include metadata associated with rules and policies which are actively applied during a connection between a load balancer node and a server node (which may be part of a pool of servers in a load balancer pool).

[0080] For example, metadata related to each of the nodes may be added to provide additional context for the network tree. This information may include, for example, a description about access control lists, VIP settings, server metadata, application metadata, IP metadata, network layer level, active security protocols, firewall settings, underlying hardware information, or virtual device information. The added metadata may be used to enrich an analysis of the tree, and thus the underlying network, for network vulnerabilities and attack 78859730V.1surfaces. Further, the metadata added to the network tree can allow IP address reuse to be analyzed.

[0081] FIG.5 illustrates aspects of annotating or including data related to security rules to a created network tree. FIG. 5 illustrates method 500. Method 500 can be iteratively or exhaustively conducted through all nodes of a network tree to ensure that every node of the tree is analyzed. In some examples, the network tree can contain a ranked or numbered list of vertices and edges to allow method 500 to iteratively or exhaustively be conducted through all nodes. For example, the network tree can be numbered in a one-to-one correspondence with a finite subset of the natural numbers.

[0082] At step 520, it can be checked if the chosen node corresponds to a domain name. In some examples, the domain name may be the top-most node of a tree or the very first node of the tree. If at step 520, the node is a domain name (e.g., Domain1 discussed with reference to FIG. 4), metadata can be added to the node at step 521. For example, at step 521, content delivery network (CDN) or L7 load balancer details may be included as metadata with the node. The method may then proceed to step 510. If the criteria is not met the method may proceed to step 530.

[0083] At step 530, it may be checked if the node corresponds to an external IP address (e.g., if the node is a firewall). If the node meets the described criteria, the method may progress to step 531, where details including IP information (e.g., domain, hostname, subnet, network), router access control list (ACL), and firewall access control list (ACL) may be included at this node. The method may then proceed to step 510. If the criteria is not met, the method may proceed to step 540.

[0084] At step 540, it may be checked if the node corresponds to a virtual IP address, e.g., by being assigned to a network device that exists further into the local network. The virtual IP may be a primary or secondary VIP. If this is determined to be the case, details including VIP settings (e.g., from a server pool)from a load balancer configuration may be added at step 541. Example VIP settings may include configuration details related to load balancer configurations (including ports, protocols, policies applied for load balancing, active rules, etc.).

[0085] Additionally, at step 541 any combination of the following details may be added as metadata: IP information (domain, hostname, subnet, network), open ports, load balancer profile (certificate details, header injections details (e.g., X-Forwarded-For), pool monitor details, SSL decryption), IDS enrollment information, Full Packet Capture (FPC) enrollment 78859730V.1info (e.g., Moloch, Zeek), and WAF enrollment information. If the criteria at step 540 is not met, the method may proceed to step 550.

[0086] At step 550, it may be checked if a node corresponds to a server IP, such as with a server endpoint in a network tree. If so, server metadata may be added to the node at step 551. The metadata added at step 551 may include , for example, server details, file integrity monitor (FIM) information, IP table access control list, system event logging services, and anti-virus or host base IDS information. If the criteria identified in step 550 is not met, the method may proceed to step 560.

[0087] At step 560, it may be checked if the node is an application node. If so, application metadata may be added. This may include for example, library information, runtime information, authentication information, access-control information, log collection, and database information. The method may proceed to step 510. At step 510, it may be checked whether or not all the nodes of the tree are visited. If not, a particular node may be chosen or provided for analysis and the method may proceed to step 520.

[0088] When it is determined that all of the nodes with a network tree have been checked at step 510, the process may end at step 570. The metadata may be added to a database which corresponds to the nodes of the network tree.

[0089] While method 500 is described with respect to nodes within a tree, it is possible that metadata be added for edges within a network tree. The addition of metadata to one or more nodes within a network tree may allow for more robust analysis of the network tree. D. Creation and Analysis of Network Trees to Detect Network Vulnerabilities

[0090] As explained further below with reference to FIG.6, the created network tree can be utilized to detect and remediate network vulnerabilities.

