George Mason University

The Mitre Corporation

Government of the United States of America, As Represented by the Secretary of Commerce

Other

National Institute of Standards and Technology

Steven E Noel

Sushil Jajodia

Eric B Robertson

Lingyu Wang

Anoop Singhal

Brian C O'Berry

Michael A Jacobs

Vipin Swarup

Massimiliano Albanese

Pramod Kalapa

Mandira D Hegde

Brianna L Chen

Man M Sapra

Stephen F Purdy

Kam Him Tam

Karin Luisa Johnsgard

Michael Limiero

Christine M Difonzo

Jeremy T Martin

Matthew Share

Robert G Weierbach

Eric Harley

Sushil Jajodie

Described herein are systems and methods for grouping computing devices in a computing network and predicting future communications links between computing devices for the purpose of developing a computing network microsegmentation policy. In one or more examples, the systems and methods described herein can predict future links in a computing network using a plurality of combinations of node similarity, node grouping, and link prediction methods. Each unique combination of methods can be assessed by comparing the predicted links to observed network traffic to determine the quality of the prediction. The quality of prediction can be assessed by generate F1 curves for each combination of methods. The combination with the highest quality prediction can then be selected and tuned (by adjusting a threshold associated with the combination). Once tuned, the selected combination (i.e., model) can then be used generate and/or modify a microsegmentation policy associated with the computing network.

Systems and methods for behavioral link prediction for network access microsegmentation policy

Disclosed herein are system, method, and computer program product embodiments for creating cyber situational understanding in an operational environment. An embodiment operates by normalizing streaming cyber information for a plurality of cyberspace entities and generating cyber-graphs based on relationships between two or more of the plurality of cyberspace entities. A cyber-threat inquiry of the cyber-graphs returns potential cyber-threats that are subsequently visualized as an overlay on a corresponding operational environment.

Graph analytics and visualization for cyber situational understanding

Methods and systems for translating a natural language user query into a graph database query are described. In some instances, the methods may comprise receiving a first input from a user comprising a natural language query regarding data in a graph database; processing the natural language query using a named entity recognition (NER) machine learning model to extract named entities from the natural language query and tag them according to an entity type; processing the tagged named entities using a semantic similarity algorithm to identify corresponding nodes and edges, and their associated properties, in the graph database; processing the natural language query using an intent classification machine learning model to determine a user intent for the natural language query; and applying a user intent-based template to the identified nodes and edges to formulate a graph database query that corresponds to the natural language query.

Methods and systems for natural language processing of graph database queries

Described herein is a system and method for improving cyber resilience for determining an optimal security policy for a network. The system uses an objective function to balance cyberattack risks, accessibility to network resources, resource limitations, minimum mission availability requirements within a network environment, or a combination thereof. The objective function comprises objectives (one or more variables that enhance accessibility to network resources and reduce cyberattack risks) and constraints (one or more variables that characterize resource limitations or minimum mission availability requirements within a network environment). The optimal security policy is selected by solving one or more optimization problems. The optimization problem may be solved by determining candidate security policies that meet the constraints and selecting among candidate security policies having the highest score for a given objective function.

Optimizing network microsegmentation policy for cyber resilience

A system and method for implementing a graph database to analyze and monitor a status of an enterprise computer network is provided. In one example, a plurality of sensors can be inputted into sensor interface in which all of the data associated with the sensors in converted into a common data format. The data can be parsed into a data model that contains nodes and edges in order to generate a graph database model that can allow a network analyst to analyze the real-time status of a computer network. The graph database model can include multiple layers including an infrastructure layer, a cyber threats layer, a cyber posture layer, and a mission readiness layer. The graph database model can also be queried by a user using a domain-specific query language, so as to provide a user-friendly syntax in generating queries.

System and method for visualizing and analyzing cyber-attacks using a graph model

Systems and methods for determining a safety level of a network vulnerable to attack from at least one origin to at least one target are described. Machines, components, and vulnerabilities in a network may be associated to one another. Degrees of similarity among the vulnerabilities may be determined and subsets of vulnerabilities may be grouped based on their determined degrees of similarity to one another. This data may be used to generate an attack graph describing exploitation of vulnerabilities and grouped vulnerabilities and defining vulnerability exploit condition relationships between at least one origin and at least one target. The attack graph may be analyzed using a k-zero day metric function to determine a safety level.

K-zero day safety

A system and method for determining at least one hardening strategy to prevent at least one attack, comprising: performing processing associated with obtaining at least one attack graph, the at least one attack graph comprising at least one goal condition, at least one initial condition, and at least one exploit; performing processing associated with obtaining at least one allowable action that disables the at least one initial condition; performing processing associated with obtaining costs associated with the at least one allowable action; and performing processing associated with utilizing the at least one allowable action to determine at least one recommended strategy from the at least one allowable action taking into account the costs.

Methods and systems for determining hardening strategies

Disclosed is a system for correlating intrusion events using attack graph distances. The system includes an attack graph generator, an exploit distance calculator, an intrusion detector, an event report/exploit associator, an event graph creator, an event graph distance calculator, a correlation value calculator, and a coordinated attack analyzer. An attack graph is constructed for exploits and conditions in a network. The exploit distance calculator determines exploit distances for exploit pair(s). The intrusion detector generates event. Events are associated with exploits. Event graph distances are calculated. Correlation values are calculated for event pair(s) using event graph distances. The correlation values are analyzed using a correlation threshold to detect coordinated attacks.

Intrusion event correlation system

Disclosed is a system for modeling, analyzing, and responding to network attacks. Machines are mapped to components, components are mapped to vulnerabilities, and vulnerabilities are mapped to exploits. Each of the exploits includes at least one precondition mapped to at least one postcondition. An attack graph which defines inter-exploit distances is generated using at least one of the exploits. The attack graph is aggregated. At least one hardening option is determined using the aggregated attack graph. Hardening options include applying at least one corrective measure to at least one initial condition, where the initial condition is the initial state of a precondition.

Network attack modeling, analysis, and response

Intrusion event correlator

Disclosed is framework for aggregating network attack graphs. A network may be represented as a dependency graph. Condition set(s), exploit set(s) and machine set(s) may be generated using information from the dependency graph. Exploit-condition set(s) may be generated using the condition set(s) and the exploit set(s). Machine-exploit set(s) may be generated using the exploit-condition set(s) and machine set(s).

Attack graph aggregation

Disclosed is a network hardening mechanism. The mechanism: generates a dependency graph from a multitude of exploits; constructs a goal conditions expression which may then be used to determine set(s) of safe network configurations. A subset of these safe network configuration sets may then be selected for implementation using hardening costs as a criterion.

Growing community of inventors

Dale City, VA, United States of America

Steven E Noel