Systems for computer network security risk assessment including user compromise analysis associated with a network of devices
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for computer network security risk assessment. One of the methods includes obtaining compromise likelihoods for user accounts. Information describing a network topology of a network is obtained, with the network topology being nodes each connected by an edge to other nodes, each node being associated with a compromise likelihood, and one or more nodes are high value nodes associated with a compromise value. Unique paths to each of the high value nodes are determined for a particular user account. An expected value for each path is determined based on the compromise likelihood of the particular user account, the compromise likelihood of each node included in the path, the communication weight of each edge included in the path, and the compromise value associated with the high value node. User interface data is generated describing at least one path.
1. A computerized method for determining security risks of a network that includes user accounts accessing different network devices included in the network, the method comprising:
by a computing device having one or more computer processors and a non-transitory computer readable storage device storing software instruction for execution by the one or more computer processors,
receiving information indicating respective compromise likelihoods of a set of user accounts of the network;
obtaining information describing a network topology of the network, wherein the network topology comprises a plurality of nodes each connected by an edge to one or more of the plurality of nodes, each node being associated with a compromise likelihood, each edge being associated with a communication weight, and wherein one or more nodes are high value nodes;
determining, for a particular user account of the set of user accounts, expected values associated with a plurality of unique paths to a particular high value node of the one or more high value nodes, each of the plurality of unique paths initiating at a node to which the particular user account can authenticate and each associated expected value indicating risk associated with access to the particular high value node by the particular user account from the node, and wherein determining the expected values comprises:
accessing user access logs identifying nodes to which user accounts are authorized to authenticate, and identifying, based on the user access logs, a plurality of nodes to which the particular user account is authorized to authenticate,
determining a first unique path and a second unique path of the plurality of unique paths to the particular high value node, the first unique path initiating at a first of the identified nodes to which the particular user account is authorized to authenticate and the second unique path initiating at a second of the identified nodes to which the particular user account is authorized to authenticate, and
determining, for the particular user account, a first expected value for the first unique path and a second expected value for the second unique path based on the information describing the network topology and the compromise likelihood of the particular user account, including respective communication weights included in the first unique path and the second unique path of the network topology, wherein the communication weights are indicative of probabilities associated with user transition between nodes; and
generating, for presentation, an interactive user interface describing one or more of the first unique path and the second unique path of the plurality of unique paths.
2. The computerized method of claim 1 , the method further comprising determining the compromise likelihood of the particular user account comprising:
obtaining summary data associated with the set of user accounts, wherein summary data for each user account summarizes historical user behavior of the user account;
comparing summary data associated with the particular user account to one or more other user accounts of the set of user accounts; and
determining, using the comparisons, the compromise likelihood of the particular user account.
3. The computerized method of claim 2 , wherein the particular user account and the one or more other user accounts are each associated with a same employee role.
4. The computerized method of claim 2 , wherein user behavior for a user account describes systems utilized to access the user account, geographic locations from which the user account was accessed, and/or network actions performed by the user account on network devices.
5. The computerized method of claim 1 , wherein each node is associated with one or more network devices, and wherein a communication weight for an edge connecting a first node and a second node indicates a frequency of communication events between the first node and the second node, and wherein the method further comprises determining the communication weight for the edge connecting the first node and the second node, comprising:
obtaining network logs indicating communication events between network devices included in the network;
determining, from the network logs, a frequency of communication events between network devices associated with nodes connected by a respective edge; and
determining the communication weight for the edge connecting the first node and the second node from the relative frequency of communication events for the edge in comparison to a frequency of communication events for the remaining edges in the network topology.
6. The computerized method of claim 1 , wherein the method further comprises determining, for the particular user account, unique paths to the particular high value node comprising:
obtaining information indicating originating nodes the particular user account can authenticate to, and information indicating nodes in which communication events to the originating events are possible;
determining, for the particular high value node, unique orderings of nodes subsequent to a respective originating node that terminate at the particular high value node, wherein communication events between each subsequent node in an ordering are possible; and
assigning information describing each unique ordering as a unique path.
7. The computerized method of claim 1 , wherein determining an expected value for a particular unique path comprises:
determining a conditional likelihood of the particular user account accessing all nodes included in the unique path prior to the particular high value node; and
computing a multiplication of the conditional likelihood and the compromise value associated with the particular high value node, and assigning the computation as the expected value.
8. The computerized method of claim 1 , further comprising:
determining an expected value for all unique paths based on the compromise likelihood of the particular user account, the compromise likelihood of each node included in any unique path, the communication weight of each edge included in any unique path, and the compromise value associated with the respective high value node, wherein each communication weight indicates a likelihood of the particular user account following the respective edge.
9. The computerized method of claim 1 , wherein the interactive user interface describes a unique path associated with a highest expected value.
10. The computerized method of claim 1 , wherein the interactive user interface:
presents information describing expected values for the one or more high value nodes;
responds to selection of the particular high value node; and
updates to present information describing a unique path associated with a highest expected value for the particular high value node.
11. The computerized method of claim 1 , wherein the interactive user interface presents a graphical depiction of a particular unique path of the one or more of the first unique path and the second unique path comprises graphical depictions of nodes included in the particular unique path connected by edges, wherein an indication of a compromise likelihood of each node and an indication of a communication weight for each edge is included in the interactive user interface, and wherein an indication of a compromise likelihood associated with the particular high value node is included in the interactive user interface.
12. The method of claim 1 , wherein accessing user access logs comprises accessing an Access Control List associated with user account authorization.
