Vulnerability chain mapping using graph modeling
Mechanisms are provided for identifying vulnerability chains in a computing system. Computer system vulnerability characteristics for a plurality of computer system vulnerabilities from a vulnerability registry are retrieved. For each vulnerability, a threat score is calculated indicating a level of risk of the vulnerability to security of the computing system. Based on the vulnerability characteristics and the threat score, a directed acyclic graph (DAG) data structure is generated having a plurality of vulnerability chains, each vulnerability chain having a plurality of vulnerabilities, represented as nodes of the DAG, linked to each other from a root node to a terminating node. Links of the DAG have weights corresponding to a function of the threat scores of the nodes directly connected by the link. A graphical representation of the DAG is generated that depicts the weights of the links to thereby represent relative threat of the vulnerabilities linked by the links.
1 . A method, in a data processing system, for identifying vulnerability chains in a computing system, the method comprising:
retrieving computer system vulnerability characteristics for a plurality of computer system vulnerabilities from a vulnerability registry, wherein the vulnerability registry is an external, standards-based vulnerability registry comprising a repository of publicly disclosed computer system vulnerabilities, the vulnerability registry being distinct from the data processing system;
determining, for each computer system vulnerability, a threat score indicating a level of risk of the vulnerability to security of the computing system;
generating, based on the computer system vulnerability characteristics and the threat score, a directed acyclic graph data structure, wherein the directed acyclic graph (DAG) data structure comprises a plurality of vulnerability chains, wherein each vulnerability chain comprises a plurality of computer system vulnerabilities, represented as nodes of the DAG data structure, linked to each other from a root node to a terminating node, and wherein links of the DAG data structure have weights that are mathematically determined as a function of the threat scores of the two nodes directly connected by the link, such that each link weight is computed based on the threat scores of its adjacent nodes and is not a probability unrelated to those threat scores; and
generating a graphical representation of the DAG data structure, wherein the graphical representation of the DAG data structure depicts the weights of the links to thereby represent relative threat of the vulnerabilities linked by the links.
2 . The method of claim 1 , further comprising identifying a prioritized vulnerability chain, in the plurality of vulnerability chains, having a relatively largest vulnerability chain risk based on the weights of the links of the vulnerability chains, wherein generating the graphical representation of the DAG data structure comprises accentuating the prioritized vulnerability chain in the graphical representation of the DAG data structure.
3 . The method of claim 2 , further comprising determining, for each vulnerability chain in the DAG data structure, a vulnerability chain risk for the vulnerability chain based on an accumulation of weights of links that are part of the vulnerability chain, and wherein the relatively largest vulnerability chain risk is a vulnerability chain risk of the vulnerability chains in the DAG data structure that has a largest relative value.
4 . The method of claim 1 , further comprising executing a computer analysis of the DAG data structure to identify a vulnerability chain representing a relatively largest threat to an organization computing system, wherein the computer analysis comprises at least one of a depth-first-search of the DAG data structure or a breadth-first-search of the DAG data structure to enumerate vulnerability chains in the DAG data structure.
5 . The method of claim 1 , further comprising executing a computer analysis of the DAG data structure to identify a vulnerability chain representing a relatively largest threat to an organization computing system, wherein the computer analysis comprises identifying a relatively longest vulnerability chain in the DAG data structure.
6 . The method of claim 1 , wherein generating the DAG data structure comprises associating computer system vulnerabilities with each other in a dependency of the DAG data structure based on characteristics of the computer system vulnerabilities, wherein these characteristics comprise at least one of an attack vector, an impact on a confidentiality, integrity, and availability (CIA) triad, or consequences of exploitation of the computer system vulnerability.
7 . The method of claim 6 , wherein generating the DAG data structure comprises, for each vulnerability chain:
selecting a first computer system vulnerability, having characteristics indicating the first computer system vulnerability is a computer system vulnerability that has a local attack vector, a security bypass, or credential exfiltration, as an initial computer system vulnerability in the vulnerability chain;
selecting one or more second computer system vulnerabilities, having characteristics indicating the one or more second computer system vulnerabilities are computer system vulnerabilities that perform a privilege escalation, credential dumping, or data enumeration, as intermediate computer system vulnerabilities in the vulnerability chain; and
selecting a third computer system vulnerability, having characteristics indicating the third computer system vulnerability is a computer system vulnerability that executes authenticated code, performs a command injection, or performs a file upload, as a final computer system vulnerability in the vulnerability chain.
8 . The method of claim 1 , further comprising:
receiving, from an organization computing system, a vulnerability listing data structure specifying a set of organization computing system vulnerabilities, wherein the set of organization computing system vulnerabilities is a subset of the plurality of computer system vulnerabilities;
matching computer system vulnerabilities in the set of organization computing system vulnerabilities to computer system vulnerabilities specified in the DAG data structure; and
identifying vulnerability chains in the DAG data structure corresponding to the set of organization computing system vulnerabilities based on results of the matching, to thereby generate one or more organization vulnerability chains.
9 . The method of claim 8 , wherein the one or more organization vulnerability chains comprises a plurality of organization vulnerability chains, and wherein the method further comprises prioritizing organization vulnerability chains in the plurality of organization vulnerability chains relative to one another based on vulnerability chain risk values.
10 . The method of claim 1 , wherein determining, for each computer system vulnerability, the threat score comprises executing a threat scoring algorithm of a threat intelligence platform computing system.
