Patent Description:
To defend against such attacks, enterprises use security systems to monitor occurrences of potentially adverse events occurring within a network, and alert security personnel to such occurrences. For example, one or more dashboards can be provided, which provide lists of alerts that are to be addressed by the security personnel.

Modern computer networks are largely segregated and often deployed with diverse cyber defense mechanisms, which makes it challenging for an attacker (hacker) to gain direct access to a target (e.g., administrator credentials). This pattern is commonly seen in industrial control systems (ICSs) where a layered architecture ensures that targets are not in close proximity to the perimeter. Despite the presence of a layered architecture, the spate of attacks is increasing rapidly and span from large enterprises to critical infrastructure (CINF) networks. Due to the potential severe damage and cost experienced by a victim, CINFs have been intentionally targeted and have suffered from significant losses when successfully exploited.

In an effort to defend against cyber-attacks, so-called analytical attack graphs (AAGs) can be generated, which represent potential lateral movements of adversaries within computer networks. An AAG can be used to understand how a computer network can be hacked and undesirable consequences that can result. Accordingly, AAGs can be described as an important tool in developing anti-hacker defenses. For example, an AAG can be used to identify the most vulnerable components within a computer network, and can be used to evaluate fixes of vulnerabilities that the AAG reveals (e.g., by fixing a limited number of issues, any adversary attack on the computer network, or on certain components in the computer network can be stopped).

<CIT> discloses a method that includes providing a state graph representative of a set of action states within a network, each action state representing an attack that can be performed by an adversary within the network, determining a path stealthiness value for each attack path of a set of attack paths within the network. The method also includes determining a path hardness value for each attack path of the set of attack paths within the network, path hardness values being determined based on a state correlation matrix that correlates action states relative to each other, and a decay factor that represents a reduction in effort required to repeatedly perform an action of an action state, and selectively generating one or more alerts based on one or more of path stealthiness values and path hardness values.

<NPL>" (Espacenet non-patent literature number XP033837995) discloses a cyber digital twin, based on attack graph analytics, that automatically gathers and prioritizes security controls.

<CIT> discloses a method for analyzing and remediating operational risks in production computing systems. A risk mitigation modeler of a server computing device receives risk input data from a plurality of data sources. The modeler selects a risk scenario to be applied to the input data from a plurality of risk scenarios. The modeler analyzes the input data using the selected risk scenario to identify one or more risks present in the input data. The modeler determines a risk remediation plan based upon the selected risk scenario if at least one of the identified risks meets or exceeds a risk tolerance associated with the selected scenario, where the remediation plan comprises instructions to change data elements based upon the identified risk.

Implementations of the present disclosure are directed to mitigating cyber security risk in enterprise networks. More particularly, implementations of the present disclosure are directed to using process-aware analytical attack graphs (AAGs) and a mitigation simulator to prioritize mitigation efforts to mitigate risk in enterprise networks. A mitigation list is provided, a set of remedial actions can be identified based on the mitigation list, and remedial actions can be executed to mitigate risk to enterprise networks.

In some examples, implementations of the present disclosure are provided within an agile security platform that determines asset vulnerability of enterprise-wide assets including cyber-intelligence and discovery aspects of enterprise information technology (IT) systems and operational technology (OT) systems, asset value, potential for asset breach and criticality of attack paths towards target(s) including hacking analytics of enterprise IT/OT systems.

In accordance with the invention, actions include receiving graph data representative of a process-aware AAG that is representative of potential lateral movement of adversaries within a computer network, wherein nodes of the process-aware AAG are associated with process attributes, a process attribute maps a node to at least a portion of a process that is at least partially executed within the computer network, and wherein the nodes indicate facts of the process-aware AAG, receiving risk profile data representative of a risk profile of an enterprise with respect to two or more risk aspects, wherein the risk profile comprises a user-assigned acceptance score to each risk aspect, an acceptance score representing the enterprise's minimal acceptance rate of a risk aspect, generating, by a process-aware risk assessment module, a risk assessment based on the process-aware AAG and the risk profile, and generating, by a mitigation simulator module, a mitigation list based on the process-aware AAG, the risk profile, and the risk assessment, the mitigation list comprising a prioritized list of two or more of the facts of the process-aware AAG, providing a set of remediation actions based on the mitigation list, and executing at least one remediation action in the set of remediation actions to mitigate cyber security risk to the computer network. Other implementations of this aspect include corresponding systems, apparatus, and computer programs, configured to perform the actions of the methods, encoded on computer storage devices.

