Patent ID: 11930046
Assignee: XEROX CORPORATION
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. A computer-implemented method, comprising:
generating a multi-layer graph for a computer system comprising a collective network composed of a plurality of interconnected components, wherein the multi-layer graph comprises a configuration subgraph, a vulnerability subgraph, and a dependency subgraph;
determining, based on the multi-layer graph, a model for a multi-step attack on the computer system, by:
computing, based on a first set of variables and a first set of tunable parameters, a likelihood of exploiting a vulnerability in the computer system; and
computing, based on a second set of variables and a second set of tunable parameters, an exposure factor indicating an impact of exploiting a vulnerability on a utility of an associated component;

determining, based on the model, a set of attack paths that can be used in the multi-step attack; and
mitigating the multi-step attack on the computer system while preserving computer system functionality by modifying, based on the determined set of attack paths, at least one configuration associated with one of the plurality of interconnected components in the computer system or preserving the at least one configuration based on determining that preserving the system functionality outweighs a security impact associated with the determined set of attack paths.