Method for simulation aided security event management
View Patent ↗A method for simulation aided security event management, the method includes: generating attack simulation information that comprises multiple simulation data items of at least one data item type out of vulnerability instances data items, attack step data items and attack simulation scope data items; wherein the generating of attack simulation information is responsive to a network model, at least one attack starting point and attack action information; identifying security events in response to a correlation between simulation data items and event data; and prioritizing identified security events.
1. A method for simulation aided security event management, the method comprises:
obtaining event data indicative of a security event identified by a computerized security event manager;
searching for a simulated attack step that resembles the security event; and generating contextual information indicative of next attack steps and risk associated with the next attack steps in response to an attack simulation;
wherein the generating of the contextual information comprises extracting the contextual information from an attack simulation that determines possible multi-step attacks from start points to nodes and business assets within the network.
2. A method for simulation aided security event management, the method comprises:
obtaining event data indicative of a security event identified by a computerized security event manager;
searching for a simulated attack step that resembles the security event; and generating contextual information indicative of next attack steps and risk associated with the next attack steps in response to an attack simulation;
wherein the generating of the contextual information comprises extracting the contextual information from an attack graph that comprises graph nodes that represent attacker achievement, wherein transitions between the graph nodes represent attack steps or actions that enabled the attacker achievements.
3. A method for simulation aided security event management, the method comprises:
obtaining event data indicative of a security event identified by a computerized security event manager;
searching for a simulated attack step that resembles the security event; generating contextual information indicative of next attack steps and risk associated with the next attack steps in response to an attack simulation; and
generating attack simulation information that comprises multiple simulation data items of at least one data item type out of vulnerability instances data items, attack step data items and attack simulation scope data items; wherein the generating of attack simulation information is responsive to a network model, at least one attack starting point and attack action information.
4. A computer program product that comprises a non-transitory computer readable medium that stores instructions for:
obtaining event data indicative of a security event identified by a security event manager;
searching for a simulated attack step that resembles the security event; and
generating contextual information indicative of next attack steps and risk associated with the next attack steps in response to an attack simulation;
wherein the computer readable medium stores instructions for extracting the contextual information from an attack simulation that determines possible multi-step attacks from start points to nodes and business assets within the network.
5. A computer program product that comprises a non-transitory computer readable medium that stores instructions for:
obtaining event data indicative of a security event identified by a security event manager;
searching for a simulated attack step that resembles the security event; and
generating contextual information indicative of next attack steps and risk associated with the next attack steps in response to an attack simulation;
wherein the computer readable medium stores instructions for extracting the contextual information from an attack graph that comprises graph nodes that represent attacker achievement, wherein transitions between the graph nodes represent attack steps or actions that enabled the attacker achievements.
6. A computer program product that comprises a non-transitory computer readable medium that stores instructions for:
obtaining event data indicative of a security event identified by a security event manager;
searching for a simulated attack step that resembles the security event; and
generating contextual information indicative of next attack steps and risk associated with the next attack steps in response to an attack simulation;
wherein the computer readable medium stores instructions for generating attack simulation information that comprises multiple simulation data items of at least one data item type out of vulnerability instances data items, attack step data items and attack simulation scope data items; wherein the generating of attack simulation information is responsive to a network model, at least one attack starting point and attack action information.