These and other implementations can each optionally include one or more of the features of the dependent claims.

The present disclosure also provides a computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations in accordance with implementations of the methods provided herein.

The present disclosure further provides a system for implementing the methods provided herein. The system includes one or more processors, and a computer-readable storage medium coupled to the one or more processors having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations in accordance with implementations of the methods provided herein.

Implementations of the present disclosure are directed to mitigating cyber security risk in enterprise networks. More particularly, implementations of the present disclosure are directed to using process-aware analytical attack graphs (AAGs) and a mitigation simulator to prioritize mitisation efforts to mitigate risk in enterprise networks. A mitigation list is provided, a set of remedial actions can be identified based on the mitigation list, and remedial actions can be executed to mitigate risk to enterprise networks.

In accordance with the invention, actions include receiving graph data representative of a process-aware AAG that is representative of potential lateral movement of adversaries within a computer network, wherein nodes of the process-aware AAG are associated with process attributes, a process attribute maps a node to at least a portion of a process that is at least partially executed within the computer network and wherein the nodes indicate facts of the process-aware AAG, receiving risk profile data representative of a risk profile of an enterprise with respect to two or more risk aspects, wherein the risk profile comprises a user-assigned acceptance score to each risk aspect, an acceptance score representing the enterprise's minimal acceptance rate of a risk aspect, generating, by a process-aware risk assessment module, a risk assessment based on the process-aware AAG and the risk profile, and generating, by a mitigation simulator module, a mitigation list based on the process-aware AAG, the risk profile, and the risk assessment, the mitigation list comprising a prioritized list of two or more of the facts of the process-aware AAG, providing a set of remediation actions based on the mitigation list, and executing at least one remediation action in the set of remediation actions to mitigate cyber security risk to the computer network.

To provide context for implementations of the present disclosure, and as introduced above, computer networks are susceptible to attack by malicious users (e.g., hackers). For example, hackers can infiltrate computer networks in an effort to obtain sensitive information (e.g., user credentials, payment information, address information, social security numbers) and/or to take over control of one or more systems. Computer networks are used to execute processes that support operations of enterprises and/or industrial infrastructures. Enterprises, in general, and industrial infrastructures, in particular, are increasingly connected to external networks such as the Internet. As such, processes that were once isolated from the open Internet network, are now vulnerable to external cyber-attacks. As the frequency and derived impact of these attacks increase, there is a need to prioritize and mitigate risks in order of importance to the operations.

Modern computer networks are largely segregated and often deployed with diverse cyber defense mechanisms, which makes it challenging for an attacker (hacker) to gain direct access to a target (e.g., administrator credentials). This pattern is commonly seen in industrial control system (ICSs) where a layered architecture ensures that targets are not in close proximity to the perimeter. Despite the presence of a layered architecture, the spate of attacks is increasing rapidly and span from large enterprises to the critical infrastructure (CINF) networks. Due to the potential severe damage and cost experienced by a victim nation, CINF networks have been intentionally targeted intentionally and have suffered from significant losses when successfully exploited.

In general, attacks on CINF networks occur in multiple stages. Consequently, detecting a single intrusion does not necessarily indicate the end of the attack as the attack could have progressed far deeper into the network. Accordingly, individual attack footprints are insignificant in an isolated manner, because each is usually part of a more complex multi-step attack. That is, it takes a sequence of steps to form an attack path toward a target in the network. Researchers have investigated several attack path analysis methods for identifying attacker's required effort (e.g., number of paths to a target and the cost and time required to compromise each path) to diligently estimate risk levels. However, traditional techniques fail to consider important features and provide incomplete solutions for addressing real attack scenarios. For example, some traditional techniques only consider the topological connection between stepping stones to measure the difficulty of reaching a target. As another example, some traditional techniques only assume some predefined attacker skill set to estimate the path complexity. In reality, an attacker's capabilities and knowledge of the enterprise network evolve along attack paths to the target.

