Granted Patent B2

US 12,393,694 · App. 18/007,362 · Granted Aug 19, 2025

Inventors: Abdelkader Lahmadi (Le Chesnay, FR); Jérôme Francois (Le Chesnay, FR); Frédéric Beck (Le Chesnay, FR)

Assignee: INSTITUT NATIONAL DE RECHERCHE EN INFORMATIQUE ET EN AUTOMATIQUE (INRIA)

G06F21/577G06F2221/034

Abstract

Claims (40)

1. A computer-implemented method for testing cybersecurity of a target environment, comprising operations including:

a) receiving target environment data comprising software elements;

b) accessing a database of vulnerabilities, each vulnerability being defined by a tuple associating a vulnerability identifier, a list of means defining the means used to exploit the vulnerability, and a list of consequences defining the consequences for exploiting the vulnerability, and extracting therefrom a list of vulnerabilities comprising all of the vulnerabilities comprising a vulnerability identifier associated with a software element included in the target environment data;

c) building a list of vulnerability chains based on the list of vulnerabilities by initialising at least one pair comprising an empty list as the current list and one of the vulnerabilities from the list of vulnerabilities as the current vulnerability, and for each couple, by executing the following operations

c)1) for each given vulnerability of the list of vulnerabilities distinct from the current vulnerability and absent from the tuples in the current list, comparing the consequences of the current vulnerability with the means of the given vulnerability, and,

c)2) whenever a similarity between a consequence of the list of consequences of the current vulnerability with a means of the list of means of the given vulnerability is found,

c)2)i) defining one or more new chains by adding to each of the chains of the current list whose last tuple includes the current vulnerability a tuple associating the given vulnerability, a similarity identifier, the consequence of the list of consequences of the current vulnerability, and the means of the list of means of the given vulnerability,

c)2)ii) adding the new chain(s) to the list of vulnerability chains,

c)2)iii) repeating the operations a) and b) with the given vulnerability as the current vulnerability, and the list of vulnerability chains as the current list.

2. The method according to claim 1 , wherein the operation c) includes initializing as many pairs as there are vulnerabilities in the list of vulnerabilities.

3. The method according to claim 1 , wherein the operation c)2) comprises determining a value of similarity between a consequence of the list of consequences of the current vulnerability and a means of the list of means of the given vulnerability, and determining that this value of similarity is strictly greater than a selected threshold.

4. The method according to claim 3 , wherein the selected threshold is zero.

5. The method according to claim 3 , wherein when the consequence of the list of consequences of the current vulnerability is identical to the means of the list of means of the given vulnerability, the similarity value is 1.

6. The method according to claim 1 ,

wherein the target environment data further comprise software element configuration data and software element relationship data, wherein the tuple defining a vulnerability further comprises a list of context data defining the software context in which the vulnerability can be executed, the method further comprising:

d) comparing the lists of context data of the vulnerabilities of each vulnerability chain in the list of vulnerability chains with the configuration data and/or the software element relationship data, and

d)1) storing in a first list the vulnerability chains whose vulnerabilities comprise lists of context data which are all contained in the configuration data and/or the software element relationship data, and

d)2) storing in a second list the vulnerability chains of which only some of the vulnerabilities comprise lists of context data contained in the configuration data and/or the software element relationship data.

7. The method according to claim 6 , further comprising:

e) obtaining exploits corresponding to the vulnerabilities of the vulnerability chains of the first list and of the second list, implementing the exploit chains of the first list and of the second list with these exploits, and returning the chains while classifying them according to whether they belong to the first list or the second list and according to the success rate of their implementation.

8. A non-transitory computer readable data storage medium on which a computer program is recorded, which comprises instructions that when executed by a processor of a computer system configure the computer system to implement a method for testing cybersecurity of a target environment, comprising operations including:

a) receiving target environment data comprising software elements;

b) accessing a database of vulnerabilities, each vulnerability being defined by a tuple associating a vulnerability identifier, a list of means defining the means used to exploit the vulnerability, and a list of consequences defining the consequences for exploiting the vulnerability, and extracting therefrom a list of vulnerabilities comprising all of the vulnerabilities comprising a vulnerability identifier associated with a software element included in the target environment data;

c) building a list of vulnerability chains based on the list of vulnerabilities by initialising at least one pair comprising an empty list as the current list and one of the vulnerabilities from the list of vulnerabilities as the current vulnerability, and for each couple, by executing the following operations

c)1) for each given vulnerability of the list of vulnerabilities distinct from the current vulnerability and absent from the tuples in the current list, comparing the consequences of the current vulnerability with the means of the given vulnerability, and,

c)2) whenever a similarity between a consequence of the list of consequences of the current vulnerability with a means of the list of means of the given vulnerability is found,

c)2)i) defining one or more new chains by adding to each of the chains of the current list whose last tuple includes the current vulnerability a tuple associating the given vulnerability, a similarity identifier, the consequence of the list of consequences of the current vulnerability, and the means of the list of means of the given vulnerability,

c)2)ii) adding the new chain(s) to the list of vulnerability chains,

c)2)iii) repeating the operations a) and b) with the given vulnerability as the current vulnerability, and the list of vulnerability chains as the current list.

9. A computer system comprising:

a processor; and

a non-transitory computer readable medium coupled to the processor and comprising instructions stored thereon instructions which when executed by the processor configure the computer system to implement a method for testing cybersecurity of a target environment, comprising operations including:

a) receiving target environment data comprising software elements;

b) accessing a database of vulnerabilities, each vulnerability being defined by a tuple associating a vulnerability identifier, a list of means defining the means used to exploit the vulnerability, and a list of consequences defining the consequences for exploiting the vulnerability, and extracting therefrom a list of vulnerabilities comprising all of the vulnerabilities comprising a vulnerability identifier associated with a software element included in the target environment data;

c) building a list of vulnerability chains based on the list of vulnerabilities by initialising at least one pair comprising an empty list as the current list and one of the vulnerabilities from the list of vulnerabilities as the current vulnerability, and for each couple, by executing the following operations

c)1) for each given vulnerability of the list of vulnerabilities distinct from the current vulnerability and absent from the tuples in the current list, comparing the consequences of the current vulnerability with the means of the given vulnerability, and,

c)2) whenever a similarity between a consequence of the list of consequences of the current vulnerability with a means of the list of means of the given vulnerability is found,

c)2)i) defining one or more new chains by adding to each of the chains of the current list whose last tuple includes the current vulnerability a tuple associating the given vulnerability, a similarity identifier, the consequence of the list of consequences of the current vulnerability, and the means of the list of means of the given vulnerability,

c)2)ii) adding the new chain(s) to the list of vulnerability chains,

c)2)iii) repeating the operations a) and b) with the given vulnerability as the current vulnerability, and the list of vulnerability chains as the current list.

Assignments (1)

Priority Claims (1)

Continuity (1)

References Cited (12)