Network Attack Path Visualization Using Relational Representation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional data structures for identifying and visualizing network attack paths in large and complex computing environments, such as cloud computing environments, are computationally intensive, non-scalable, and inefficient, leading to memory overload and overwhelming user experiences due to the sheer number of potential paths to analyze.

Innovation Solution

The use of a relational representation, instead of graph-based structures, to identify and visualize network attack paths by generating tables from metadata, allowing for efficient identification and visualization of attack paths with reduced computational and hardware resource requirements.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If graph-based data structures are used to identify and visualize network attack paths, then comprehensive path analysis is achieved, but computational intensity and memory consumption increase significantly

Engineering Contradiction:

Improvecomprehensive path analysisVSAvoidcomputational intensity

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent segments the network attack path analysis by separating the identification phase from the visualization phase. It uses relational data structures to identify attack paths efficiently, then selectively visualizes only critical paths rather than all possible paths, thereby reducing computational intensity while maintaining comprehensive analysis capability.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent changes the data structure parameter from graph-based to relational representation. This parameter change enables more efficient storage and querying of network resource relationships, reducing memory consumption and computational overhead while maintaining the ability to perform comprehensive path analysis.

Inventive Principle:

Principle #35Parameter changes

2Loss of information

If graph-based data structures are used to identify and visualize network attack paths, then complete path visualization is achieved, but memory overload occurs

Engineering Contradiction:

Improvepath visualization completenessVSAvoidmemory consumption

Core Design Contradiction:

Loss of informationVSQuantity of substance

Solution Approach 1:

The patent extracts and visualizes only the essential attack path information rather than attempting to visualize all network paths. It identifies critical attack paths using relational structures and selectively presents them to users, thereby maintaining information completeness for security analysis while significantly reducing memory consumption.

Inventive Principle:

Principle #2Taking out (Extraction)

3Reliability

If all potential network paths are analyzed, then comprehensive security assessment is achieved, but user experience becomes overwhelming

Engineering Contradiction:

Improvesecurity assessment completenessVSAvoiduser experience

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent applies local quality by providing different levels of detail to different users or for different purposes. It performs comprehensive security assessment internally but presents simplified, prioritized attack path information to users, ensuring both assessment completeness and ease of operation through selective information presentation.

Inventive Principle:

Principle #3Local quality

4Measurement precision

If conventional data structures are used for attack path identification, then thorough analysis is achieved, but scalability to large computing environments is lost

Engineering Contradiction:

Improveanalysis thoroughnessVSAvoidscalability

Core Design Contradiction:

Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The patent inverts the conventional approach by using relational data structures instead of graph-based structures for attack path identification. This inversion enables the system to scale to large computing environments while maintaining thorough analysis capability, as relational structures provide more efficient querying and indexing for large datasets.

Inventive Principle:

Principle #13The other way round (Inversion)

Data Source

PatentUS12476996B2Techniques for visualizing network attack paths

Publication Date: 2025.11.18 RAPID7 INC

AI summary

An example method includes using at least one computer hardware processor to perform: identifying one or more vulnerable network resources in a plurality of network resources, each of the one or more vulnerable network resources having at least one respective security vulnerability; accessing at least one portion of a relational representation of a set of network resources in the plurality of network resources, identifying, using the at least one portion of the relational representation, one or more network attack paths between the one or more vulnerable network resources and network resources in the set, generating, using the at least one portion of the relational representation, a graph, and generating a GUI comprising a visualization of the graph and information indicating that the one or more attack paths may be used to exploit one or more security vulnerabilities of the set.