Attack Graph Generation for Cyber Risk Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large-scale information processing systems face exponential calculation increases when applying inference algorithms to model complex relationships between devices, networks, vulnerabilities, and security settings, making risk analysis computationally intensive.
Innovation Solution
An analysis system that generates attack graphs by deriving pairs of start and end point facts based on device states and analysis rules, without using information from devices outside the start and end points, to reduce the calculation burden.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If inference algorithms are applied to large-scale models representing complex system relationships, then analysis completeness is improved, but calculation amount increases exponentially
Solution Approach 1:
The patent segments the large-scale inference problem into multiple smaller sub-problems by dividing the set of facts into different groups and performing inference operations on each group separately. This is achieved through the fact generation unit that creates facts in a controlled manner and the analysis unit that processes inference in staged steps, avoiding the need to perform exhaustive inference on all facts simultaneously, thereby reducing calculation complexity while maintaining analysis completeness.
Solution Approach 2:
The patent applies preliminary action by pre-processing and organizing system information into structured facts before performing inference operations. The fact generation unit prepares facts in advance by collecting system information, identifying vulnerabilities, and structuring security data into a standardized format. This preliminary organization enables more efficient subsequent inference operations without requiring exponential calculation resources.
2Measurement precision
If comprehensive system information is collected for accurate risk assessment, then measurement precision is improved, but device complexity increases
Solution Approach 1:
The patent extracts only the essential and relevant information from comprehensive system data through the fact generation unit. Instead of processing all available system information, the system selectively extracts key facts such as device configurations, vulnerability states, and security settings that are directly relevant to risk assessment. This extraction process maintains measurement precision by focusing on critical data while reducing device complexity by excluding unnecessary information from the analysis model.
Solution Approach 2:
The patent applies local quality by creating a simplified model structure where different parts of the system are represented with appropriate levels of detail based on their relevance to security analysis. The analysis unit focuses inference operations on specific local areas of the system model that are most vulnerable or critical, rather than uniformly processing the entire system. This approach maintains accurate risk assessment for critical components while reducing overall model complexity.
Data Source
AI summary
The analysis unit 6 generates one or more pairs of a start point fact which is a fact representing possibility of attack in a device that is a start point and an end point fact which is a fact representing possibility of attack in a device that is an end point. The analysis unit 6 analyzes, for each pair, whether or not it is possible to derive the end point fact from the start point fact, and generates an attack graph from a node corresponding to the start point fact to a node corresponding to the end point fact, in a case where it is possible to derive the end point fact from the start point fact.