Network graph analysis
A computer-implemented method comprising: obtaining an asset graph representing a network, the asset graph comprising a plurality of nodes representing assets of the network and edges representing relationships between the assets; calculating, using the graph, a local connectivity metric for a node of the graph; based on the local connectivity metric, identifying a local pattern associated with a potential security risk; and identifying a candidate node or a candidate edge based on the identified local pattern associated with the potential security risk.
1 . A computer-implemented method comprising:
obtaining an asset graph representing a network, the asset graph comprising a plurality of nodes representing assets of the network and edges representing relationships between the assets;
calculating, using the asset graph, a local connectivity metric for a node of the asset graph, wherein the local connectivity metric is a product of an InDegree of the node and an OutDegree of the node, a betweenness of the node, or an in/out node similarity of the node;
based on the local connectivity metric, identifying a local pattern associated with a potential security risk; and
identifying a candidate node or a candidate edge based on the identified local pattern associated with the potential security risk.
2 . The method of claim 1 , wherein the method further comprises determining a modification suggestion based on the candidate node or candidate edge which, when implemented, reduces the potential security risk.
3 . The method of claim 2 , wherein the method further comprises:
obtaining an updated asset graph representing the network after the modification suggestion has been implemented;
providing the updated asset graph to an automated engine as an input;
receiving an output from the automated engine in response to the input; and
causing a security action to be performed based on the output.
4 . The method of claim 3 , wherein the output identifies a security action asset of the network, wherein the security action comprises:
generating at a user interface an alert pertaining to the security action asset;
revoking or restricting an access privilege associated with the security action asset;
quarantining the security action asset; or
isolating the security action asset from a network or system.
5 . The method of claim 1 , wherein the product of the InDegree of the node and the OutDegree of the node is a connectivity c of a node v:
c
(
v
)
=
InDegree
(
v
)
·
OutDegree
(
v
)
.
6 . The method of claim 1 , wherein the betweenness of the node is a betweenness b of a node v:
b
(
v
)
=
∑
σ
st
(
v
)
σ
st
where σ st is a number of shortest paths between s and t, and σ st (v) is a number of such paths passing though v.
7 . The method of claim 1 , wherein the in/out node similarity of the node is an in/out node similarity s of a node v with inbound set I and outbound set O:
s
(
v
)
=
I
v
⋂
O
v
I
v
⋃
O
v
.
8 . The method of claim 1 , wherein the identified local pattern is a chokepoint.
9 . The method of claim 1 , wherein the identified local pattern is a vortex, in which several nodes are connected in a path via several tokens.
10 . The method of claim 1 , wherein the method further comprises:
predicting a number of access paths passing through the identified local pattern;
determining that the predicted number of access paths passing through the identified local pattern exceeds an access path threshold; and
identifying the candidate node or candidate edge based on the determination that the predicted number of access paths passing through the identified local pattern exceeds the access path threshold.
11 . The method of claim 2 , wherein the modification suggestion is a network modification suggestion, wherein the method further comprises:
identifying a candidate asset or candidate relationship associated with the candidate node or candidate edge respectively; and
determining the network modification suggestion based on the candidate asset or candidate relationship which, when implemented in the network, reduces the potential security risk.
12 . The method of claim 11 , wherein the network modification suggestion comprises removing a token associated with the candidate relationship from the network.
13 . The method of claim 11 , wherein the network modification suggestion comprises reducing allowed access to the candidate asset in the network.
14 . The method of claim 2 , wherein the modification suggestion is a graph modification suggestion, wherein the method further comprises determining the graph modification suggestion for modifying the asset graph representing the network based on the candidate node or candidate edge, which when implemented reduces the potential security risk when the asset graph is executed by a security management system.
15 . The method of claim 14 , wherein multiple candidate nodes are identified, wherein the graph modification suggestion comprises clustering the multiple candidate nodes associated to generate an asset cluster node.
16 . The method of claim 14 , wherein the graph modification suggestion comprises removing the candidate node or candidate edge from the asset graph.
17 . The method of claim 14 , wherein the method further comprises modifying the asset graph based on the graph modification suggestion to generate a modified asset graph.
18 . The method of claim 1 , wherein the method further comprises generating a user interface based on the candidate node or candidate edge, and providing the user interface to a user device for rendering thereat.
19 . A computer system, comprising:
a processing unit; and
a computer-readable medium having encoded thereon computer-executable instructions to cause the processing unit to:
obtain an asset graph representing a network, comprising a plurality of nodes representing assets of the network and edges representing relationships between the assets;
calculate, using the asset graph, a local connectivity metric for a node of the asset graph, wherein the local connectivity metric is a product of an InDegree of the node and an OutDegree of the node, a betweenness of the node, or an in/out node similarity of the node;
based on the local connectivity metric, identify a local pattern associated with a potential security risk;
identify a candidate node or a candidate edge associated with the potential security risk; and
determine a modification suggestion based on the candidate node or candidate edge which, when implemented, reduces the potential security risk.
20 . A computer program product comprising a computer-readable storage medium having instructions recorded thereon for enabling a processor-based system to perform operations, the operations comprising:
obtaining an asset graph representing a network, comprising a plurality of nodes representing assets of the network and edges representing relationships between the assets;
calculating, using the asset graph, a local connectivity metric for a node of the asset graph, wherein the local connectivity metric is a product of an InDegree of the node and an OutDegree of the node, a betweenness of the node, or an in/out node similarity of the node;
based on the local connectivity metric, identifying a local pattern associated with a potential security risk;
identifying a candidate node or a candidate edge associated with the potential security risk; and
determining a modification suggestion based on the candidate node or candidate edge which, when implemented, reduces the potential security risk.