Patent ID: 8392997
Filing Date: 2013-03-05
Classification: G06F,G06Q,H04L

Abstract:
1. A method of analyzing security threats associated with software and computer vulnerabilities, the method comprising: identifying, stakeholder values relevant for a software system; quantifying the identified stakeholder values using a quantitative decision making approach to prioritize vulnerabilities of the software system; generating a structured attack graph that includes the quantified stakeholder values to define a scalable framework to evaluate attack scenarios, wherein the structured attack graph includes five or more nodes and at least five layers with each layer including one or more of the nodes, the at least five layers representing the identified stakeholder values, the software system, software installed on the software system, software vulnerabilities of the software installed on the software system and possible attackers; based on the generated structured attack graph, identifying structured attack paths, each of the structured attack paths including at least one node of the five or more nodes and representing a respective attack scenario, wherein each of the structured attack paths is associated with at least one threat relevant attribute rating; and calculating, by one or more computer system, a quantitative measure of criticalness of each respective node of the five or more nodes based on the at least one threat relevant attribute rating associated with each structured attack path that includes the respective node.