Virtualized Adversary Simulation for Critical Network Path Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cyber threat protection systems fail to effectively assess how malicious cyber threats spread through a network, and existing vulnerability scanners often fail to effectively address the challenges of malicious cyber threats, and existing technologies such as vulnerability scanning by humans lead to inefficient security resource allocation and can compromise network devices during testing.
Innovation Solution
An intelligent-adversary simulator constructs a virtualized network graph based on real-time network data to simulate cyber-attack scenarios, identifying critical devices and calculating paths of least resistance for threat propagation, generating a report to prioritize security resource allocation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If vulnerability scanning is performed by humans or traditional scanners, then security assessment is conducted, but actual network devices may be compromised and network operations adversely affected
Solution Approach 1:
The patent creates a virtualized copy of the network environment that mirrors the structure, devices, and connectivity of the actual network. This virtual replica allows security assessments to be performed on the copy rather than the real devices, eliminating the harmful effect of compromising actual network equipment while maintaining assessment accuracy through faithful replication of network topology and device relationships
2Reliability
If traditional vulnerability scanning is used, then security issues are detected, but security resource allocation is inefficient and not targeted
Solution Approach 1:
The system performs preliminary analysis by constructing the virtualized network graph and pre-identifying critical devices and pathways before actual security assessments. By预先 determining which devices are most vulnerable and which pathways are most critical for threat propagation, the system enables targeted security resource allocation rather than blanket scanning of all devices, thereby improving productivity while maintaining detection reliability
Solution Approach 2:
The patent applies different assessment intensities and methods to different parts of the network based on their criticality. Critical devices identified through the virtualized graph analysis receive focused, intensive security assessment, while less critical devices receive minimal or no scanning. This localized approach to security assessment improves resource allocation efficiency by concentrating resources where they are most needed while maintaining overall security detection capability
3Reliability
If comprehensive network security assessment is performed, then all vulnerabilities are identified, but the complexity and time required for analysis increases significantly
Solution Approach 1:
The patent segments the network assessment task by first constructing a virtualized graph representation that divides the complex network into manageable nodes and edges. This segmentation allows the system to analyze network topology, identify critical pathways, and assess vulnerabilities in a structured, modular manner rather than attempting to evaluate all devices simultaneously, thereby reducing analysis complexity while maintaining comprehensive vulnerability identification through systematic coverage of all network segments
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An intelligent-adversary simulator can construct a graph of a virtualized instance of a network including devices connecting to the virtualized instance of the network as well as connections and pathways through the virtualized instance of the network. Running a simulated cyber-attack scenario on the virtualized instance of the network in order to identify one or more critical devices connecting to the virtualized instance of the network from a security standpoint, and then put this information into a generated report to help prioritize which devices should have a priority. During a simulation, the intelligent-adversary simulator calculates paths of least resistance for a cyber threat in the cyber-attack scenario to compromise a source device through to other components until reaching an end goal of the cyber-attack scenario in the virtualized network, all based on historic knowledge of connectivity and behaviour patterns of users and devices within the actual network under analysis.