Security attack knowledge graph and simulated neural network

Abstract

A method and system for creating, accessing and training a Security Attack Knowledge Graph (SA-KG) that functions as a Simulated Neural Network of Security Attacks (SNN-SA) is described. A Security Attack Knowledge Base (SA-KB) is assembled by transforming authoritative security documents into markup and database formats, following a contextual data model. A SA-KG is encoded from SA-KB content using a graph markup language, where nodes represent 'attack steps' and connecting directional edges represent “attack-enabling weaknesses”. Graph Computing Systems (GCS) access the SNN-SA, perform traversals and generate an output “attack-surface model” for an input scenario. Attack-surface models can include: enumerated attack paths, attack steps, attack-enabling weaknesses, guidance, test cases and mitigation actions. The SNN-SA can be trained and improved by evaluating GCS-generated output for input scenarios and exploratory graph queries. The SA-KB and SNN-SA can be updated with new authoritative security documents, historical data, experiential knowledge and analytical insights.