[0091] FIG. 6 illustrates a method 600. Method 600 may be used to create a network tree. The network tree may be stored in a data structure sufficient to represent nodes and edges of the network tree. As one example, the network tree may be stored in a matrix. For example, network tree 320 described with respect to FIG.3 may be stored as follows:78859730V.1

[0092] A “1” in the matrix represents a connection between two nodes while a “0” represents no connection. As the network trees described herein are undirected (i.e., the edges do not have directionality associated with them), the matrix is symmetric around its diagonal. A data structure equivalent to the matrix may be stored in memory of a computer to reference a created network tree. Additionally, references to metadata may be included within the matrix as an array or with a pointer to another database.

[0093] At step 610, a list of network devices is stored by a computing system. The list of network devices may contain one or more externally exposed devices with externally exposed IP addresses and a plurality of internal network devices. In some examples, the list of network devices may be obtained from a single configuration file such as a CMDB. In some examples, the list of network devices may be derived based on information from a list of IP addresses obtained from an ASN related to the network. The information for this list may be obtained from firewalls, load balancers, and other network components as described above. For instance, the methods and techniques described above and more particularly with reference to Fig.3 may be used to store and access a list of network devices.

[0094] At step 620, a graph (e.g., as a network tree) is generated. The generation of the graph may include identifying one or more nodes. The identification of the nodes may be through provisioning one or more configuration files. In some examples, the generation of the graph may be based on a configuration file related to a firewall. Additional details of a generation of a graph, including the identification of nodes for the graph are discussed above in the section “Constructing a Network Graph” and FIG.3.

[0095] The generation of a graph may also include mapping IP translation rules to the nodes of graph as virtual IP or other IP address. Thus, the nodes of the graph will represent a network device and an associated IP address. Additionally, metadata related to the nodes may be augmented to the graph. As am example, this may be performed as discussed with to FIG. 5. The graph may contain a plurality of network tree paths. Each network tree path can correspond to a set of network devices through which a network packet can flow before reaching a destination network device. Each network tree path can contain nodes representing the IP addresses of network devices within the network tree path and an edge between the 78859730V.1nodes can represent a configuration or other connection between the two nodes. Tree 200 and the trees in FIG.4 are examples of such a network tree that may be generated.

[0096] Steps 630-650 may be performed as part of generating the graph.

[0097] At step 630, an externally exposed IP address can be translated to an internal IP address. This translated IP address can correspond to the root node of an externally exposed network device. For example, the translated root node of an externally exposed network device can be node 330 or node 210 described above. Additional example of root nodes for trees or subtrees are illustrated with respect to Fig.4. It may be noted that in some examples, there may be only a single root node for each internal network or on-premises network.

[0098] At step 640, one or more edges may be established between the root node and one or more intermediate nodes. The establishment of an edge may be performed upon certain criteria being met. The root node may be a firewall node or a domain name node. The one or more intermediate nodes may correspond to one or more intermediate network devices, such as load balancers, WSIs, or server pools. The one or more intermediate nodes may be nodes which are listed in the configuration policies of the root node, such as within a firewall policy. The edges may be stored within a matrix data structure described above. For example, a “1” in a matrix may represent the existence of an edge while a “0” implies no edge exists between the two nodes.

[0099] At step 650, intermediate nodes may be selected, and links between an intermediate node and other intermediate nodes may be established. This process may occur iteratively to create a complete network tree. Additional information on which intermediate nodes can be linked to other intermediate nodes can be found in other intermediate network devices. After all links have been established, the network tree graph can be considered complete or formed for a particular network tree. At this step, or other steps, additional security information related to the nodes can be added. For example, as explained with reference to FIG. 5, additional information can be added to the nodes.

