Enterprise Attack Path Prediction Using Active Directory Graphs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for identifying network vulnerabilities in enterprise networks are time-consuming and costly, requiring extensive simulations that mimic hacker attacks, which is inefficient for enterprises seeking rapid security assessments.
Innovation Solution
A method and system for predicting attack paths by analyzing accounts, machines, and network resources using a macro domain perspective, employing active directory data and deep machine learning to visualize and quantify threat boundaries, without requiring actual attacks or modifying active directory settings.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional hacker attack simulation methods are used to identify network vulnerabilities, then comprehensive security assessment can be achieved, but the process becomes time-consuming and costly
Solution Approach 1:
The system performs preliminary analysis by pre-calculating and storing attack path probabilities and vulnerability information in the active directory database before actual security assessments are needed. This allows rapid retrieval and analysis during vulnerability identification, eliminating the need for time-consuming real-time simulations while maintaining comprehensive assessment capability
Solution Approach 2:
The system creates a virtual model of the network environment by copying active directory data and constructing simulated attack paths in software. This virtual copy allows comprehensive security assessment to be performed on the model rather than requiring actual hacker simulations on the live network, significantly reducing time and cost while maintaining assessment reliability
2Reliability
If extensive hacker attack simulations are conducted to ensure comprehensive vulnerability detection, then security coverage is improved, but cost increases significantly
Solution Approach 1:
The system creates a virtual model of the network environment by copying active directory data and constructing simulated attack paths in software. This virtual copy allows comprehensive security assessment to be performed on the model rather than requiring actual hacker simulations on the live network, significantly reducing time and cost while maintaining assessment reliability
Solution Approach 2:
The system replaces physical hacker simulation operations with automated software-based analysis algorithms. Instead of employing actual security experts to manually simulate attacks, the system uses computerized path analysis and probability calculations to automatically identify vulnerabilities, reducing both labor costs and time requirements while maintaining comprehensive detection coverage
3Measurement precision
If traditional single-machine attack simulation is used, then specific vulnerability points can be identified, but the overall attack path analysis is insufficient
Solution Approach 1:
The system transitions from analyzing single-machine vulnerabilities to multi-dimensional attack path analysis by incorporating active directory relationships, account privileges, and network resource connections. This dimensional expansion allows the system to maintain precise vulnerability point identification while simultaneously providing comprehensive attack path context, resolving the contradiction between precision and complexity
Data Source
AI summary
A method for predicting an attacked path on enterprise networks includes: obtaining a plurality of accounts, a plurality of machines and network resource data, where the plurality of machines include at least one attacked target; calculating, according to the network resource data, a plurality of evaluated values of executing access on other machines of each account logging in at least one machine; and presenting an attacked path where a machine at least one account logs in accesses the attacked target directly, or indirectly by connecting to other machines, and the machine the at least one account logs in points to the attacked target directly, or indirectly by connecting to other machines.