Dynamic cybersecurity scoring using traffic fingerprinting and risk score improvement
A system for dynamic cybersecurity scoring using traffic fingerprinting and score improvement, that uses a web crawler that sends message prompts to external hosts and receives responses from external hosts, a time-series data store that produces time-series data from the message responses, and a directed computational graph module that analyzes the time-series data to produce a weighted score representing the overall cybersecurity state of an organization.
1 . A computer system comprising a hardware memory, wherein the computer system is configured to execute software instructions stored on nontransitory machine-readable storage media that:
retrieve stored time-series data pertaining to a network;
receive a directed computational graph for performing a plurality of transformation operations on at least a portion of the time-series data, wherein the directed computational graph comprises nodes and edges, the nodes representing the transformation operations and the edges representing message outputs between the nodes; and
produce a first weighted cybersecurity score based on at least a portion of the transformation operations, wherein the first weighted cybersecurity score represents a predicted risk of external cybersecurity threats;
simulate an attack against the network based on the first weighted cybersecurity score;
produce a second weighted cybersecurity score based on the outcome of the simulated attack, wherein the second weighted cybersecurity score represents an actual vulnerability to the attack that was simulated; and
produce a confidence score based on a comparison between the first and second weighted cybersecurity scores, wherein the confidence score represents the accuracy of the predicted risk based on the observed outcome of the simulated attack.
2 . The system of claim 1 , wherein the computer system is further configured to:
apply an adjustment to a model of the network, the model being based on the time-series data;
produce an additional weighted cybersecurity score for the adjusted model; and
compare the additional weighted cybersecurity score and the first weighted cybersecurity score to determine whether the adjustment resulted in an improvement to the predicted risk.
3 . The system of claim 1 , wherein the computer system is further configured to to:
receive cybersecurity reconnaissance data about a company from a web crawler; and
produce time-series data based on at least a portion of the cybersecurity reconnaissance data.
4 . The system of claim 3 , wherein the computer system is further configured to:
collect cybersecurity reconnaissance data from websites and web applications relevant to the company, the collection of cybersecurity reconnaissance data comprising:
identifying portions of each website or web application that web crawlers are requested to ignore;
fingerprinting each website or web application to identify characteristic patterns or markers that may be used to identify host or application details; and
checking each web application and website's administrative pages to determine if any administrative portals are vulnerable to cyber-attacks.
5 . A method for dynamic cybersecurity scoring, comprising the steps of:
retrieving, using a directed computational graph, stored time-series data pertaining to a network;
receiving a directed computational graph for performing a plurality of transformation operations on at least a portion of the time-series data, wherein the directed computational graph comprises nodes and edges, the nodes representing the transformation operations and the edges representing message outputs between the nodes; and
producing a first weighted cybersecurity score based on at least a portion of the transformation operations, wherein the first weighted cybersecurity score represents a predicted risk of external cyber-security threats;
simulating an attack against the network based on the first weighted cybersecurity score;
producing a second weighted cybersecurity score based on the outcome of the simulated attack, wherein the second weighted cybersecurity score represents an actual vulnerability to the attack that was simulated; and
producing a confidence score based on a comparison between the first and second weighted cybersecurity scores, wherein the confidence score represents the accuracy of the predicted risk based on the observed outcome of the simulated attack.
6 . The method of claim 5 , further comprising the steps of:
applying an adjustment to a model of the network, the model being based on the time-series data;
producing an additional weighted cybersecurity score for the adjusted model; and
comparing the additional weighted cybersecurity score and the first weighted cybersecurity score to determine whether the adjustment resulted in an improvement to the predicted risk.