[0100] At step 660, network vulnerabilities, anomalies, misconfigurations, or other exposures can be detected using the created network tree. The network tree may be used to determine which network elements are actually exposed to an external source. As one example, a server node in the network tree may include information regarding potential vulnerabilities (e.g., an application on a server). The server node may also be associated with ports from which the server may be accessed and services provided by the server. The tree 78859730V.1may be traversed to see if the potentially vulnerable service may be reached from the internet. Additional details of how these detections can occur is explained in additional detail below with reference to FIG.7. For example, the created network tree may reveal when a particular internal firewall is bypassed, when a particular load balancer cannot be reached due to a misconfiguration, or a particular server pool is unavailable due to a server IP not being accessed or obtained in a configuration file. Traffic which is traversing to an external IP (e.g., through a firewall) may be examined at various nodes within a network tree. For example, the protocols being used at various network layers to traverse the traffic may be examined. Additional attack surface anomalies for the network may include broken paths, public IP reuse, VIP reuse, router access control lists exceeding one or more criteria (e.g., violation of organization security policies represented as rules or industry best practices), firewalls allowing a metric related to traffic exceeding one or more criteria such as overly permissive rules or rules allowing traffic from unauthorized sources, or vulnerabilities related to network segmentation. Whether a rule is overly permissive may be based on established network standards or internal organizational standards. Other rules may include information related to headers, APIs, database access, local storage, device access, and authentication requests for example. Attack surfaces may include vulnerabilities in physical, virtual, or topological devices, and can include firewalls, switches, network file servers, and other devices. IV. EXAMPLE ANOMALIES IN NETWORKS

[0101] Anomalies, misconfigurations, vulnerabilities, security violations, or other operation defects with a network may be examined with respect to the created network tree. Discussed below are example anomalies illustrative of how a graph containing a plurality of network tree paths may be used. Various algorithms may be used to determine defects within the network, such as a depth first search algorithm. For example, it can checked that traffic from a load balancer can properly be decrypted using a Web Application Firewall by traversing a path in a depth first algorithm and ensuring a proper load balancer SSL orchestrator configuration (e.g., an SSL orchestrator rule or profile) is functioning. Upon detection of an anomaly in the network an alert or other indication can be generated related to the anomaly. The network tree can be recreated and reanalyzed following any corrective measures on the network. In some examples the network tree may be recreated from scratch periodically. In some examples, a portion of the network tree may be created only for the downstream portion from which a change is made and that portion may be stitched to an existing network tree to create an updated network tree. 78859730V.1

[0102] FIG. 7 illustrates example improper network configurations. The examples illustrated are simplified but it may be understood that more complex network misconfigurations may be possible. Misconfigurations may emerge from improperly timed decommissioning of network components. For example, it amy be determined that an external IP was not properly decommissioned if a NAT rule exists but not adjacent to load balancer exists corresponding to that NAT rule. An “X” in FIG.7 may represent an expected connection which may be missing. It is to be understood that the representation in FIG.7 is exemplary and other methods of using a network tree to examine network misconfigurations.

[0103] Example 710 illustrates a “dangling at firewall” misconfiguration. In this example misconfiguration, a load balancer entry is missing between a firewall and a load balancer. In this specific example, it is expected that between a firewall and a load balancer, a load balancer entry or VIP entry is expected to be present. However, when this entry is not present, it may be deemed that there is an improper configuration. Thus, the VIP address between the firewall and the load balancer is not recorded and data flow between the firewall and the load balancer may not occur.

[0104] Example 720 illustrates a “dangling at load balancer” misconfiguration. In this specific example, a server pool is missing between the load balancer and the servers containing SIPs. In this example, an IP entry is missing for a server pool between a load balancer forwarding or directing traffic to that server pool. In this example, data flow between the load balancer is not recorded or does not occur. Thus, this is a misconfiguration in that information may never reach a server as no server pool is recorded.

[0105] Example 730 illustrates a “stray” misconfiguration. In this example, there is no entry for a load balancer or a Web Application Firewall (WAF) in the network tree. Data from the firewall may thus bypass a load balancer and WAF and be directed to the server directly. In this misconfiguration, the firewall allows direct access to a server without a load balancer, web application firewall (WAF), or other intermediate components. Thus, this is a misconfiguration or security concern as network components which may regulate the inflow of packets are being skipped.

