Analytical Attack Graph Modeling for Scalable Cyber-Attack Discovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cyber-attack process discovery in computer networks faces challenges such as scalability, resource-intensive graph processing, limited versatility, and incomplete attack path data, making it difficult to prioritize security threats effectively.
Innovation Solution
The implementation processes analytical attack graphs (AAGs) to convert them into tactic graphs, generating compact process models that include hardness scores, enabling faster and more versatile cyber-attack path analysis, applicable across multiple networks, and supporting machine learning for real-time security risk assessment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If analytical attack graphs are used to represent all possible attack paths, then comprehensive attack coverage is achieved, but processing power and time requirements increase significantly
Solution Approach 1:
The patent segments the complete attack graph into multiple subgraphs based on attack path similarity and structural characteristics. Each subgraph represents a portion of the attack space, allowing parallel processing and reducing the computational burden on single processing units while maintaining comprehensive coverage through aggregation of results from all subgraphs.
Solution Approach 2:
The patent implements dynamic subgraph generation that adapts to the specific network topology and attack scenarios being analyzed. Subgraphs are created and processed dynamically based on the complexity and size of the attack graph, allowing the system to optimize processing resources according to the actual analysis needs rather than using a fixed segmentation approach.
2Loss of information
If detailed analytical attack graphs are constructed, then complete attack path information is captured, but the system lacks real-time adaptability
Solution Approach 1:
The patent performs preliminary analysis by pre-processing the attack graph to identify and segment potential attack paths into subgraphs before actual attack detection occurs. This preliminary structuring enables faster real-time analysis when attacks are detected, as the segmentation logic and subgraph structures are already established and can be quickly queried without requiring full graph reconstruction.
Solution Approach 2:
The patent changes the parameter of graph representation by transforming the complete attack graph into multiple smaller subgraphs with modified structural parameters. This transformation maintains the essential attack path information while changing the scale and organization of the data structure, enabling more efficient real-time processing and adaptation to different attack scenarios.
3Reliability
If all attack paths are analyzed equally, then comprehensive security assessment is provided, but priority-based security measures cannot be implemented
Solution Approach 1:
The patent applies local quality by assigning different priority levels and security characteristics to different subgraphs based on their attack path characteristics, network criticality, and potential impact. Rather than treating all attack paths uniformly, the system enables differentiated security responses where high-priority subgraphs receive more intensive monitoring and faster response mechanisms, while lower-priority subgraphs use standard processing.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Implementations of the present disclosure include receiving analytical attack graph data representative of an analytical attack graph, the analytical attack graph including: one or more rule nodes each representing a network configuration rule; and one or more impact nodes each representing an impact of one or more respective network configuration rules; converting the analytical attack graph to a tactic graph including one or more tactic nodes, each tactic node representing at least one rule node and at least one impact node; determining one or more paths of the tactic graph that lead to a particular network impact; generating a process model based on the paths that lead to the particular network impact, the process model representing network activity for execution of a process that leads to the particular network impact; and executing one or more remedial actions based on the process model to mitigate cyber-security risk to the enterprise network.