Granted Patent B2

US 12,238,132 · App. 17/831,848 · Granted Feb 25, 2025

Inventors: Massimiliano Albanese (Potomac, MD); Ibifubara Iganibo (Fairfax, VA); Marc E. Mosko (Santa Cruz, CA); Alejandro E. Brito (Mountain View, CA)

Assignee: Xerox Corporation

H04L63/1433H04L41/0816H04L63/1416H04L63/1425H04L63/1466

Abstract

Claims (103)

1. A computer-executable method, comprising:

determining, in a graph which represents a system of components:

vulnerability nodes which represent known vulnerabilities to the system, wherein exposed vulnerability nodes represent vulnerabilities at a perimeter of the system and non-exposed vulnerability nodes represent vulnerabilities not at the perimeter of the system, and

wherein the exposed vulnerability nodes are each associated with a first likelihood of exploitation and the non-exposed vulnerability nodes are each associated with a second likelihood of exploitation based on a prior likelihood associated with a prior vulnerability node which enables a respective non-exposed vulnerability node; and

dependency nodes which represent the components in the system,

wherein direct dependency nodes are each associated with an exposure factor which indicates an amount of degradation caused to a respective component based on exploitation of a respective vulnerability which directly degrades the respective component;

calculating, across all the non-exposed vulnerability nodes and all the direct dependency nodes, a score which indicates an attack volume of the system using a metric which is based on at least:

a respective second likelihood associated with a first non-exposed vulnerability node;

an exposure factor associated with a respective dependency node which represents a component directly degraded based on exploitation of a vulnerability represented by the first non-exposed vulnerability node; and

a loss of utility of the component represented by the respective dependency node,

wherein the score is calculated for one or more configurations of the system of components; and

selecting, based on the calculated score for the one or more configurations of the system of components, a first configuration of the one or more configurations of the system of components which optimizes a configuration of the system.

2. The method of claim 1 ,

wherein the graph comprises a multi-layer graph which includes a configuration subgraph, a vulnerability subgraph, and a dependency subgraph,

wherein the vulnerability subgraph includes the vulnerability nodes, which include the exposed vulnerability nodes and the non-exposed vulnerability nodes, and

wherein a directed edge from an exposed vulnerability node or a first non-exposed vulnerability node to a second non-exposed vulnerability node is associated with the second likelihood.

3. The method of claim 2 , wherein calculating the score using the metric is further based on:

a weighted summation of a loss of utility, across all the components represented by the direct dependency nodes, caused by an exploitation of any vulnerability which directly or indirectly degrades a respective component,

wherein a respective second likelihood associated with a respective non-exposed vulnerability node is used as a weight in the weighted summation.

4. The method of claim 2 ,

wherein the dependency graph includes the dependency nodes, which include the direct dependency nodes and indirect dependency nodes, and

wherein a respective indirect dependency node is associated with a respective dependency function which indicates a level of dependency of the respective indirect dependency node upon a dependency node reachable by a directed edge from the respective indirect dependency node to the dependency node.

5. The method of claim 4 ,

wherein calculating the score is performed across all the non-exposed vulnerability nodes, all the direct dependency nodes, and all the indirect dependency nodes using the metric and is further based on:

the respective dependency function associated with the respective indirect dependency node.

6. The method of claim 5 , wherein calculating the score using the metric is further based on:

a set of components which depend upon a respective component represented by the respective direct dependency node based on a chain of directed edges.

7. The method of claim 5 , further comprising:

applying a second configuration for the system based on the calculated score for the second configuration using the metric,

wherein the second configuration prioritizes a set of actions based on the calculated score for the second configuration.

8. The method of claim 5 , further comprising:

applying, based on the calculated score for the one or more configurations of the system of components using the metric, an artificial intelligence search or a dynamic programming tool to obtain a third configuration which has an improved security posture over at least one of the one or more configurations of the system of components.

9. The method of claim 5 , further comprising:

displaying, on a screen of a user device, one or more interactive elements which allow the user to:

view the multi-layer graph, including the vulnerability nodes, the dependency nodes, directed edges, the first and second likelihoods of exploitation associated with the exposed and non-exposed vulnerability nodes, exposure factors, and dependency functions in any of the configuration subgraph, the vulnerability subgraph, and the dependency subgraph;

view or modify configuration parameters for the system using a graph generation tool to obtain the one or more configurations of the system of components;

calculate the score using the metric for the one or more configurations of the system of components;

view the calculated score for the one or more configurations of the system of components;

select a first configuration of the one or more configurations of the system of components;

view an average attack volume for the selected first configuration; and

view an explanation of evidence associated with the selected configuration.

10. The method of claim 1 ,

wherein the first likelihood of exploitation and the second likelihood of exploitation are associated with a Common Vulnerability Scoring System exploitability score.

11. The method of claim 1 , wherein the score is at least one of:

a first score calculated based on eliminating security constraints which contradict operational requirements, wherein the first score defines a lower bound on the attack volume;

a second score calculated based on maintaining operation of a testbed while considering settings of current values,

wherein when a current value is not feasible against a set of non-relaxable constraints, the current value is invalidated, which enables a set of vulnerabilities associated with the current value, and

wherein when the current value is feasible against the set of non-relaxable constraints, the system relaxes all conflicting relaxable constraints;

a third score calculated based on a recommended configuration; and

a fourth score calculated based on relaxing all constraints of the testbed, wherein the fourth score defines an upper bound on the attack volume.

12. The method of claim 1 ,

wherein selecting the first configuration which optimizes the configuration of the system is based on at least one of a security priority and an operational priority.

