	US 11,677,775 B2
	System and method for emulating a multi-stage attack on a node within a target network
Rajesh Sharma, San Diego, CA (US); Jeremy Miller, San Diego, CA (US); Stephan Chenette, San Diego, CA (US); Albert Lopez, San Diego, CA (US); Shubhi Mittal, San Diego, CA (US); and Andres Gazzoli, San Diego, CA (US)
Assigned to AttackIQ, Inc., San Diego, CA (US)
Filed by AttackIQ, Inc., San Diego, CA (US)
Filed on Jun. 3, 2022, as Appl. No. 17/832,106.
Application 17/832,106 is a continuation in part of application No. 17/083,275, filed on Oct. 28, 2020, granted, now 11,563,765.
Claims priority of provisional application 63/196,320, filed on Jun. 3, 2021.
Claims priority of provisional application 63/008,451, filed on Apr. 10, 2020.
Prior Publication US 2022/0377102 A1, Nov. 24, 2022
Int. Cl. H04L 9/40 (2022.01)

CPC H04L 63/1433 (2013.01)

20 Claims

1. A method comprising:

accessing an attack record defining a sequence of actions executed on a machine on a second computer network and representing a known attack on the second computer network;

initializing an attack graph comprising a set of nodes;

for each action in the sequence of actions:

based on the attack record, deriving a start condition at the machine prior to start of the action;

based on the attack record, deriving an end condition at the machine following completion of the action;

based on the attack record, defining a nominal behavior:

representing the action executed by the machine during the known attack; and

executable by a target asset on a target network to emulate the action;

defining a set of alternative behaviors:

analogous to the nominal behavior; and

executable by the target asset to emulate a transition from the start condition to the end condition at the target asset;

defining a target hierarchy for the nominal behavior and the set of alternative behaviors; and

storing the nominal behavior and the set of alternative behaviors according to the target hierarchy in a node in the set of nodes in the attack graph;

linking the set of nodes in the attack graph according to the sequence of actions representing the known attack in the attack record;

scheduling the target asset on the target network to selectively execute nominal behaviors and alternative behaviors, according to target hierarchies, stored in the set of nodes in the attack graph during a first time period;

accessing a set of alerts generated by a set of security tools, deployed on the target network, during the first time period; and

characterizing a vulnerability of the target network based on presence of alerts, in the set of alerts, indicating detection and prevention of nominal behaviors and alternative behaviors, stored in nodes in the attack graph, executed by the target asset during the first time period.