Patent ID: 11876824
Assignee: ACCENTURE GLOBAL SOLUTIONS LIMITED
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 6:
7. A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for enterprise network security using a process aware analytical attack graph (AAG) based on an AAG representative of potential lateral movement within an enterprise network, the operations comprising:
receiving the AAG from computer-readable memory;
generating from logical network ontology data, asset inventory data, and asset communication data, a logical topology of the enterprise network as a computer-readable data structure;
defining a sub-set of groups within the enterprise network, including:
executing community detection over the logical topology; and
determining a quality of respective groups in a set of groups based on a set of measures including conductance and normalized cut,
each group representing a process of a plurality of processes, each process at least partially executed by one or more assets within the enterprise network;

processing the AAG based on the sub-set of groups and data from one or more contextual data sources to provide the process aware AAG, the process aware AAG defining a mapping between an infrastructure-layer of the enterprise network and a process-layer of the enterprise network;
storing the process aware AAG as a computer-readable data structure to computer-readable memory; and
executing one or more remedial actions in the enterprise network in response to analytics executed on the process aware AAG.