Granted Patent B2

US 12,726,503 · App. 18/782,843 · Granted Sep 1, 2026

Inventors: Rajesh Sharma (San Diego, CA); Jeremy Miller (San Diego, CA); Stephan Chenette (San Diego, CA); Albert Lopez (San Diego, CA); Shubhi Mittal (San Diego, CA); Andres Gazzoli (San Diego, CA)

Assignee: AttackIQ, Inc.

H04L63/1433

Abstract

Claims (105)

1 . A method comprising:

accessing an attack graph comprising a set of nodes connected according to a sequence of actions, executed on a machine in a second computer network, representing a known attack on the second computer network, each node in the set of nodes:

corresponding to an action in the sequence of actions; and

storing a set of behaviors analogous to the action and executable by a target asset to emulate an effect of the action on the machine in the second computer network;

scheduling the target asset connected to a target network to automatically execute analogous behaviors stored in the set of nodes in the attack graph;

accessing a set of alerts generated by a set of security tools deployed on the target network; and

characterizing a vulnerability of the target network based on presence of alerts in the set of alerts indicating detection and prevention of analogous behaviors executed by the target asset.

2 . The method of claim 1 :

wherein accessing the attack graph comprises accessing the attack graph comprising the set of nodes, each node in the set of nodes storing the set of behaviors comprising:

a nominal behavior executable by the target asset to emulate the action; and

a set of alternative behaviors analogous to the nominal behavior and executable by the target asset to emulate an effect of the action; and

wherein scheduling the first asset comprises scheduling the target asset to automatically execute nominal behaviors and alternative behaviors stored in the set of nodes in the attack graph.

3 . The method of claim 1 , further comprising:

accessing an attack record defining the sequence of actions executed on the machine; and

for a first action in the sequence of actions:

based on the attack record, deriving a first effect of the first action on the machine in the second computer network;

based on the attack record, defining a first nominal behavior:

representing the first action executed on the machine during the known attack; and

executable by the target asset to emulate the first action;

defining a first set of alternative behaviors:

analogous to the first nominal behavior; and

executable by the target asset to emulate the first effect at the target asset; and

storing the first nominal behavior and the first set of alternative behaviors in a first node in the set of nodes in the attack graph.

4 . The method of claim 1 , further comprising:

accessing an attack record defining:

the sequence of actions executed on the machine; and

a second sequence of actions executed on a second machine on the second computer network during the known attack on the second computer network;

initializing a second attack graph comprising a second set of nodes;

for each action in the second sequence of actions:

based on the attack record, deriving an effect of the action on the second machine in the second computer network;

based on the attack record, defining a set of behaviors analogous to the action and executable by a second asset to emulate the effect of the action on the second machine in the second computer network: and

storing the set of behaviors according in a node in the second set of nodes in the second attack graph;

connecting the second set of nodes in the second attack graph according to the second sequence of actions by the second machine during known attack; and

scheduling the second asset connected to the target network to execute nominal behaviors and alternative behaviors stored in the second set of nodes in the second attack graph.

5 . The method of claim 1 , wherein accessing the attack graph comprises accessing the attack graph comprising the set of nodes comprising a first node:

corresponding to a first action in the sequence of actions;

storing a first nominal behavior executable by the target asset to emulate the first action;

storing a first set of alternative behaviors analogous to the first nominal behavior and executable by the target asset to emulate a transition from a first start condition, at the machine prior to start of the first action, to a first end condition at the machine following completion of the first action; and

storing a first reversing behavior executable by the target asset to transition from the first end condition to the first start condition.

6 . The method of claim 1 , wherein accessing the attack graph comprises accessing the attack graph comprising the set of nodes comprising a first node:

corresponding to a first action in the sequence of actions;

storing a first nominal behavior executable by the target asset to emulate the first action, the first nominal behavior prescribing a first nominal technique and a first nominal procedure; and

storing a first set of alternative behaviors analogous to the first nominal behavior and executable by the target asset to emulate a first effect of the first action, the first set of alternative behaviors comprising a second alternative behavior prescribing the first nominal technique and a second procedure different from the first nominal procedure.

7 . The method of claim 6 , wherein scheduling the target asset comprises scheduling the target asset to execute a script that emulates the first effect of the first action according to the first nominal technique and the second alternative procedure prescribed by the second alternative behavior.

8 . The method of claim 1 :

further comprising, for a first action in the sequence of actions:

defining a first target hierarchy for a first set of behaviors analogous to the first action and executable by the target asset to emulate a first effect of the first action; and

storing the first set of behaviors according to the first target hierarchy in a first node in the set of nodes in the attack graph; and

wherein scheduling the target asset comprises scheduling the target asset on the target network to execute analogous behaviors according to target hierarchies stored in the set of nodes in the attack graph.

