Interactive Attack Graph Analysis via Relational Queries

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current approaches to analyzing attack graphs for network intrusion defense require proprietary algorithms, leading to delays and making interactive analysis difficult due to the need for new algorithm development with rapidly changing network threats and configurations.

Innovation Solution

A relational model is used to represent network configuration and domain knowledge, enabling the generation of attack graphs through relational queries that can be dynamically constructed and revised, allowing for interactive analysis and leveraging mature optimization techniques in relational databases.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If proprietary algorithms are used to analyze attack graphs, then analysis can be performed, but analysis time increases and interactive analysis becomes difficult

Engineering Contradiction:

Improveattack graph analysis capabilityVSAvoidanalysis time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent creates a relational database copy of the attack graph data model, allowing queries to be executed against this standardized copy rather than requiring proprietary analysis algorithms. This copying approach enables using mature database optimization techniques to reduce analysis time while maintaining analysis capability.

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The patent replaces the mechanical system of proprietary algorithms with a standardized relational database query system. By substituting custom algorithmic processing with SQL queries on a relational model, the system leverages mature database optimization techniques to improve analysis performance and enable interactive analysis.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Adaptability or versatility

If proprietary algorithms are developed for each analysis, then specific analysis requirements can be met, but system complexity increases

Engineering Contradiction:

Improveanalysis flexibilityVSAvoidalgorithm complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent implements a universal relational database schema that can serve multiple analysis purposes. A single relational model supports various attack graph analyses through different SQL queries, eliminating the need for separate proprietary algorithms for each analysis type. This multi-functional approach maintains analysis flexibility while reducing system complexity.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

Instead of creating custom algorithms for each analysis requirement, the patent inverts the approach by creating a standardized data model that can be queried in multiple ways. Rather than algorithms adapting to data, the data model adapts to support various query types, simplifying the system while maintaining versatility.

Inventive Principle:

Principle #13The other way round (Inversion)

Data Source

PatentUS8566269B2Interactive analysis of attack graphs using relational queries

Publication Date: 2013.10.22 GOVERNMENT OF THE UNITED STATES OF AMERICA AS REPRESENTED BY THE SEC OF COMMERCE THE NAT INST OF STANDARDS & TEHCNOLOGY

AI summary

An attack graph analysis tool that includes a network configuration information input module, a domain knowledge input module, a network configuration information storage module, a domain knowledge storage module, and a result generation module. The network configuration information input module inputs network configuration information. The domain knowledge input module inputs domain knowledge for the network. The network configuration information storage module stores network configuration information in a network database table. The domain knowledge storage module stores the domain knowledge in an exploit database table. The result generation module generates a result using the network database table and exploit database table. The result may be generated in response to a query to a database management system that has access to the network database table and exploit database table. The network may be reconfigured to decrease the likelihood of future attacks using the attack information learned from the result.