Intelligent adversary simulator
An apparatus features processor(s) and a non-transitory storage medium including an intelligent-adversary simulator and a formatting modules. The simulator calculates path(s) of least resistance for a cyber threat in a cyber-attack scenario to compromise 1) a first virtualized instance (source device), 2) a second virtualized instance (targeted device), and 3) virtualized instances of components of a virtualized instance of a network associated with selected pathways of the cyber-attack scenario through the virtualized instance of the network. The virtualized instances may be based on historical knowledge of connectivity and behaviour patterns of users and devices within an actual network under analysis. The formatting module generates a report with identified devices that are communicatively coupled to the virtualized instance of the network and prioritized to allocate security resources. The simulator calculates the least resistance path(s) through the virtualized instance of the network and refrains from calculating every theoretically path therefrom.
1. An apparatus, comprising:
one or more processors; and
one or more non-transitory storage mediums accessible by the one or more processors, wherein the non-transitory storage mediums are configured to store software for execution by the one or more processors,
an intelligent-adversary simulator configured to calculate one or more paths of least resistance for a cyber threat in a cyber-attack scenario to compromise 1) a virtualized instance associated with a source device, 2) a virtualized instance associated with a targeted device, and 3) virtualized instances of one or more users, other devices, and any combinations of both of a virtualized instance of a network associated with selected pathways of the cyber-attack scenario through the virtualized instance of the network, wherein at least the virtualized instances of the users and/or other devices are based on historical knowledge of connectivity and behaviour patterns of actual users and devices within an actual network under analysis, wherein the intelligent-adversary simulator is configured to calculate a weight of how difficult it would be to compromise the users and/or other devices represented in the virtualized instance of the network as well as then assign to the users and/or other devices the calculated weight to resist the compromise from the cyber threat being simulated in the cyber-attack scenario during a simulation;
a formatting module is configured to generate a report with at least identified devices in the virtualized instance of the network with an assigned priority to allocate security resources to that identified device;
and
wherein the intelligent-adversary simulator is configured to calculate a subset of the one or more paths of least resistance to the cyber threat through the virtualized instance of the network and refrain from calculating every theoretically path; and thus exclude certain paths of least resistance, from the virtualized instance associated with the source device to the virtualized instance of the targeted device to reduce an amount of computing cycles needed by the one or more processors as well as an amount of memory storage needed by the non-transitory storage mediums, wherein the one or more non-transitory storage mediums are configured to store the software for the intelligent-adversary simulator and the formatting module, which are then configured to be executed by the one or more processors.
2. The apparatus of claim 1 , wherein the intelligent-adversary simulator is configured to construct a graph of the virtualized instance of the network including at least a) the virtualized instance associated with the source device, b) the virtualized instance associated with the targeted device, c) the virtualized instance of the one or more users, additional devices, and any combinations of both, and d) connections and pathways corresponding to the selected pathways through the virtualized instance of the network.
3. The apparatus of claim 1 , wherein a graph of the virtualized instance of the network is constructed in order to run a simulated cyber-attack scenario on the virtualized instance of the one or more users, other devices, and any combinations of both in order to generate information associated with the identified devices communicatively coupled to the virtualized instance of the network that are critical from a security standpoint and placement of the information into the generated report.
4. The apparatus of claim 3 , wherein the graph of the virtualized instance of the network is configured to assist to prioritize which of the identified devices should have a priority to allocate security resources based on the simulation of the cyber-attack scenario.
5. The apparatus of claim 1 , wherein the intelligent-adversary simulator is configured to search and query of i) a data store, ii) modules, or iii) one or more Artificial Intelligence (AI) models forming a cyber security appliance protecting the actual network under analysis from cyber threats for data known about the network and components of the network to create a graph of the virtualized instance of the network,
wherein the graph of the virtualize instance of the network is created with a plurality of 1) known characteristics of the network, 2) pathways or connections between the devices of the network, 3) security features and credentials of the devices or users of the devices, and 4) behavioural characteristics of the devices or the users of the devices.
6. The apparatus of claim 1 , wherein the non-transitory storage medium further comprises:
a profile manager module configured to communicate and cooperate with the intelligent-adversary simulator, where the profile manager module is configured to maintain a profile tag on each device, including the source device, connecting to the actual network under analysis based on behaviour and security characteristics of that device and then supply the profile tags for the devices during a construction of a graph.
7. The apparatus of claim 1 , wherein the non-transitory storage medium further comprises:
a profile manager module configured to maintain a profile tag for each of the devices before the simulation is carried out to eliminate a need to search and query for known data about each device being simulated during the simulation, wherein the profile manager module is configured to maintain the profile tag on each device based on device behaviour as detected by a network module cooperating with network probes ingesting traffic data for network devices and network users in the network under analysis as well as cooperation and analysis with Artificial Intelligence (AI) models modelling a normal pattern of life for entities in the network under analysis.