[0106] An advantage of the network tree is that anomalies between any two points can be checked without a complete check of the network tree. Thus, when a network topology is changed or upgraded, and a corresponding new network tree created, fewer nodes and edges may be checked for anomalies. Additionally, the modularity of the network tree allows for an 78859730V.1arbitrary check on any portion or subtree within the tree, leading to more efficiency and simplification of checking for network anomalies. Similarly, only certain sub-networks or subnets within an internal network may be examined.

[0107] Embodiments further allow examination of traffic traversing the paths, and the addition of metadata related to each node to enable visualization and determination of which communication protocols and security controls are actively being used along one particular path in a tree. Thus, a holistic view of a path to any externally exposed endpoint (e.g., a final node in a tree such as a web server or application) may be known and examined. V. NETWORK ADDRESS LIFE CYCLE MANAGEMENT

[0108] The network tree can advantageously be used to recycle IP addresses. IPv4 address exhaustion is the depletion of the pool of unallocated Ipv4 addresses. A safe IP recycling process can slow down Ipv4 address exhaustion without introducing additional security risks. This can ensure that an IP address has been properly decommissioned across all appliances (including, for example, firewall rules, load balancer configurations, DNS records, and any other relevant network devices and services) before reintroducing it back into the pool of available addresses.

[0109] Fig. 8 illustrates method 800. Method 800 is an example safe IP recycling process, which may be implemented on a network tree. As the number of IPv4 addresses are limited, recycling of the addresses is essential as networks scale. Further, checks may be needed to ensure that newly requested IP addresses are not currently in-use by the network, such on for example a server or load balancer pool. As another example, there may be situations where a change in applications may trigger a misconfiguration. For example, when all network components corresponding to a VIP (e.g., for a first application A) are removed but network components for a second application B are added, there may be accidental exposure for the second application B if the configurations and allowances for application A are used due to an improperly configured VIP network component (e.g., pool members) for application A.

[0110] At step 810, a new IP address may be requested for use for a new node, new network device, or other network component.

[0111] At step 820, a search can be performed through one or more network trees which are available to validate that there are no risks in provisioning the new IP address. For example, it 78859730V.1may be checked that no remaining pools exist for a VIP which contain an IP address which is requested. Such a situation may occur due to failure eto decommission all configurations related to a server previously associated with the requested IP address.

[0112] At step 830, it may be examined if the IP address is related to a server. If so, the method may progress to step 840. If the IP address is not for a server, the method may progress to step 860.

[0113] At step 840, it may be examined if the IP address is still related to another server. If it is not, the method may progress to step 899. If so, the method may progress to step 850.

[0114] At step 860, it may be examined if the IP address is for a load balancer. If so, the method may progress to step 870, and otherwise to step 880.

[0115] At step 870, it may be examined if the IP address is related to a member of another load balancer pool. If so, the method may progress to step 850, and otherwise to step 890.

[0116] At step 880, it is examined if the IP address is the type of a non-rfc1918 internet address, e.g., a public IP address. An RFC1918 address is an IP address that is assigned by an enterprise organization to an internal host. If not, the method may terminate at step 898, which indicates that the IP address is out of the scope of method 800. If so, the method may progress to step 890. Although the example provided herein is with respect to RFC1918, other address types may be used.

[0117] At step 890, it may be checked if the IP address is associated with an existing NAT address. If so, the method may progress to step 850. If not, the method may progress to step 899, indicating that the IP address is safe to be re-used.

[0118] Step 850 indicates that another IP address must be used as other conditions for safe IP address recycling have not been met.