In an effort to defend against cyber-attacks, AAGs can be generated, which represent potential lateral movements of adversaries within computer networks. An AAG can be used to understand how a computer network can be hacked and undesirable consequences that can result. Accordingly, AAGs can be described as an important tool in developing anti-hacker defenses. For example, an AAG can be used to identify the most vulnerable components within a computer network, and can be used to evaluate fixes of vulnerabilities that the AAG reveals (e.g., by fixing a limited number of issues, any adversary attack on the computer network, or on certain components in the computer network can be stopped). While much research has been dedicated to the analysis of a single AAG, little focus has been given to the analysis and comparison of multiple AAGs. In comparing multiple AAGs, the difference between the AAGs is a target of interest, as differences can reveal vulnerabilities that were added, were removed or that persisted across all AAGs.

In view of the above context, implementations of the present disclosure are directed to recommending remedial actions for cyber security. More particularly, implementations of the present disclosure are directed to automated process-aware recommendation of remedial actions to mitigate cyber security. As described in further detail, prioritization of remedial actions can include determining a risk assessment based on a process-aware AAG, and generating a prioritized list of remedial actions based on the risk assessment and a risk profile, the prioritized list of remedial actions being generated by a mitigation simulator.

In some examples, automated prioritization of remedial actions of the present disclosure can be realized within an agile security platform that considers attack complexity within an interconnected cyber infrastructure with a variety of attack paths to comprehensively address real attack scenarios. It is contemplated, however, that implementations of the present disclosure of the present disclosure can be realized in any appropriate cyber security platform.

In general, the agile security platform provides a cyber-threat analysis framework based on characterizing adversarial behavior in a multi-stage cyber-attack process. As described in further detail herein, how a threat proceeds within a network is investigated using an AAG and all possible attack stages are identified. In some implementations, each stage can be associated with network attributes. Using a holistic view of threat exposure provided by AAGs, attack techniques and tactics are incorporated into stepping stones found in AAGs.

In further detail, the cyber-threat analysis framework adds context to each attack stage using a real-world knowledge base of adversary tactics and techniques to more comprehensively characterize progression along the attack path. In some implementations, an attack path analysis model identifies a level of difficulty in taking a path by considering the complexity of the path, the skill set of the attacker, and the like. Implementations of the present disclosure provide a path hardness that is measured in terms of a capability of the attacker and challenges. The insight into the level of difficulty of an attack path in the network helps security administrators to pinpoint critical paths and prioritize path hardening actions.

As described herein, the agile security platform enables continuous cyber and enterprise-operations alignment controlled by risk management. The agile security platform improves decision-making by helping enterprises to prioritize security actions that are most critical to their operations. In some examples, the agile security platform combines methodologies from agile software development lifecycle, IT management, development operations (DevOps), and analytics that use artificial intelligence (AI). In some examples, agile security automation bots continuously analyze attack probability, predict impact, and recommend prioritized actions for cyber risk reduction. In this manner, the agile security platform enables enterprises to increase operational efficiency and availability, maximize existing cyber security resources, reduce additional cyber security costs, and grow organizational cyber resilience.

As described in further detail herein, the agile security platform provides for discovery of IT/OT supporting elements within an enterprise, which elements can be referred to as configuration items (CI). Further, the agile security platform can determine how these CIs are connected to provide a CI network topology. In some examples, the CIs are mapped to processes and services of the enterprise, to determine which CIs support which services, and at what stage of an operations process. In this manner, a services CI topology is provided.

In some implementations, the specific vulnerabilities and improper configurations of each CI are determined and enable a list of risks to be mapped to the specific IT/OT network of the enterprise. Further, the agile security platform of the present disclosure can determine what a malicious user (hacker) could do within the enterprise network, and whether the malicious user can leverage additional elements in the network such as scripts, CI configurations, and the like. Accordingly, the agile security platform enables analysis of the ability of a malicious user to move inside the network, namely, lateral movement within the network. This includes, for example, how a malicious user could move from one CI to another CI, what CI (logical or physical) can be damaged, and, consequently, damage to a respective service provided by the enterprise.

