Patent ID: 11876824
Assignee: ACCENTURE GLOBAL SOLUTIONS LIMITED
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. A computer-implemented method for enterprise network security using a process aware analytical attack graph (AAG) based on an AAG representative of potential lateral movement within an enterprise network, the method executed by one or more processors and comprising:
receiving the AAG from computer-readable memory;
generating from logical network ontology data, asset inventory data, and asset communication data, a logical topology of the enterprise network as a computer-readable data structure;
defining a sub-set of groups within the enterprise network, including:
executing community detection over the logical topology; and
determining a quality of respective groups in a set of groups based on a set of measures including conductance and normalized cut,
each group representing a process of a plurality of processes, each process at least partially executed by one or more assets within the enterprise network;

processing the AAG based on the sub-set of groups and data from one or more contextual data sources to provide the process aware AAG, the process aware AAG defining a mapping between an infrastructure-layer of the enterprise network and a process-layer of the enterprise network;
storing the process aware AAG as a computer-readable data structure to computer-readable memory; and
executing one or more remedial actions in the enterprise network in response to analytics executed on the process aware AAG.