[0119] Embodiments allow for recycling of IP addresses in a safe manner which does not violate security or other network configuration policies. Method 800 may be used to determine the set of IP addresses which may be safely recycled. VI. COMPUTER SYSTEM

[0120] FIG. 9 is a high level block diagram of a computer system 900 that may be used to implement any of the entities or components described above. 78859730V.1

[0121] The subsystems shown in FIG.9 are interconnected via a system bus 975. Additional subsystems such as a printer 974, keyboard 978, storage device(s) 979, monitor 976, which is coupled to display adapter 982, and others are shown. Peripherals and input / output (I / O) devices, which couple to I / O controller 971, can be connected to the computer system by any number of means known in the art, such as serial port 977. For example, input / output (I / O) port 977 or external interface 981 (e.g., Ethernet, Wi-Fi, etc.) can be used to connect computer system 900 to a wide area network such as the Internet, a mouse input device, or a scanner. The interconnection via system bus 975 allows the central processor 973 to communicate with each subsystem and to control the execution of instructions from system memory 972 or the storage device(s) 979 (e.g., a fixed disk, such as a hard drive or optical disk), as well as the exchange of information between subsystems. The system memory 972 and / or the storage device(s) 979 may embody a computer readable medium. Data collection device 985 may collect data from digital or analog instrumentation, other computing devices, and / or servers. Any of the data mentioned herein can be output from one component to another component and can be output to the user.

[0122] It should be understood that any of the embodiments can be implemented in the form of control logic using hardware (e.g., an application specific integrated circuit or field programmable gate array) and / or using computer software with a generally programmable processor in a modular or integrated manner. As user herein, a processor includes a multi-core processor on a same integrated chip, or multiple processing units on a single circuit board or networked. Based on the disclosure and teachings provided herein, a person of ordinary skill in the art will know and appreciate other ways and / or methods to implement embodiments using hardware and a combination of hardware and software.

[0123] Any of the software components or functions described in this application may be implemented as software code to be executed by a processor using any suitable computer language such as, for example, Java, C, C++, C# or scripting language such as Perl or Python using, for example, conventional or object-oriented techniques. The software code may be stored as a series of instructions or commands on a computer readable medium for storage and / or transmission, suitable media include random access memory (RAM), a read only memory (ROM), a magnetic medium such as a hard-drive or a floppy disk, or an optical medium such as a compact disk (CD) or DVD (digital versatile disk), flash memory, and the like. The computer readable medium may be any combination of such storage or transmission devices. 78859730V.1

[0124] Such programs may also be encoded and transmitted using carrier signals adapted for transmission via wired, optical, and / or wireless networks conforming to a variety of protocols, including the Internet. As such, a computer readable medium according to an embodiment may be created using a data signal encoded with such programs. Computer readable media encoded with the program code may be packaged with a compatible device or provided separately from other devices (e.g., via Internet download). Any such computer readable medium may reside on or within a single computer product (e.g., a hard drive, a CD, or an entire computer system), and may be present on or within different computer products within a system or network. A computer system may include a monitor, printer, or other suitable display for providing any of the results mentioned herein to a user.

[0125] Any of the methods described herein may be totally or partially performed with a computer system including one or more processors, which can be configured to perform the steps. Thus, embodiments can be directed to computer systems configured to perform the steps of any of the methods described herein, potentially with different components performing a respective steps or a respective group of steps. Although presented as numbered steps, steps of methods herein can be performed at a same time or in a different order. Additionally, portions of these steps may be used with portions of other steps from other methods. Also, all or portions of a step may be optional. Additionally, any of the steps of any of the methods can be performed with modules, circuits, or other means for performing these steps.

[0126] The specific details of particular embodiments may be combined in any suitable manner without departing from the spirit and scope of embodiments of the disclosure. However, other embodiments may be directed to specific embodiments relating to each individual aspect, or specific combinations of these individual aspects.

[0127] For the purposes of explanation, specific details are set forth in order to provide a thorough understanding of the exemplary embodiments. However, it will be apparent that various embodiments may be practiced without these specific details. For example, circuits, systems, algorithms, structures, techniques, networks, processes, and other components may be shown as components in block diagram form in order not to obscure the embodiments in unnecessary detail.

[0128] The above description is illustrative and is not restrictive. Many variations will become apparent to those skilled in the art upon review of the disclosure. The scope should, 78859730V.1therefore, be determined not with reference to the above description, but instead should be determined with reference to the pending claims along with their full scope or equivalents.