<FIG> depicts an example architecture <NUM> in accordance with implementations of the present disclosure. In the depicted example, the example architecture <NUM> includes a client device <NUM>, a network <NUM>, and a server system <NUM>. The server system <NUM> includes one or more server devices and databases (e.g., processors, memory). In the depicted example, a user <NUM> interacts with the client device <NUM>.

In some examples, the client device <NUM> can communicate with the server system <NUM> over the network <NUM>. In some examples, the client device <NUM> includes any appropriate type of computing device such as a desktop computer, a laptop computer, a handheld computer, a tablet computer, a personal digital assistant (PDA), a cellular telephone, a network appliance, a camera, a smart phone, an enhanced general packet radio service (EGPRS) mobile phone, a media player, a navigation device, an email device, a game console, or an appropriate combination of any two or more of these devices or other data processing devices. In some implementations, the network <NUM> can include a large computer network, such as a local area network (LAN), a wide area network (WAN), the Internet, a cellular network, a telephone network (e.g., PSTN) or an appropriate combination thereof connecting any number of communication devices, mobile computing devices, fixed computing devices and server systems.

In some implementations, the server system <NUM> includes at least one server and at least one data store. In the example of <FIG>, the server system <NUM> is intended to represent various forms of servers including, but not limited to a web server, an application server, a proxy server, a network server, and/or a server pool. In general, server systems accept requests for application services and provide such services to any number of client devices (e.g., the client device <NUM> over the network <NUM>). In accordance with implementations of the present disclosure, and as noted above, the server system <NUM> can host an agile security platform.

In the example of <FIG>, an enterprise network <NUM> is depicted. The enterprise network <NUM> represents a network implemented by an enterprise to perform its operations. In some examples, the enterprise network <NUM> represents on-premises systems (e.g., local and/or distributed), cloud-based systems, and/or combinations thereof. In some examples, the enterprise network <NUM> includes IT systems and OT systems. In general, IT systems include hardware (e.g., computing devices, servers, computers, mobile devices) and software used to store, retrieve, transmit, and/or manipulate data within the enterprise network <NUM>. In general, OT systems include hardware and software used to monitor and detect or cause changes in processes within the enterprise network <NUM> as well as store, retrieve, transmit, and/or manipulate data. In some examples, the enterprise network <NUM> includes multiple assets. Example assets include, without limitation, users <NUM>, computing devices <NUM>, electronic documents <NUM>, and servers <NUM>.

In some implementations, the agile security platform is hosted within the server system <NUM>, and monitors and acts on the enterprise network <NUM>, as described herein. More particularly, and as described in further detail herein, one or more AAGs representative of the enterprise network are generated in accordance with implementations of the present disclosure. For example, the agile security platform detects IT/OT assets and generates an asset inventory and network maps, as well as processing network information to discover vulnerabilities in the enterprise network <NUM>. The agile security platform executes automated prioritization of remedial actions of the present disclosure based on the network information.

In some examples, the agile security platform provides one or more dashboards, alerts, notifications and the like to cyber security personnel that enable the cyber security personnel to react to and remediate security relevant events. For example, the user <NUM> can include a cyber security expert that views and responds to dashboards, alerts, and/or notifications of the agile security platform using the client device <NUM>.

In some examples, the agile security platform operates over multiple phases. Example phases include an asset discovery, anomaly detection, and vulnerability analysis phase, a cyber resilience risk analysis phase, and a cyber resilience risk recommendation phase.

With regard to the asset discovery, anomaly detection, and vulnerability analysis phase, discovering what vulnerabilities exit across the vertical stack and the relevant use cases is imperative to be conducted from the enterprise IT to the control systems. A focus of this phase is to generate the security backlog of issues, and potential remediations.

Rather than managing each technology layer separately, the agile security platform addresses lateral movements across the stack. Through devices, communication channels (e.g., email, TCP/IP), and/or operation systems, vulnerabilities are addressed within the context of a service (e.g., a service that the enterprise offers to customers), and a cyber kill chain to a target in the operation vertical, generating operation disturbance by manipulation of data. The notion of a CI assists in mapping dependencies between IT/OT elements within a configuration management DB (CMDB). A so-called security CI (SCI) maps historical security issues of a certain managed security element and is mapped into a security aspect of a digital twin.

