Apparatuses, methods, and computer program products for automatic improved network architecture generation
Various embodiments of the present disclosure are directed to automatic improved network architecture generation. In this regard, embodiments may process data representing a network architecture to generate an improved network architecture that resolves one or more vulnerabilities associated with the network architecture. In this regard, embodiments such as apparatuses, methods, and computer program products, are provided to identify a network architecture comprising a networked device set, determine cybersecurity threat set associated with the network architecture, identify an improved network configuration data set based on the cybersecurity threat set and the network device architecture, wherein each recommended sub network configuration of the improved network configuration data set decreases a threat likelihood associated with at least one determined cybersecurity threat from the cybersecurity threat set, generate an improved network architecture based on the network architecture and the improved network configuration data set, and output the improved network architecture.
1. A method comprising:
receiving a network architecture analysis request from a requestor system, wherein the network architecture analysis request comprises structured data representative of a network architecture;
identifying the network architecture by extracting the structured data from the network architecture analysis request, wherein the network architecture comprises one or more networked devices that are connected;
identifying a first subset of devices from amongst the one or more networked devices in the network architecture based on at least one of a type of the device in the first subset of devices, a functionality of the device in the first subset of devices, and a level associated with a network layer at which the device in the first subset of devices is configured to operate in the network architecture;
identifying from amongst a plurality of an architecture threat rule set, a first rule set applicable for the first subset of devices in the network architecture;
identifying from amongst the plurality of the architecture threat rule set, a second rule set applicable for a second subset of the devices in the network architecture different from the first subset of devices, wherein the second subset of devices are identified based on at least one of a type of the device in the second subset of devices, a functionality of the device in the second subset of devices, and a level associated with a network layer at which the device in the second subset of devices is configured to operate in the network architecture; and
determining a solution to mitigate vulnerabilities associated with the first and second subset of devices in the network architecture, wherein the vulnerabilities are identified for the first and second subset of devices based on the first rule set and the second rule set respectively, wherein determining the solution to mitigate vulnerabilities associated with the first subset of devices in the network architecture comprises:
retrieving a set threat solution data objects, wherein each of the set of threat solution data objects is associated with a number f changes to the network architecture;
selecting a first threat solution data object from the set of threat solution data objects based on a determination that the first threat solution data is associated with a minimum number of changes to the network architecture of the set of threat solution data objects; and
determining at least a portion of the solution to mitigate vulnerabilities associated with the first subset of device in the network architecture based on the first threat solution data object.
2. The method of claim 1 further comprising:
determining the solution to mitigate the vulnerabilities comprising changes to be made to the network architecture to resolve the vulnerabilities,
wherein the changes comprises removing a device from the one or more networked devices.
3. The method of claim 2 , further comprising:
rendering the network architecture on a display,
wherein the rendering comprises visually distinguishing the changes made to the network architecture to resolve the vulnerabilities.
4. The method of claim 1 further comprising:
determining the solution to mitigate the vulnerabilities based on a weighted combination of factors,
wherein the factors comprises protection against vulnerabilities and a projected cost associated with changes to be implemented.
5. The method of claim 1 , wherein the one or more threat solution data objects are retrieved based on requirements of at least one of: (i) shared networked devices, (ii) device configurations, and (iii) device connections.
6. The method of claim 1 further comprising:
determining the vulnerabilities being associated with firmware versions of the one or more networked devices.
7. A system comprising at least one processor and at least one non-transitory memory comprising program code, wherein the at least one non-transitory memory and the program code are configured to, with the at least one processor, cause the system to at least:
receive a network architecture analysis request from a requestor system, wherein the network architecture analysis request comprises structured data representative of a network architecture;
identify the network architecture by extracting the structured data from the network architecture analysis request, wherein the network architecture comprises one or more networked devices that are connected;
identify a first subset of devices from amongst the one or more networked devices in the network architecture based on at least one of a type of the device in the first subset of devices, a functionality of the device in the first subset of devices, and a level associated with a network layer at which the device in the first subset of devices is configured to operate in the network architecture;
identify a first rule set from amongst a plurality of an architecture threat rule set, the first rule set is applicable for the first subset of devices in the network architecture;
identify a second rule set from amongst the plurality of the architecture threat rule set and applicable for a second subset of devices in the network architecture, wherein the second subset of the devices are different from the first subset of devices, further the second subset of devices are identified based on at least one of a type of the device in the second subset of devices, a functionality of the device in the second subset of devices, and a level associated with a network layer at which the device in the second subset of devices is configured to operate in the network architecture; and
determine a solution to mitigate vulnerabilities associated with the first and second subset of devices in the network architecture, wherein the vulnerabilities are identified for the first and second subset of devices based on the first rule set and the second rule set respectively, wherein to determine the solution to mitigate vulnerabilities associated with the first subset of devices in the network architecture comprises the at least one non-transitory memory and the program code being configured to, with the at least one processor, cause the system to further:
retrieve a set of threat solution data objects, wherein each of the set of threat solution data objects is associated with a number of changes to the network architecture;
select a first threat solution data object from the set of threat solution data objects based on a determination that the first threat solution data is associated with a minimum number of changes to the network architecture of the set of threat solution data objects, and
determine at least a portion of the solution to mitigate abilities associated with the first subset of device in the network architecture based on the first threat solution data object.