9 . The method of claim 8 , wherein defining the first target hierarchy comprises defining the first target hierarchy specifying:

attempted execution, by the target asset, of a first nominal script executable by the target asset to emulate the first action; and

attempted execution, by the target asset responsive to failed execution of the first nominal script, of a second alternative script executable by the target asset to emulate the first effect of the first action.

10 . The method of claim 8 , further comprising, by the target asset:

executing a first nominal script that emulates the first action at a first time according to the first target hierarchy; and

in response to detecting failed execution of the first nominal script, executing a second alternative script that emulates the first effect of the first action at a second time succeeding the first time according to the first target hierarchy.

11 . The method of claim 1 , further comprising, by the target asset:

executing analogous behaviors stored in a first subset of nodes in the attack graph; and

executing reversing behaviors stored in a second subset of nodes in the attack graph.

12 . The method of claim 1 :

wherein accessing the set of alerts comprises accessing a set of detection alerts indicating detection of behaviors occurring on the target network by the set of security tools; and

wherein characterizing the vulnerability of the target network comprises:

scanning the set of detection alerts for a target detection alert corresponding to a target behavior, stored in a node in the set of nodes in the attack graph, attempted by the target asset; and

characterizing the target network as vulnerable in response to absence of the target detection alert in the set of detection alerts.

13 . The method of claim 1 , wherein characterizing the vulnerability of the target network comprises:

correlating a subset of alerts in the set of alerts with behaviors executed by the target asset according to the attack graph; and

calculating the vulnerability of the target network based on a quantity of alerts in the subset of alerts.

14 . The method of claim 1 , further comprising, in response to characterizing the vulnerability of the target network greater than a threshold vulnerability:

scheduling a second asset connected to the target network to execute analogous behaviors stored in the set of nodes in the attack graph, the second asset distinct from the target asset;

accessing a second set of alerts generated by the set of security tools deployed on the target network; and

characterizing a scope of the vulnerability of the target network based on presence of alerts in the second set of alerts indicating detection and prevention of analogous behaviors, stored in nodes in the attack graph, executed by the second asset.

15 . A method comprising:

accessing an attack record defining a sequence of actions executed on a machine in a second computer network;

for each action in the sequence of actions:

based on the attack record, deriving an effect of the action on the machine in the second computer network;

based on the attack record, defining a set of behaviors analogous to the action and executable by a target asset to emulate the effect of the action on the machine in the second computer network; and

storing the set of behaviors in a node in a set of nodes in an attack graph;

connecting the set of nodes in the attack graph according to the sequence of actions representing a known attack on the second computer network; and

scheduling the target asset connected to a target network to automatically execute analogous behaviors stored in the set of nodes in the attack graph.

16 . The method of claim 15 , further comprising:

accessing a set of alerts generated by a set of security tools deployed on the target network; and

characterizing a vulnerability of the target network based on presence of alerts in the set of alerts indicating detection and prevention of analogous behaviors executed by the target asset.

17 . The method of claim 15 , wherein deriving the effect of the action, defining the set of behaviors, and storing the set of behaviors for each action in the sequence of actions comprises, for a first action in the sequence of actions:

based on the attack record, deriving a first effect of the first action on the machine in the second computer network;

based on the attack record, defining a first nominal behavior:

representing the first action executed on the machine during the known attack; and

executable by the target asset to emulate the first action;

defining a first set of alternative behaviors:

analogous to the first nominal behavior; and

executable by the target asset to emulate the first effect at the target asset; and

storing the first nominal behavior and the first set of alternative behaviors in a first node in the set of nodes in the attack graph.

18 . The method of claim 17 , wherein storing the first nominal behavior and the first set of alternative behaviors comprises storing the first set of alternative behaviors executable by the target asset to emulate a transition from a first start condition, at the machine prior to start of the first action, to a first end condition at the machine following completion of the first action.

19 . A method comprising:

scheduling a target asset connected to a target network to automatically execute analogous behaviors stored in an attack graph comprising a set of nodes connected according to a sequence of actions representing a known attack on a second computer network, each node in the set of nodes:

corresponding to an action in the sequence of actions; and

storing a set of behaviors analogous to the action and executable by the target asset to emulate an effect of the action on a machine in the second computer network; and

characterizing a vulnerability of the target network based on presence of alerts in a set of alerts, generated by a set of security tools deployed on the target network, indicating detection and prevention of analogous behaviors executed by the target asset.

20 . The method of claim 19 , further comprising, for a first action in the sequence of actions:

based on an attack record defining the sequence of actions executed on the machine, deriving a first effect of the first action on the machine in the second computer network;

based on the attack record, defining a first nominal behavior:

representing the first action executed on the machine during the known attack; and

executable by the target asset to emulate the first action;

defining a first set of alternative behaviors:

analogous to the first nominal behavior; and

executable by the target asset to emulate the first effect at the target asset; and

storing the first nominal behavior and the first set of alternative behaviors in a first node in the set of nodes in the attack graph.

Assignments (1)

Continuity (6)

References Cited (77)