Granted Patent B2

US 8,356,353 · App. 12/147,282 · Granted Jan 15, 2013

Abstract

Claims (19)

1. A method of providing computer network attack simulation on a computer, comprising the steps of:

receiving a network configuration, a network setup description, and a penetration testing framework with a local agent installed in the penetration testing framework;

simulating the network based on the received network configuration, wherein the simulated network contains at least one of the group consisting of a simulated computer, a simulated machine, and a simulated network device;

receiving a remote agent running in one simulated computer of the simulated network and connected to the penetration testing framework through the local agent;

receiving a simulated exploit for compromising the at least one simulated computer, simulated machine, or simulated network device;

querying an exploit database with a property of said simulated exploit;

receiving an exploit outcome probability from said exploit database in response to said querying;

determining an outcome of the simulated exploit for compromising the at least one simulated computer, simulated machine, or simulated network device based on said exploit outcome probability; and

when the outcome of the simulated exploit is compromising the simulated computer, simulated machine, or simulated network device, virtually installing a remote agent on the at least one simulated computer, simulated machine, or simulated network device, wherein the remote agent allows a user to execute arbitrary operating system calls on the at least one simulated computer, simulated machine, or simulated network device from the local agent.

2. The method of claim 1 , further comprising the step of executing the arbitrary operating system calls on the simulated computer to analyze risk to which the network may be exposed.

3. The method of claim 1 , wherein the network configuration is provided by a configuration file.

4. The method of claim 3 , wherein the configuration file contains a template that is used for at least a portion of the at least one simulated computer, simulated machine, or simulated network device.

5. The method of claim 3 , wherein the configuration file describes which simulated computers are in the simulated network, and at least one of what applications and services are run by the simulated computers, what operating systems are run by the simulated computers, and how the simulated computers are connected through the network.

6. The method of claim 1 , wherein more than one simulator is used to perform the step of simulating the network configuration.

7. The method of claim 6 , wherein a simulator monitor provides management and administrative operations for each simulator.

8. The method of claim 7 , wherein a graphical user interface connected to the simulator allows a user of the present method to view information provided by the simulator monitor.

9. The method of claim 1 , wherein the network configuration includes at least two simulated computers that communicate with each other.

10. The method of claim 1 , further comprising the step of issuing arbitrary operating system calls from the local agent so that the arbitrary operating system calls are executed on the simulated computer and their answer is returned to the local agent to allow the execution of modules within the penetration testing framework.

11. The method of claim 1 , wherein the outcome is selected from the group consisting of compromising the system, crashing the system, and doing nothing.

Assignments (20)