11 . A computer program product comprising a computer readable storage medium having a computer readable program stored therein, wherein the computer readable program, when executed on a data processing system, causes the data processing system to:
retrieve computer system vulnerability characteristics for a plurality of computer system vulnerabilities from a vulnerability registry, wherein the vulnerability registry is an external, standards-based vulnerability registry comprising a repository of publicly disclosed computer system vulnerabilities, the vulnerability registry being distinct from the data processing system;
determine, for each computer system vulnerability, a threat score indicating a level of risk of the vulnerability to security of the computing system;
generate, based on the computer system vulnerability characteristics and the threat score, a directed acyclic graph data structure, wherein the directed acyclic graph (DAG) data structure comprises a plurality of vulnerability chains, wherein each vulnerability chain comprises a plurality of computer system vulnerabilities, represented as nodes of the DAG data structure, linked to each other from a root node to a terminating node, and wherein links of the DAG data structure have weights that are mathematically determined as a function of the threat scores of the two nodes directly connected by the link, such that each link weight is computed based on the threat scores of its adjacent nodes and is not a probability unrelated to those threat scores; and
generate a graphical representation of the DAG data structure, wherein the graphical representation of the DAG data structure depicts the weights of the links to thereby represent relative threat of the vulnerabilities linked by the links.
12 . The computer program product of claim 11 , wherein the computer readable program further causes the data processing system to identify a prioritized vulnerability chain, in the plurality of vulnerability chains, having a relatively largest vulnerability chain risk based on the weights of the links of the vulnerability chains, wherein generating the graphical representation of the DAG data structure comprises accentuating the prioritized vulnerability chain in the graphical representation of the DAG data structure.
13 . The computer program product of claim 12 , wherein the computer readable program further causes the data processing system to determine, for each vulnerability chain in the DAG data structure, a vulnerability chain risk for the vulnerability chain based on an accumulation of weights of links that are part of the vulnerability chain, and wherein the relatively largest vulnerability chain risk is a vulnerability chain risk of the vulnerability chains in the DAG data structure that has a largest relative value.
14 . The computer program product of claim 11 , wherein the computer readable program further causes the data processing system to execute a computer analysis of the DAG data structure to identify a vulnerability chain representing a relatively largest threat to an organization computing system, wherein the computer analysis comprises at least one of a depth-first-search of the DAG data structure or a breadth-first-search of the DAG data structure to enumerate vulnerability chains in the DAG data structure.
15 . The computer program product of claim 11 , wherein the computer readable program further causes the data processing system to execute a computer analysis of the DAG data structure to identify a vulnerability chain representing a relatively largest threat to an organization computing system, wherein the computer analysis comprises identifying a relatively longest vulnerability chain in the DAG data structure.
16 . The computer program product of claim 11 , wherein generating the DAG data structure comprises associating computer system vulnerabilities with each other in a dependency of the DAG data structure based on characteristics of the computer system vulnerabilities, wherein these characteristics comprise at least one of an attack vector, an impact on a confidentiality, integrity, and availability (CIA) triad, or consequences of exploitation of the computer system vulnerability.
17 . The computer program product of claim 16 , wherein generating the DAG data structure comprises, for each vulnerability chain:
selecting a first computer system vulnerability, having characteristics indicating the first computer system vulnerability is a computer system vulnerability that has a local attack vector, a security bypass, or credential exfiltration, as an initial computer system vulnerability in the vulnerability chain;
selecting one or more second computer system vulnerabilities, having characteristics indicating the one or more second computer system vulnerabilities are computer system vulnerabilities that perform a privilege escalation, credential dumping, or data enumeration, as intermediate computer system vulnerabilities in the vulnerability chain; and
selecting a third computer system vulnerability, having characteristics indicating the third computer system vulnerability is a computer system vulnerability that executes authenticated code, performs a command injection, or performs a file upload, as a final computer system vulnerability in the vulnerability chain.
18 . The computer program product of claim 11 , wherein the computer readable program further causes the data processing system to:
receive, from an organization computing system, a vulnerability listing data structure specifying a set of organization computing system vulnerabilities, wherein the set of organization computing system vulnerabilities is a subset of the plurality of computer system vulnerabilities;
match computer system vulnerabilities in the set of organization computing system vulnerabilities to computer system vulnerabilities specified in the DAG data structure; and
identify vulnerability chains in the DAG data structure corresponding to the set of organization computing system vulnerabilities based on results of the matching, to thereby generate one or more organization vulnerability chains.
19 . The computer program product of claim 18 , wherein the one or more organization vulnerability chains comprises a plurality of organization vulnerability chains, and wherein the method further comprises prioritizing organization vulnerability chains in the plurality of organization vulnerability chains relative to one another based on vulnerability chain risk values.
20 . An apparatus comprising:
at least one processor; and
at least one memory coupled to the at least one processor, wherein the at least one memory comprises instructions which, when executed by the at least one processor, cause the at least one processor to:
retrieve computer system vulnerability characteristics for a plurality of computer system vulnerabilities from a vulnerability registry, wherein the vulnerability registry is an external, standards-based vulnerability registry comprising a repository of publicly disclosed computer system vulnerabilities, the vulnerability registry being distinct from the data processing system;
determine, for each computer system vulnerability, a threat score indicating a level of risk of the vulnerability to security of the computing system;
generate, based on the computer system vulnerability characteristics and the threat score, a directed acyclic graph data structure, wherein the directed acyclic graph (DAG) data structure comprises a plurality of vulnerability chains, wherein each vulnerability chain comprises a plurality of computer system vulnerabilities, represented as nodes of the DAG data structure, linked to each other from a root node to a terminating node, and wherein links of the DAG data structure have weights that are mathematically determined as a function of the threat scores of the two nodes directly connected by the link, such that each link weight is computed based on the threat scores of its adjacent nodes and is not a probability unrelated to those threat scores; and
generate a graphical representation of the DAG data structure, wherein the graphical representation of the DAG data structure depicts the weights of the links to thereby represent relative threat of the vulnerabilities linked by the links.