Distributed Attack Graph Generation for Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network security systems face challenges in monitoring vulnerabilities efficiently due to limited resources and the need for frequent updates, which existing technologies struggle to address effectively, especially in sharing computational and network loads during low activity times.
Innovation Solution
A distributed methodology for generating and merging attack graphs locally within enclaves, where individual machines create their own attack graphs and share data with a central processing unit to form an enclave-wide probabilistic attack graph, reducing computational and network loads by transmitting only differences in updated graphs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If attack graph generation is performed frequently to improve cyber-situational awareness, then the accuracy and timeliness of vulnerability monitoring is improved, but the computational load and network traffic increase
Solution Approach 1:
The system segments the attack graph generation task by distributing it across multiple machines within enclaves. Each machine generates its own local attack graph independently, and these subgraphs are then merged at the enclave level. This segmentation allows frequent updates without overloading a single central system, resolving the contradiction between frequent monitoring and computational load.
Solution Approach 2:
The patent introduces a hierarchical dimension to attack graph generation by creating multiple levels: machine-level attack graphs, enclave-level attack graphs, and network-level attack graphs. This dimensional structure allows the system to perform frequent local updates while aggregating results periodically, reducing the frequency and volume of data transmission across the network.
2Productivity
If attack graph generation is performed frequently to improve cyber-situational awareness, then the accuracy and timeliness of vulnerability monitoring is improved, but the network bandwidth consumption increases
Solution Approach 1:
The system extracts and processes attack graph generation locally at each machine and enclave level, removing the need to continuously transmit complete attack graphs across the network. Only necessary aggregation data and updates are transmitted to higher levels, significantly reducing network bandwidth consumption while maintaining frequent monitoring capability.
Solution Approach 2:
By creating a hierarchical structure with machine-level, enclave-level, and network-level graphs, the system reduces network traffic by performing computations at lower dimensions locally. The network infrastructure only needs to transport aggregated results between levels rather than continuous full-graph data, reducing overall bandwidth requirements.
3Device complexity
If a centralized approach is used for attack graph generation, then the system complexity is reduced, but the computational load on the central system increases
Solution Approach 1:
The system divides the centralized attack graph generation function into distributed segments at each machine and enclave level. This segmentation reduces the computational burden on any single central system while maintaining manageable complexity through standardized interfaces and protocols for generating and merging subgraphs.
Solution Approach 2:
The patent combines multiple distributed attack graph generation instances into a unified hierarchical structure. By merging machine-level graphs into enclave-level graphs and then into network-level graphs, the system achieves centralized coordination benefits while distributing the actual computational workload across multiple nodes.
4Loss of information
If all machines transmit complete attack graphs to the central processing unit, then the central system has complete information, but the network traffic and data transmission load increase
Solution Approach 1:
The system extracts only the necessary information for aggregation at each local level and transmits only these extracted data points to higher levels. Complete attack graphs are not transmitted; instead, summarized enclave-level graphs and key vulnerability information are sent, maintaining information completeness while dramatically reducing network traffic volume.
Solution Approach 2:
The hierarchical structure allows information to be aggregated and summarized at lower dimensions before transmission to higher dimensions. This dimensional aggregation reduces the quantity of data transmitted across the network while preserving the essential vulnerability information needed for comprehensive security awareness.
Data Source
AI summary
A method for generating a network-level attack graph is described. A first computing device in a network generates a first attack graph and transmits the first attack graph to a central computing device in the network. A second computing device in the network generates a second attack graph, wherein the second computing device is different than the first computing device, and transmits the second attack graph to the central computing device. The central computing device generates, based on the first attack graph and the second attack graph, a network-level attack graph by merging the first attack graph, the second attack graph, and an attack graph stencil of cross-device vulnerability interactions.