Network security modeling system and method
View Patent ↗A network security modeling system which simulates a network and analyzes security vulnerabilities of the network. The system includes a simulator which includes a network vulnerabilities database and a network configuration module having network configuration data. The simulator determines vulnerabilities of the simulated network based on the network configuration data and the vulnerabilities database.
1. A network security modeling system comprising:
a network configuration module having network configuration data; and
a simulator coupled to the network configuration module to simulate and analyze networks based on the network configuration data, wherein the simulator includes a network vulnerabilities database, and wherein the network vulnerabilities database includes:
a plurality of known network vulnerabilities, wherein each network vulnerability includes a service to which it applies, defense conditions that might close the vulnerability, and resource and state conditions needed to exercise the vulnerability;
wherein the simulator includes a defender and an attacker user interface.
2. The system of claim 1 , wherein the network vulnerabilities database includes network vulnerability, attack and exploitation data.
3. The system of claim 2 , wherein the simulator includes a means for receiving the network vulnerability, attack and exploitation data.
4. A network security modeling system comprising:
a network configuration module having network configuration data;
a simulator coupled to the network configuration module for simulating and analyzing networks based on the network configuration, wherein the simulator includes a network vulnerabilities database; and
a mission objectives module coupled to the simulator, wherein the mission objectives module includes critical resource information used to determine network components that are involved in a specific attack scenario.
5. The system of claim 4 , wherein the network vulnerabilities database includes network vulnerability, attack and exploitation data.
6. The system of claim 4 , wherein the critical resource information includes goals, expectations and constraints for simulating the network.
7. The system of claim 4 , wherein the simulator includes a means for receiving the network vulnerability, attack and exploitation data.
8. The system of claim 4 , wherein the simulator includes a defender and an attacker interface.
9. A method of analyzing a computer network using a security modeling system, wherein the security modeling system includes a database of network vulnerability information, the method comprising:
receiving a network configuration of a computer network;
simulating the network based on the network configuration; and
determining vulnerabilities of the simulated network using the vulnerability information stored in the database, wherein the database includes a plurality of known network vulnerabilities, wherein each network vulnerability includes:
a plurality of known network vulnerabilities, wherein each network vulnerability includes a service to which it applies, defense conditions that might close the vulnerability, and resource and state conditions needed to exercise the vulnerability;
wherein simulating the network includes:
receiving mission objectives;
storing the mission objectives; and
simulating the network based on the network configuration and the mission objectives.
10. The method of claim 9 , wherein receiving a network configuration includes analyzing the network with a network discovery tool.
11. The method of claim 9 , wherein determining vulnerabilities includes modifying the simulation using a graphical user interface.
12. The method of claim 11 , wherein modifying the simulation includes dynamically interacting with an attacker.
13. The method of claim 12 , wherein modifying the simulation includes dynamically interacting in real time with the security modeling system.
14. The method of claim 11 , wherein modifying the simulation includes dynamically interacting in real time with the security modeling system.
15. The method of claim 9 , wherein determining vulnerabilities of the simulated network includes updating the vulnerabilities database when vulnerabilities are detected.
16. A machine-readable medium that provides instructions which, when executed by a machine, cause the machine to perform the method of claim 9 .
17. A method of opposing attackers of a computer network, comprising:
receiving a network configuration, wherein the network configuration comprises computer hardware and software component information;
receiving mission objectives including critical resource information used to determine network components that are involved in a specific attack scenario;
receiving commands from a network attacker;
simulating the network based on the commands received from the network attacker, wherein simulating the network includes determining results as a function of the network configuration, mission objectives and stored vulnerability data for the described computer hardware and software components; and
responding to the network attacker, wherein responding to the attacker includes responses selected from a group of responses including imposing barriers, providing response messages and protecting the network.
18. The method of claim 17 , wherein simulating the network further includes receiving commands from a defender and determining results based on the defender commands.
19. The method of claim 17 , wherein receiving configuration includes receiving critical resource information, wherein the critical resource information includes goals, expectation and constraints for simulating the network.
20. The method of claim 19 , wherein receiving commands includes receiving attack actions which include commands that simulate service functionality, commands that change services or nodes, and commands that exploit vulnerabilities.
21. A network security modeling system for simulating objective networks comprising:
a simulator having a plurality of databases, wherein the plurality of databases include mission objectives tables including information used to determine network components that are involved in a specific attack scenario, vulnerability tables, and network configuration tables, wherein the network configuration tables include network configuration data; and
a graphical user interface which operates with the simulator to allow input and output to clients.
22. The system of claim 21 , wherein the mission objectives tables include mission tables, mission files tables and mission services tables.
23. The system of claim 21 , wherein the vulnerability tables include service tables.