US 12,081,580 B2
System and method for emulating a multi-stage attack on a node within a target network
Rajesh Sharma, San Diego, CA (US); Jeremy Miller, San Diego, CA (US); Stephan Chenette, San Diego, CA (US); Albert Lopez, San Diego, CA (US); Shubhi Mittal, San Diego, CA (US); and Andres Gazzoli, San Diego, CA (US)
Assigned to AttackIQ, Inc., San Diego, CA (US)
Filed by AttackIQ, Inc., San Diego, CA (US)
Filed on May 1, 2023, as Appl. No. 18/141,888.
Application 18/141,888 is a continuation of application No. 17/832,106, filed on Jun. 3, 2022, granted, now 11,677,775.
Application 17/832,106 is a continuation in part of application No. 17/083,275, filed on Oct. 28, 2020, granted, now 11,563,765, issued on Jan. 24, 2023.
Claims priority of provisional application 63/196,320, filed on Jun. 3, 2021.
Claims priority of provisional application 63/008,451, filed on Apr. 10, 2020.
Prior Publication US 2023/0269266 A1, Aug. 24, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/1433 (2013.01) 21 Claims
OG exemplary drawing
 
1. A method comprising:
accessing an attack graph comprising a set of nodes linked according to a sequence of actions, executed on a machine in a second computer network, representing a known attack on the second computer network, each node in the set of nodes:
corresponding to an action in the sequence of actions;
storing a nominal behavior executable by a target asset to emulate the action; and
storing a set of alternative behaviors analogous to the nominal behavior and executable by the target asset to emulate a transition from a start condition, at the machine prior to start of the action, to an end condition at the machine following completion of the action;
scheduling the target asset, comprising an endpoint device connected to the target network, to automatically execute nominal behaviors and alternative behaviors stored in the set of nodes in the attack graph during a first time period;
accessing a set of alerts generated by a set of security tools, deployed on the target network, during the first time period; and
characterizing a vulnerability of the target network based on presence of alerts, in the set of alerts, indicating detection and prevention of nominal behaviors and alternative behaviors, stored in nodes in the attack graph, executed by the target asset during the first time period.