Attack Path Visualization Using Relational Network Graph Segments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for identifying and visualizing network attack paths in large and complex computing environments, such as cloud computing environments, are computationally intensive, non-scalable, and inefficient, often overwhelming users with vast amounts of data, leading to suboptimal security vulnerability detection and analysis.
Innovation Solution
A relational representation of network resources and connections is used to identify and visualize network attack paths, employing metadata to generate tables that facilitate efficient identification and visualization of attack paths, reducing the need for loading entire graphs into memory and minimizing hardware resource consumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional methods are used to identify network attack paths in large computing environments, then comprehensive security vulnerability detection can be achieved, but computational intensity and hardware resource consumption increase significantly
Solution Approach 1:
The patent segments the network graph into multiple smaller graphs by dividing the network into zones or domains. Each zone is processed independently to identify attack paths, which then need to be stitched together to form the complete attack path picture. This segmentation reduces the computational burden on any single processing unit while maintaining comprehensive security vulnerability detection across the entire network.
Solution Approach 2:
The patent introduces an intermediary representation layer between the network graph and the attack path identification process. This intermediary layer transforms the complex network graph into a simplified structured format that can be processed more efficiently, acting as a mediator that reduces computational intensity while preserving the essential security vulnerability information.
2Loss of information
If conventional methods are used to visualize network attack paths, then complete attack path information can be provided, but hardware resource requirements and data overload increase
Solution Approach 1:
The patent extracts only the essential attack path information from the complete network graph, separating critical vulnerability data from redundant network topology information. By extracting and focusing solely on attack paths rather than displaying the entire network state, the system provides complete attack path information while significantly reducing the data volume presented to users.
Solution Approach 2:
The patent transforms the attack path visualization from a two-dimensional network graph into a three-dimensional hierarchical structure that organizes attack paths by zones, domains, and criticality levels. This dimensional transformation allows complete attack path information to be presented in an organized manner that reduces perceived data overload by structuring information across multiple hierarchical levels.
3Productivity
If conventional graph-based methods are used, then network attack paths can be identified, but scalability to large computing environments is poor
Solution Approach 1:
The patent divides the large network graph into smaller manageable segments or zones that can be processed independently. This segmentation enables the system to scale to large computing environments by processing attack paths in smaller units rather than attempting to analyze the entire network at once, thereby improving identification speed while maintaining scalability.
Solution Approach 2:
The patent applies partial action by processing only the necessary portions of the network graph relevant to identified vulnerabilities rather than analyzing the entire network topology. This selective processing approach improves attack path identification speed for critical areas while maintaining scalability, as the system can focus computational resources on high-risk zones rather than uniformly processing the entire network.
Data Source
AI summary
The techniques described herein relate to visualizing network attack paths. An example method includes using at least one computer hardware processor to perform: identifying one or more vulnerable network resources in a plurality of network resources, each of the one or more vulnerable network resources having at least one respective security vulnerability; accessing at least one portion of a relational representation of a set of network resources in the plurality of network resources, identifying, using the at least one portion of the relational representation, one or more network attack paths between the one or more vulnerable network resources and network resources in the set, generating, using the at least one portion of the relational representation, a graph, and generating a GUI comprising a visualization of the graph and information indicating that the one or more attack paths may be used to exploit one or more security vulnerabilities of the set.