Security attack knowledge graph and simulated neural network

1 . A method for performing automated security analysis of an information system or computing device by modeling attacks and attack surfaces using a Security Attack Analysis Tool, wherein, the Security Attack Analysis Tool comprising: a User Interface, a Graph Computing Engine with capabilities comprising: graph queries, graph traversal algorithms, and graph management; an Attack Path Analysis Engine with capabilities comprising: data sorting, filtering and ranking, statistical analysis and database query; a Security Knowledge Base; and a Security Attack Knowledge Graph; the method comprising:

assembling, via at least one computer device executing computer program instructions, at least one digitally encoded input for automated security analysis in the form of a Security Analysis Manifest comprising: a description of a security attack scenario, and a set of parameters that provide criteria for the security analysis, wherein, the Security Analysis Manifest is also referred to as a Security Attack Manifest or a Security Manifest; and,

submitting, via at least one computer device executing the computer program User Interface, the at least one digitally encoded input scenario to the Security Attack Analysis Tool, wherein the tool performs an automated security analysis by invoking the Graph Computing Engine that executes queries and traversals of the Security Attack Knowledge Graph and produces a plurality of attack paths and attack steps related to the input scenario, wherein the Attack Path Analysis Engine evaluates the plurality of attack scenarios based on the parameters from the input scenario and generates an output comprising: a set of ranked attack paths and attack steps relevant to the input scenario, recommendations and an action plan, wherein the action plan is determined for the input scenario, wherein said input scenario defines a set of conditions for automatically initiating a programmatic operation that results in the security analysis tool generating the action plan, wherein said security analysis tool is selectively configurable to produce said action plan for informing, preventing, mitigating security attacks at a defined point in time, wherein said security analysis tool is selectively configurable to produce said action plan as a static attack analysis for a defined time window, and wherein, said security analysis tool is selectively configurable to produce said action plan for a dynamic security analysis against the information system in at least one of real-time and near real time; and,

receiving, via at least one computer device executing the computer programmed User Interface, the output from the Security Attack Analysis Tool, the output comprising: an enumerated set of ranked security attack paths and security attack steps that are relevant to the input scenario, data and metrics encoded in the node and connected edge entries, recommendations and action plans.

2 . A method for building a Security Knowledge Base and a related Security Attack Knowledge Graph used by a Security Attack Analysis Tool that performs automated security analysis of an information system or computing device by modeling attacks and attack surfaces, wherein, the Security Attack Knowledge Graph represents a Simulated Neural Network of Security Attacks, the method comprising:

receiving, via at least one computer device executing computer program instructions, machine readable versions of authoritative documents and datasets with historical data and experiential knowledge related to security aspects of information systems and computing devices, wherein, the content of said authoritative documents and datasets relates to contextual data models derived from Common Criteria for Information Technology Security Evaluation, also known as ISO/IEC 15408, wherein, the contextual data models describe security concepts, relationships and dependencies comprising: owners, assets, risk, vulnerabilities, countermeasures, threats, threat agents, assurance techniques, evaluation techniques, assurance metrics, confidence metrics and risk metrics, and wherein, the historical data and experiential knowledge is found in authoritative sources comprising: MITRE Common Attack Patterns (CAPEC), MITRE Common Weakness Enumeration List (CWE), MITRE Common Vulnerability Enumeration List (CVE), NIST National Vulnerability Database (NVD), the MITRE Top 25 Software Weaknesses, the MITRE Top 25 Hardware Weaknesses, the Open Web Application Security Project (OWASP) Top 10, Common Criteria for Information Technology Security Evaluation, also known as ISO/IEC 15408, and NIST SP800-207 Zero Trust Architecture; and,

assembling, via at least one computer device executing computer program instructions, a set of security data instances, wherein, the security data instances contain descriptions and reference information related to security attacks, wherein, the data instances are digitally encoded following a contextual model comprising: security attack instance data, security attack correlating data, security attack metadata and security attack extension data; and wherein, the assembled set of digitally encoded data instances are stored in a non-transitory computer usable storage medium to represent a Security Knowledge Base; and,

assembling, via the at least one computer device executing computer program instructions, a Security Attack Knowledge Graph from the security data instances of the Security Knowledge Base; wherein, said Security Attack Knowledge Graph is organized as a data structure comprising: a set of node entries and edge entries in the form of a connected knowledge graph, wherein, each node entry represents a security attack step, each edge entry represents a security weakness, vulnerability or architectural feature that enables a security attack step, and wherein, related node entries are logically connected by parameters in edge entries based on relationships and dependencies found in the security data instance entries of the Security Attack Knowledge Base; wherein, assembling comprising: digitally encoding the data structure representing the node entries and edge entries of the Security Attack Knowledge Graph in GraphML or other graphing language, and storing the digitally encoded data in a non-transitory computer-usable storage medium, to form a Simulated Neural Network of Security Attacks.

3 . A method for training the Security Attack Knowledge Graph, wherein, the training process updates the Security Attack Knowledge Graph to improve the completeness and correctness of automated security analysis, the method comprising:

receiving, via at least one computer device executing computer program instructions, machine readable versions of authoritative documents and datasets containing training data, wherein, said authoritative documents and datasets comprising: MITRE Common Attack Pattern Lists (CAPEC), MITRE Common Weakness Enumeration Lists (CWE), MITRE Common Vulnerability Enumeration Lists (CVE), NIST National Vulnerability Database (NVD) entries, and customization data for a given organization, enterprise or information system; and,

selecting, via the at least one computer device executing computer program instructions, the training data from said authoritative documents and datasets, wherein the training data comprising: new or updated security attack data, new or updated security weakness data, new or updated security vulnerability data, and, new or updated cross references between security attacks, security weaknesses, and security vulnerabilities, wherein, the selected training data is digitally encoded following a data model comprising: a set of updates to knowledge graph node entries that represent security attacks, a set of updates to knowledge graph edge entries that represent security weaknesses and vulnerabilities, and a set of updates to knowledge graph node-to-node connection parameters, and wherein, the digitally encoded training data is stored in a non-transitory computer usable storage medium; and,

applying, via at least one computer device executing computer program instructions, said digitally encoded training data to the entries in the Security Attack Knowledge Graph, wherein, applying comprising: adding new node entries or new edge entries, adjusting the severity, likelihood and risk metrics and weights in node and edge entries, adjusting the Source and Target node identifiers in edge entries to enable new attack paths, and, modifying data labels and data values in nodes and edges.

4 . The method of claim 2 , wherein,

the authoritative documents and datasets used to assemble the Security Knowledge Base and the related Security Attack Knowledge Graph includes customization data for a given organization, enterprise, information system or computing device, wherein, the customization data comprising: descriptions of specific information systems, system features and components, relevant security attack scenarios, attack severity metrics, attack likelihood metrics, and organizational or enterprise risk metrics.

5 . The method of claim 3 , wherein, training includes validating the correctness and completeness of the Security Attack Knowledge Graph, wherein validating comprising: performing, via at least one computer device executing computer program instructions, automated security analysis using the Security Attack Analysis Tool, wherein, the input scenarios are assembled from confirmed security attacks derived from the historical data and experiential knowledge, and the ranked security attack paths and security attack steps from the output of the Security Attack Analysis Tool are compared with the content from the assembled input scenarios in order to confirm completeness and correctness of the Security Attack Knowledge Graph, and, to identify errors and omissions in the node and edges of the Security Attack Knowledge Graph; and, generating a digitally encoded output with recommended changes to node entries, edge entries and node-to-node connection parameters, stored in a non-transitory computer-usable storage medium in the form of training data.