Patent ID: 11895150
Assignee: ACCENTURE GLOBAL SOLUTIONS LIMITED
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 17:
18. A system, comprising:
one or more computers; and
a computer-readable storage device coupled to the one or more computers and having instructions stored thereon which, when executed by the one or more computers, cause the one or more computers to perform operations for process discovery in an enterprise network, the operations comprising:
receiving, by one or more computers, analytical attack graph data representative of an analytical attack graph, the analytical attack graph including:
one or more rule nodes each representing a network configuration rule; and
one or more impact nodes each representing an impact of one or more respective network configuration rules;

converting, by the one or more computers, the analytical attack graph to a tactic graph including one or more tactic nodes, each tactic node representing at least one rule node and at least one impact node, the converting comprising:
retrieving, from a data base, data that associates tactic nodes with combinations of rule nodes and impact nodes; and
replacing combinations of rule nodes and impact nodes of the analytical attack graph with tactic nodes based on the retrieved data;

determining, by the one or more computers, one or more paths of the tactic graph that lead to a particular network impact;
generating, by the one or more computers, a process model that is different from the tactic graph based on the determined one or more paths that lead to the particular network impact, the process model representing network activity for execution of a process that leads to the particular network impact; and
executing, by the one or more computers and within the enterprise network, one or more remedial actions based on the process model to mitigate cyber-security risk to the enterprise network.