13. A system comprising one or more computers and one or more computer storage media storing instructions that when executed by the one computers cause the one or more computers to perform operations comprising:
receiving information indicating respective compromise likelihoods of a set of user accounts of the network;
obtaining information describing a network topology of the network, wherein the network topology comprises a plurality of nodes each connected by an edge to one or more of the plurality of nodes, each node being associated with a compromise likelihood, each edge being associated with a communication weight, and wherein one or more nodes are high value nodes;
determining, for a particular user account of the set of user accounts, expected values associated with a plurality of unique paths to a particular high value node of the one or more high value nodes, each of the plurality of unique paths initiating at a node to which the particular user account can authenticate and each associated expected value indicating risk associated with access to the particular high value node by the particular user account from the node, and wherein determining the expected values comprises:
accessing user access logs identifying nodes to which user accounts are authorized to authenticate, and identifying, based on the user access logs, a plurality of nodes to which the particular user account is authorized to authenticate,
determining a first unique path and a second unique path of the plurality of unique paths to the particular high value node, the first unique path initiating at a first of the identified nodes to which the particular user account is authorized to authenticate and the second unique path initiating at a second of the identified nodes to which the particular user account is authorized to authenticate,
determining, for the particular user account, respective expected values for the first unique path and the second unique path based on the information describing the network topology and the compromise likelihood of the particular user account, including respective communication weights included in the unique paths of the network topology, wherein the communication weights are indicative of probabilities associated with user transition between nodes; and
generating user interface data describing at least one of the unique paths.
14. The system of claim 13 , wherein the operations further comprise determining the compromise likelihood of the particular user account comprising:
obtaining summary data associated with the set of user accounts, wherein summary data for each user account summarizes historical user behavior of the user account;
comparing summary data associated with the particular user account to one or more other user accounts of the set of user accounts; and
determining, using the comparisons, the compromise likelihood of the particular user account.
15. The system of claim 13 , wherein determining an expected value for a particular unique path comprises:
determining a conditional likelihood of the particular user account accessing all nodes included in the unique path prior to the particular high value node; and
computing a multiplication of the conditional likelihood and the compromise value associated with the particular high value node, and assigning the computation as the expected value.
16. The system of claim 13 , wherein the operations further comprise determining, for the particular user account, unique paths to the particular high value node comprising:
obtaining information indicating originating nodes the particular user account can authenticate to, and information indicating nodes in which communication events to the originating events are possible;
determining, for the particular high value node, unique orderings of nodes subsequent to a respective originating node that terminate at the particular high value node, wherein communication events between each subsequent node in an ordering are possible; and
assigning information describing each unique ordering as a unique path.
17. The system of claim 13 , wherein the operations further comprise:
providing, for presentation on a client device, user interface data describing expected values for the one or more high value nodes;
receiving, from the client device, information indicating a selection of the particular high value node; and
providing, for presentation, information describing a unique path associated with a highest expected value for the particular high value node.
18. A non-transitory computer storage medium storing instructions that when executed by a system of one or more computers cause the one or more computers to perform operations comprising:
receiving information indicating respective compromise likelihoods of a set of user accounts of the network;
obtaining information describing a network topology of the network, wherein the network topology comprises a plurality of nodes each connected by an edge to one or more of the plurality of nodes, each node being associated with a compromise likelihood, each edge being associated with a communication weight, and wherein one or more nodes are high value nodes;
determining, for a particular user account of the set of user accounts, expected values associated with a plurality of unique paths to a particular high value node of the one or more high value nodes, each of the plurality of unique paths initiating at a node to which the particular user account can authenticate and each associated expected value indicating risk associated with access to the particular high value node by the particular user account from the node, and wherein determining the expected values comprises:
accessing user access logs identifying nodes to which user accounts are authorized to authenticate, and identifying, based on the user access logs, a plurality of nodes to which the particular user account is authorized to authenticate,
determining a first unique path and a second unique path of the plurality of unique paths to the particular high value node, the first unique path initiating at a first of the identified nodes to which the particular user account is authorized to authenticate and the second unique path initiating at a second of the identified nodes to which the particular user account is authorized to authenticate,
determining, for the particular user account, respective expected values for the first unique path and the second unique path based on the information describing the network topology and the compromise likelihood of the particular user account, including respective communication weights included in the unique paths of the network topology, wherein the communication weights are indicative of probabilities associated with user transition between nodes; and
generating user interface data describing at least one of the unique paths.
19. The non-transitory computer storage medium of claim 18 , wherein the operations further comprise determining the compromise likelihood of the particular user account comprising:
obtaining summary data associated with the set of user accounts, wherein summary data for each user account summarizes historical user behavior of the user account;
comparing summary data associated with the particular user account to one or more other user accounts of the set of user accounts; and
determining, using the comparisons, the compromise likelihood of the particular user account.
20. The non-transitory computer storage medium of claim 18 , wherein determining an expected value for a particular unique path comprises:
determining a conditional likelihood of the particular user account accessing all nodes included in the unique path prior to the particular high value node; and
computing a multiplication of the conditional likelihood and the compromise value associated with the particular high value node, and assigning the computation as the expected value.
21. The non-transitory computer storage medium of claim 18 , wherein the operations further comprise:
providing, for presentation on a client device, user interface data describing expected values for the one or more high value nodes;
receiving, from the client device, information indicating a selection of the particular high value node; and
providing, for presentation, information describing a unique path associated with a highest expected value for the particular high value node.