8. The system of claim 7 , wherein the at least one non-transitory memory and the program code are configured to, with the at least one processor, cause the system to further:
determine the solution to mitigate the vulnerabilities comprising changes to be made to the network architecture to resolve the vulnerabilities,
wherein the changes comprises removing a device from the one or more networked devices.
9. The system of claim 8 , wherein the at least one non-transitory memory and the program code are configured to, with the at least one processor, cause the system to further:
render the network architecture on a display,
wherein the rendering comprises visually distinguishing the changes made to the network architecture to resolve the vulnerabilities.
10. The system of claim 7 , wherein the at least one non-transitory memory and the program code are configured to, with the at least one processor, cause the system to further:
determine the solution to mitigate the vulnerabilities based on a weighted combination of factors,
wherein the factors comprises protection against vulnerabilities and a projected cost associated with changes to be implemented.
11. The system of claim 7 , wherein the one or more threat solution data objects are retrieved based on (i) requirements of one or more of shared networked devices, (ii) device configurations, and/or (iii) device connections.
12. The system of claim 7 , wherein the at least one non-transitory memory and the program code are configured to, with the at least one processor, cause the system to further:
determine the vulnerabilities being associated with firmware versions of the one or more networked devices.
13. A non-transitory computer-readable storage medium having computer program instructions thereon, the computer program instructions, in execution with one or more processors configured to:
receive a network architecture analysis request from a requestor system, wherein the network architecture analysis request comprises structured data representative of a network architecture;
identify the network architecture by extracting the structured data from the network architecture analysis request, wherein the network architecture comprises one or more networked devices that are connected;
identify a first subset of devices from amongst the one or more networked devices in the network architecture based on at least one of a type of the device in the first subset of devices, a functionality of the device in the first subset of devices, and a level associated with a network layer at which the device in the first subset of devices is configured to operate in the network architecture;
identify from amongst a plurality of an architecture threat rule set, a first rule set applicable for the first subset of devices in the network architecture;
identify from amongst the plurality of the architecture threat rule set, a second rule set applicable for a second subset of the devices in the network architecture different from the first subset of devices, wherein the second subset of devices are identified based on at least one of a type of the device in the second subset of devices, a functionality of the device in the second subset of devices, and a level associated with a network layer at which the device in the second subset of devices is configured to operate in the network architecture; and
determine a solution to mitigate vulnerabilities associated with the first and second subset of devices in the network architecture, wherein the vulnerabilities are identified for the first and second subset of devices based on the first rule set and the second rule set respectively, wherein to determine the solution to mitigate vulnerabilities associated with the first subset of devices in the network architecture comprises the computer program instructions, in execution with one or more processors being further configured to:
retrieve a set of threat solution data objects, wherein each of the set of threat solution data objects is associate number of changes to the network architecture;
select a first threat solution data object from the set of threat solution data objects based on a determination that the first threat solution data is associated with a minimum number of changes to the network architecture of the set of threat solution data objects; and
determine at least a portion of the solution to mitigate vulnerabilities associated with the first subset of device in the network architecture based on the first threat solution data object.
14. The non-transitory computer-readable storage medium of claim 13 , wherein the computer program instructions, in execution with one or more processors are further configured to:
determine the solution to mitigate the vulnerabilities comprising changes to be made to the network architecture to resolve the vulnerabilities,
wherein the changes comprises removing a device from the one or more networked devices.
15. The non-transitory computer-readable storage medium of claim 13 , wherein the computer program instructions, in execution with one or more processors are further configured to:
render the network architecture on a display,
wherein the rendering comprises visually distinguishing the changes made to the network architecture to resolve the vulnerabilities.
16. The non-transitory computer-readable storage medium of claim 13 , wherein the computer program instructions, in execution with one or more processors are further configured to:
determine the solution to mitigate the vulnerabilities based on a weighted combination of factors,
wherein the factors comprises protection against vulnerabilities and a projected cost associated with changes to be implemented.
17. The non-transitory computer-readable storage medium of claim 13 , wherein the one or more threat solution data objects are retrieved based on (i) requirements of one or more of shared networked devices, (ii) device configurations, and/or (iii) device connections.