Nozomi Networks Sagl

Nozomi Networks Sagi

Alessandro Cavallaro Corti

Moreno Carullo

Andrea Carcano

Paolo Di Francescantonio

Alessandro Di Pinto

Alessandro Zamberletti

Roberto Bruttomesso

Alessandro Valente

Luca Cremona

Manlio Modugno

Network monitoring system () comprising: a communication network (NT) comprising a plurality of nodes (N-N) and a plurality of node connections (E-E); wherein each node comprises an asset (AS-AS) configured to receive/transmit packets; a plurality of software agents (AG-AG) each installed in at least part of said plurality of nodes; each software agent being configured to redirect packets from a respective asset; at least one monitoring computer (CS) provided with software resources configured to: receive the packets sent by each software agent (AG-AG); extract from said packets source addresses and destination addresses; identify the plurality of nodes (N-N) and the plurality of node connections (E-E) from said source and destination addresses and associate each node to a corresponding node identifier; constructing an abstract model () representing said communication network (NT), wherein each node is represented by the corresponding node identifier and each node connection is represented by a corresponding link between respective nodes.

Network monitoring system and method including software agents

The present invention relates to a method for detecting anomalies in data traffic generated by peripheral devices simulating human-like patterns retrieving all data packets sent by a peripheral device to a computer, identifying a data communication as a plurality of the data packets in a predetermined timeframe, parsing the content of each of the data packets of the data communication to extract a plurality of communication features of the data communication, classifying the communication features through a set of absolute classifiers and through a set of majority classifiers and signalling an anomaly of the data communication when at least the majority in the set of absolute classifiers or at least one in the set of absolute classifiers define the data communication as malicious.

Method for detecting anomalies in data traffic generated by peripheral devices simulating human-like patterns

The present invention relates to a method for representing objects of a network in a GUI with a graph clustering comprising retrieving a base graph comprising all of the objects of the network as respective nodes and links between said nodes, grouping two or more of the nodes in one or more clusters, initializing the clusters by calculating the cluster mass and the cluster radius of each of the clusters, assessing the clusters defining a visualization graph which represents the base graph as seen from a predefined distance value and positioning the visualization graph in the GUI, wherein the assessing comprises creating an empty visualization graph, calculating for each of the clusters the distance ratio as ratio between the cluster radius and the predefined distance value, evaluating the distance ratio with regard to a predefined distance ratio threshold, compressing the cluster when the distance ratio is higher than the predefined distance ratio threshold, adding in the visualization graph a single compressed cluster node for all child nodes and all child clusters arranged inside the cluster to be compressed, expanding the cluster when the distance ratio is lower than the predefined distance ratio threshold, adding in the visualization graph a plurality of nodes for all child nodes and all child clusters arranged inside the cluster to be expanded and adding in the visualization graph a link between the cluster and the node outside the cluster if the link was present between a node inside the cluster and the node outside the cluster in the base graph and a link between two of the clusters if the link was present between a node inside one of the clusters and a node inside the other of the clusters in the base graph, wherein every time a link needs to be added between the same of the cluster and of the node outside the cluster a count of a link strength is increased of an integer unit and wherein every time a link needs to be added between the same of two of the clusters a count of a link strength is increased of an integer unit.

Method for representing objects of a network in a GUI with a graph clustering

The present invention relates to a method for verifying vulnerabilities of network device using Common Vulnerabilities and Exposures ('CVE)' entries comprising generating a CVE tree from each of the CVE entry and defining an indexed CVE entry, that identifies vulnerable configuration fields and extracts a set of vulnerable conditions comprising an operator attribute and nested CPE records. The CVE tree is provided with the operator attribute as node and with Common Platform Enumeration (“CPE”) records as leaves from the node, wherein the decoding comprises tokenizing of the decoded string in a sequence of plurality of n-grams having predefined sizes, and wherein the matching comprises a lookup of the sequence of plurality of n-grams into the CVE tree, that raises an alert when the operator attribute corresponds a match between CPE records.

Method for verifying vulnerabilities of network devices using CVE entries

The present invention relates to a method for automatic derivation of attack paths in a network comprising defining the topology of the network as an enriched network topology, identifying the vulnerabilities of the topology as vulnerabilities information artifacts, building the atomic attack database of the network based on the topology and the vulnerabilities, translating the enriched network topology, the vulnerabilities information artifacts and the atomic attack database into a predefined formal model, executing a predefined SMT-based model checker for the predefined formal model to seek counterexamples and deriving the attack paths from the counterexamples, wherein the defining the topology comprises running, by a computerized data processing unit operatively connected to the network, a module of deep packet inspection of the network to build a network topology based on the information derived from the deep packet inspection module, running, by the computerized data processing unit, a module of active queries of the network to add further information to the network topology based on the information derived from the active queries to build the enriched network topology, wherein the identifying the vulnerabilities comprises running, by the computerized data processing unit, a vulnerability assessment module to identify the vulnerabilities information artifacts of each node of the network based on the matching between nodes information of the enriched network topology and known vulnerabilities of a predefined vulnerabilities database and wherein the building the atomic attack database comprises finding, by the computerized data processing unit, one or more atomic attacks for the network as preconditions and actions to capture the state of the system at a given moment in time, wherein the actions are expressed in terms of a set of features of said nodes.

Method for automatic derivation of attack paths in a network

The present invention relates to a method for representing objects of a network in a GUI comprising allocating all of the objects of the network as respective nodes in a two-dimensional space, assessing the gravitational forces of the nodes, and positioning the objects as graph in the GUI based on the gravitational forces of the nodes, wherein the allocating comprises enclosing all of the nodes in a single base square, dividing the single base square in a plurality of 1-level squares, each of the 1-level squares in a plurality of 2-level squares, iterating the subdividing of each of the (n)-level squares in a plurality of (n+1)-level squares, wherein the subdividing is made for the (n)-level squares provided with two or more of the nodes, wherein the assessing comprises selecting as source square one of the squares starting from the highest level, selecting and as receiver square one the squares starting from the highest level, evaluating if the source square and the receiver square are distant, computing the forces acting on the receiver square from the source square, if the source square and the receiver square are evaluated as distant or if the source square and the receiver square are evaluated as not distant and have respectively no lower level squares nested, sub-selecting as source square or as receiver square one of the squares of a lower level if the source square and the receiver square are evaluated as not distant, wherein the sub-selecting is iterated for all squares at same level, wherein the assessing is iterated for all the the possible combinations of source and receiver squares at 1st level, and wherein the assessing further comprises distributing, by the computerized data processing unit, the forces acting on each of the receiver square to all of the nodes in the corresponding receiver square defining the gravitational forces of all of the nodes.

Growing community of inventors

Varese, Italy

Alessandro Cavallaro Corti