8. A method for threat hunting for cyber threats, comprising:
constructing a graph of a virtualized instance of a network that is based on an actual network under analysis and is represented by i) connections and pathways between virtualized instances of components spanning through the virtualized instance of the network and ii) virtualized instance of one or more users, devices and any combinations of both connected to the virtualized instance of the network, where the graph of the virtualized instance of the network is constructed in order to run a simulated cyber-attack scenario on the virtualized instance of the network;
calculating a weight of how difficult it would be to compromise the users and/or other devices represented in the virtualized instance of the network as well as then assigning to the users and/or devices the calculated weight to resist the compromise from the cyber threat being simulated in the simulated cyber-attack scenario;
calculating one or more paths of least resistance for a cyber threat in the simulated cyber-attack scenario to compromise 1) a virtualized instance associated with a source device of the one or more devices connected to the virtualized instance of the network, 2) a virtualized instance associated with a targeted device of the one or more devices, and 3) the virtualized instances of components of the virtualized instance of the network, wherein the virtualized instances of components being based on historical knowledge of connectivity and behaviour patterns of actual users and devices within the actual network under analysis;
generating a report with identified devices in the virtualized instance of the virtualized network that should have a priority to allocate security resources; and
calculating merely a subset of the one or more paths of least resistance through the virtualized instance of the network further refrains from calculating every theoretically path; and
thus exclude certain paths of least resistance, from the virtualized instance of the source device to the virtualized instance associated with the targeted device to reduce an amount of computing and memory resources.
9. The method of claim 8 , wherein the constructing of the graph of the virtualized instance of the network by an intelligent-adversary simulator comprises a) the virtualized instance associated with the source device, b) the virtualized instance associated with the target device, c) the virtualized instance of the devices, and d) the connections and pathways corresponding to a selected pathway through the virtualized instance of the network.
10. The method of claim 8 , wherein the constructing of the graph of the virtualized instance of the network is performed during the simulated cyber-attack scenario on the virtualized instance of the devices, in order to generate information that identifies one or more devices coupled to the virtualized instance of the network that are critical from a security standpoint, and place the information into the generated report.
11. The method of claim 10 , wherein the graph of the virtualized instance of the network is configured to assist to prioritize which of the one or more devices should have a priority to allocate security resources based on the simulated cyber-attack scenario.
12. The method of claim 8 , wherein the constructing of the graph of the virtualized instance of the network includes conducting virtualized instance of subnetworks associated with the network.
13. The method of claim 8 , wherein the constructing of the graph by an intelligent-adversary simulator is configured to search and query of i) a data store, ii) modules, or iii) one or more Artificial Intelligence (AI) models forming a cyber security appliance protecting the actual network under analysis from cyber threats for data known about the network and devices of the network to create the graph of the virtualized instance of the network.
14. The method of claim 13 , wherein the data known about the network and the devices of the network include data associated with 1) known characteristics of the network, 2) the pathways or connections between the devices of the network, 3) security features and credentials of the devices or users of the devices, and 4) behavioural characteristics of the devices or the users of the devices.
15. The method of claim 8 , further comprising:
maintaining a profile tag on each of the one or more actual devices connecting to the actual network under analysis based on behaviour and security characteristics of a corresponding device; and
supplying the profile tags for each of the one or more devices connecting to the virtualized instance of the network during the constructing of the graph.
16. The method of claim 15 , wherein the profile tag for each of the one or more devices is maintained before the simulated cyber-attack scenario is carried out to eliminate a need to search and query for known data about each device being simulated during the simulation.
17. A non-transitory storage medium including software that, upon execution by one or more processors, perform threat hunting for cyber threats, comprising:
an intelligent-adversary simulator configured to calculate one or more paths of least resistance for a cyber threat in a cyber-attack scenario to compromise 1) a virtualized instance associated with a source device, 2) a virtualized instance associated with a targeted device, and 3) virtualized instances of one or more users, other devices, and any combinations of both forming a virtualized instance of a network associated with selected pathways of the cyber-attack scenario through the virtualized instance of the network, wherein at least the virtualized instances being based on historical knowledge of connectivity and behaviour patterns of actual users and devices within the actual network under analysis, wherein the intelligent-adversary simulator is configured to calculate a weight of how difficult it would be to compromise the users and/or other devices represented in the virtualized instance of the network as well as then assign to the users and/or other devices the calculated weight to resist the compromise from the cyber threat being simulated in the cyber-attack scenario during a simulation; and
a formatting module is configured to generate a report with identified devices communicatively coupled to the virtualized instance of the virtualized network that should be assigned priority to allocate security resources, wherein the intelligent-adversary simulator is configured to calculate a subset of the one or more paths of least resistance through the virtualized instance of the network and refrain from calculating every theoretically path; and thus exclude certain paths of least resistance, from the virtualized instance of the source device to the virtualized instance of the targeted device to at least reduce an amount of memory storage needed by the non-transitory storage medium.