Attack Graphs for Identifying Attacked Computing Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network-connected computer systems face challenges in detecting and mitigating network attacks, as existing technologies struggle to accurately identify attacked devices and implement timely protective measures, especially in cases of zero-day attacks that evade traditional intrusion detection systems.
Innovation Solution
A computer-implemented method using a directed acyclic attack graph and network map to identify attacked devices by modeling vulnerabilities and network connections, allowing for the implementation of protective measures to safeguard the system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional intrusion detection systems are used to detect network attacks, then the system can monitor network traffic, but it fails to accurately identify attacked devices in cases of zero-day attacks
Solution Approach 1:
The system performs preliminary actions by building attack graphs that model potential attack paths and vulnerabilities before actual attacks occur. This allows the system to proactively identify and protect against zero-day attacks by predicting possible attack vectors based on known vulnerabilities and network topology, rather than waiting for traditional signature-based detection to fail.
Solution Approach 2:
The patent introduces attack graphs as an intermediary data structure that bridges the gap between known vulnerabilities and potential zero-day attacks. The attack graph serves as a mediator that models complex attack scenarios and relationships, enabling the system to detect attacks that traditional intrusion detection systems cannot identify through direct pattern matching alone.
2Reliability
If the system monitors all network traffic to identify attacks, then it can detect potential threats, but it increases processing time and computational complexity
Solution Approach 1:
The system segments the network into discrete devices and services, representing them as nodes in an attack graph. This segmentation allows the system to focus analysis on specific vulnerable devices and attack paths rather than processing all network traffic uniformly, significantly reducing computational complexity and processing time while maintaining reliable attack detection capability.
Solution Approach 2:
The patent changes the parameter of analysis from monitoring all network traffic to analyzing attack paths based on vulnerability data and network topology. This parameter change transforms the problem from real-time traffic inspection to graph-based path analysis, reducing processing time while improving reliability in identifying attacked devices through structured vulnerability assessment.
3Measurement precision
If the system uses detailed vulnerability modeling to improve detection accuracy, then it can identify specific attacked devices, but it increases device and system complexity
Solution Approach 1:
The system creates simplified graphical representations (attack graphs) that copy and model the essential relationships between vulnerabilities, devices, and attack paths. Instead of managing complex raw vulnerability data directly, the system uses these graphical models to represent attack scenarios, reducing the apparent complexity while maintaining precise device identification capability through the structured graph data structures.
Data Source
AI summary
A computer implemented method to identify an attacked computing device in a system of network-connected computing devices providing a plurality of computing services, the method including receiving a first data structure including data modeling relationships between vulnerabilities of computing services in a first proper subset of the plurality of computing services and exploitation of such vulnerabilities to identify one or more series of exploits involved in a network attack; receiving a second data structure including data modeling the computing devices in the system including the network connections of each computing device; and comparing the first and second data structures to identify the attacked computing device as an intermediate device in communications between at least two computer services in any of the one or more series of exploits.