Patent ID: 11930046
Assignee: XEROX CORPORATION
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 10:
11. A computer system, comprising:
a processor;
a storage device storing instructions that when executed by the processor cause the processor to perform a method, the method comprising:
generating a multi-layer graph for a composed system comprising a collective network of a plurality of interconnected components, wherein the multi-layer graph comprises a configuration subgraph, a vulnerability subgraph, and a dependency subgraph;
determining, based on the multi-layer graph, a model for a multi-step attack on the composed system, by:
computing, based on a first set of variables and a first set of tunable parameters, a likelihood of exploiting a vulnerability in the composed system; and
computing, based on a second set of variables and a second set of tunable parameters, an exposure factor indicating an impact of exploiting a vulnerability on a utility of an associated component;

determining, based on the model, a set of attack paths that can be used in the multi-step attack; and
mitigating the multi-step attack on the composed system while preserving composed system functionality by modifying, based on the determined set of attack paths, at least one configuration associated with one of the plurality of interconnected components in the composed system or preserving the at least one configuration based on determining that preserving the system functionality outweighs a security impact associated with the determined set of attack paths.