[0129] A recitation of "a", "an" or "the" is intended to mean "one or more" unless specifically indicated to the contrary.

[0130] All patents, patent applications, publications, and descriptions mentioned above are herein incorporated by reference in their entirety for all purposes. None is admitted to be prior 78859730V.1

Claims

WHAT IS CLAIMED IS:

1. A method for managing network vulnerabilities of a network environment, the method comprising performing, by a computer system: storing a list of network devices, including a plurality of externally exposed devices with externally exposed IP addresses and a plurality of internal network devices, including internal endpoints; generating a graph containing a plurality of network tree paths, each network tree path containing nodes representing IP addresses of network devices in the network tree path and links between nodes representing a configuration policy, wherein generating the graph includes constructing each of the plurality of network tree paths by: (i) translating an externally exposed IP address to an internal IP address corresponding to a root node of an externally exposed network device; (ii) establishing one or more links between the root node to one or more intermediate nodes corresponding to one or more intermediate network devices listed in one or more configuration policies of the root node; (iii) iteratively selecting an intermediate network device and establishing links between a corresponding intermediate node to one or more lower- level nodes corresponding to one or more other network devices listed in one or more intermediate configuration policies of the selected intermediate network device, until an internal endpoint is reached, for each intermediate node; and detecting network vulnerabilities using the graph.

2. The method of claim 1, wherein each network tree path is created by creating edges between nodes from relationships derived from firewall Network Address Translation (NAT) rules.

3. The method of claim 1, wherein the plurality of network tree paths include paths that pass through a plurality of network components, including routers, network security appliances, firewalls, load balancers, and servers.

4. The method of claim 1, wherein the graph is dynamically updated to reflect changes in any of network configuration, IP address assignment, network component addition, network component removal, or network appliance configuration changes. 78859730V.

15. The method of claim 1, wherein the plurality of network tree paths contain a routing policy related to respective nodes of the plurality of network tree paths.

6. The method of claim 1, wherein relevant security configuration information includes any of IP information, firewall ACL, firewall NAT, router ACL, load balancer details, WAF enrollment, or IDS enrollment.

7. The method of claim 1, further comprising evaluating each node and its links for their compliance to appropriate security controls based on a security configuration rule.

8. The method of claim 7, further comprising identifying one or more attack surface anomalies based on the evaluation and performing remediation measures responsive to identification of at least one attack surface anomalies.

9. The method of claim 8, wherein the one or more attack surface anomalies is one of a broken path, public IP / VIP reuse, router access control lists exceeding one or more criteria, firewalls allowing a metric related to traffic exceeding one or more criteria, or vulnerabilities in network segmentations.

10. The method of claim 1, further comprising analyzing an IP address using the graph to determine whether the IP address associated with the network is reusable within the network without creating a network misconfiguration.

11. The method of claim 10, wherein analyzing the IP address comprises determining whether the IP address is a non-rfc1918 internet address.

12. The method of claim 10, wherein analyzing is initiated upon a request for to provision a new node, a new network device, or a new network component.

13. The method of claim 10, wherein analyzing further comprises recursively examining each nodes the graph for one or more criteria related to the IP address.

14. The method of claim 13, wherein the one or more criteria include (i) whether the IP address is related to a server, (ii) whether the IP address is related to a load 78859730V.1balancer, (iii) whether the IP address is related to a member of a load balancer pool, (iv) whether the IP address is associated with an existing NAT rule, or (v) whether the IP address is associated with an existing NAT address.

15. The method of claim 1, wherein the one or more links are represented with a positive integer within an array or matrix.

16. The method of claim 1 further comprising accessing a policy stored for the intermediate network device, and identifying one or more other network devices to which a packet may be routed from the intermediate network device if there is a match in one or more criteria of the accessed policy.

17. The method of claim 16, wherein the one or more criteria include routing tables.

18. A computing system comprising one or more processors and a non- transitory computer readable medium containing instructions that, when executed by the one or more processors, cause the one or more processors to perform the method of any one of claims 1-17. 78859730V.1

Images