13. A computer system comprising:

a processor; and

a storage device storing instructions that when executed by the processor cause the processor to perform a method, the method comprising:

determining, in a graph which represents a system of components:

vulnerability nodes which represent known vulnerabilities to the system, wherein exposed vulnerability nodes represent vulnerabilities at a perimeter of the system and non-exposed vulnerability nodes represent vulnerabilities not at the perimeter of the system, and

wherein the exposed vulnerability nodes are each associated with a first likelihood of exploitation and the non-exposed vulnerability nodes are each associated with a second likelihood of exploitation based on a prior likelihood associated with a prior vulnerability node which enables a respective non-exposed vulnerability node; and

dependency nodes which represent the components in the system,

wherein direct dependency nodes are each associated with an exposure factor which indicates an amount of degradation caused to a respective component based on exploitation of a respective vulnerability which directly degrades the respective component;

calculating, across all the non-exposed vulnerability nodes and all the direct dependency nodes, a score which indicates an attack volume of the system using a metric which is based on at least:

a respective second likelihood associated with a first non-exposed vulnerability node;

an exposure factor associated with a respective dependency node which represents a component directly degraded based on exploitation of a vulnerability represented by the first non-exposed vulnerability node; and

a loss of utility of the component represented by the respective dependency node,

wherein the score is calculated for one or more configurations of the system of components; and

selecting, based on the calculated score for the one or more configurations of the system of components, a first configuration of the one or more configurations of the system of components which optimizes a configuration of the system.

14. The computer system of claim 13 ,

wherein the graph comprises a multi-layer graph which includes a configuration subgraph, a vulnerability subgraph, and a dependency subgraph,

wherein the vulnerability subgraph includes the vulnerability nodes, which include the exposed vulnerability nodes and the non-exposed vulnerability nodes, and

wherein a directed edge from an exposed vulnerability node or a first non-exposed vulnerability node to a second non-exposed vulnerability node is associated with the second likelihood.

15. The computer system of claim 14 , wherein calculating the score using the metric is further based on:

a weighted summation of a loss of utility, across all the components represented by the direct dependency nodes, caused by an exploitation of any vulnerability which directly or indirectly degrades a respective component,

wherein a respective second likelihood associated with a respective non-exposed vulnerability node is used as a weight in the weighted summation.

16. The computer system of claim 14 ,

wherein the dependency graph includes the dependency nodes, which include the direct dependency nodes and indirect dependency nodes, and

wherein a respective indirect dependency node is associated with a respective dependency function which indicates a level of dependency of the respective indirect dependency node upon a dependency node reachable by a directed edge from the respective indirect dependency node to the dependency node, and

wherein calculating the score is performed across all the non-exposed vulnerability nodes, all the direct dependency nodes, and all the indirect dependency nodes using the metric and is further based on the respective dependency function associated with the respective indirect dependency node.

17. The computer system of claim 16 , wherein calculating the score using the metric is further based on:

a set of components which depend upon a respective component represented by the respective direct dependency node based on a chain of directed edges.

18. The computer system of claim 16 , wherein the method further comprises:

displaying, on a screen of a user device, one or more interactive elements which allow the user to:

view the multi-layer graph, including the vulnerability nodes, the dependency nodes, directed edges, the first and second likelihoods of exploitation associated with the exposed and non-exposed vulnerability nodes, exposure factors, and dependency functions in any of the configuration subgraph, the vulnerability subgraph, and the dependency subgraph;

view or modify configuration parameters for the system using a graph generation tool to obtain the one or more configurations of the system of components;

calculate the score using the metric for the one or more configurations of the system of components;

view the calculated score for the one or more configurations of the system of components;

select a first configuration of the one or more configurations of the system of components;

view an average attack volume for the selected first configuration; and

view an explanation of evidence associated with the selected configuration.

19. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method, the method comprising:

determining, in a graph which represents a system of components:

vulnerability nodes which represent known vulnerabilities to the system, wherein exposed vulnerability nodes represent vulnerabilities at a perimeter of the system and non-exposed vulnerability nodes represent vulnerabilities not at the perimeter of the system, and

wherein the exposed vulnerability nodes are each associated with a first likelihood of exploitation and the non-exposed vulnerability nodes are each associated with a second likelihood of exploitation based on a prior likelihood associated with a prior vulnerability node which enables a respective non-exposed vulnerability node; and

dependency nodes which represent the components in the system,

wherein direct dependency nodes are each associated with an exposure factor which indicates an amount of degradation caused to a respective component based on exploitation of a respective vulnerability which directly degrades the respective component, and

wherein indirect dependency nodes are each associated with a respective dependency function which indicates a level of dependency of a respective indirect dependency node upon a dependency node;

calculating, across all the non-exposed vulnerability nodes, all the direct dependency nodes, and all the indirect dependency nodes, a score for one or more configurations of the system of components, wherein the score indicates an attack volume of the system using a metric which is based on at least:

a respective second likelihood associated with a first non-exposed vulnerability node;

an exposure factor associated with a respective dependency node which represents a component directly degraded based on exploitation of a vulnerability represented by the first non-exposed vulnerability node;

a loss of utility of the component represented by the respective dependency node; and

a respective dependency function associated with a respective indirect dependency node; and

selecting, based on the calculated score for the one or more configurations of the system of components, a first configuration of the one or more configurations of the system of components which optimizes a configuration of the system.

20. The non-transitory computer-readable storage medium of claim 19 , wherein the method further comprises:

applying, based on the calculated score for the one or more configurations of the system of components using the metric, an artificial intelligence search or a dynamic programming tool to obtain a third configuration which has an improved security posture over at least one of the one or more configurations of the system of components.

Assignments (9)

Continuity (2)

References Cited (109)

Cited By (1)

US 12,381,903