As a result, a stack of technologies is defined, and is configured in a plug-in reference architecture (replaceable and extensible) manner. The stack addresses different aspects of monitoring, harvesting, and alerting of information within different aggregations views (dashboards) segmented according to owners and relevant IT and security users. An example view includes a health metric inserted within the dashboard of an enterprise application. In some examples, the health metric indicates the security condition of the underlying service and hence, the reliability of the provided data and information. Similar to risks that can be driven by labor, inventory, or energy, security risk concern can be presented and evaluated in the operations-level, drilled-through for additional transparency of the issue, and can be optimally remediated by allocating investments to automation or to security and IT personal with adequate operations awareness.

With regard to the cyber resilience risk analysis phase, each vulnerability may have several remediations, and each has a cost associated with it, either per internal personnel time, transaction, service, or retainer, as well as the deferred cost of not acting on the issue. A focus of this phase is to enable economical decision-making of security investments, either to be conducted by the IT and security team or directly by automation, and according to risk mitigation budget.

In further detail, observing a single-issue type and its remediations does not reflect the prioritization between multiple vulnerabilities. Traditional systems are based on global risk assessment, yet the context in which the SCI is part of is missing. The overall risk of a process matters differently for each enterprise. As such, remediation would occur according to gradual hardening of a process according to prioritization, driven in importance and responsibility by the enterprise, not by gradual hardening of all devices, for example, in the organization according to policy, without understanding of the impact on separated operational processes. Hardening of a system should be a decision of the enterprise to drive security alignment with the enterprise.

In addition, as the system is changed by gradual enforcement and hardening, new issues are detected and monitored. Hence, making a big bang decision may be not relevant to rising risks as they evolve. Prioritization according to value is the essence of this phase. It is a matter of what is important for the next immediate term, according to overall goals, yet considering changes to the environment.

With regard to the cyber resilience risk recommendation phase, a focus is to simplify approved changes and actions by proactive automation. In traditional systems, the action of IT remediation of security issues is either done by the security team (such as awareness and training), by creating a ticket in the IT service system (call for patch managements), and/or by tools that are triggered by security and monitored by IT (automatic deployment of security policies, change of authentication and authorization, self-service access control management, etc.). Some operations can be conducted in a disconnected mode, such as upgrading firmware on an IoT device, in which the operator needs to access the device directly. Either automated or manual, by IT or by security, or by internal or external teams, the entire changes are constantly assessed by the first phase of discovery phase, and re-projected as a metric in a context. Progress tracking of these changes should also occur in a gradual manner, indicating maintenance scheduling on similar operational processes, hence, driving recommendations for frequent actions that can be automated, and serve as candidates to self-managed by the operations owners and systems users.

In the agile security platform, acting is more than automating complex event processing (CEP) rules on alerts captured in the system logs and similar tools. Acting is started in areas highlighted according to known patterns and changing risks. Pattern detection and classification of events for approved automation processes (allocated transactions budget), are aimed at commoditization of security hardening actions in order to reduce the attention needed for prioritization. As such, a compound backlog and decision phase, can focus further on things that cannot be automated versus those that can. All issues not attended yet are highlighted, those that are handled by automation are indicated as such, and monitored to completion, with a potential additional value of increasing prioritization due to changing risks impact analysis.

<FIG> depicts an example conceptual architecture <NUM> of an agile security (AgiSec) platform. The conceptual architecture <NUM> depicts a set of security services of the AgiSec platform, which include: an agile security prioritization (AgiPro) service <NUM>, an agile security business impact (AgiBuiz) service <NUM>, an agile security remediation (AgiRem) service <NUM>, an agile security hacker lateral movement (AgiHack) service <NUM>, an agile security intelligence (Agilnt) service <NUM>, and an agile security discovery (AgiDis) service <NUM>. The conceptual architecture <NUM> also includes an operations knowledge base <NUM> that stores historical data provided for an enterprise network (e.g., the enterprise network <NUM>).

In the example of <FIG>, the AgiDis service <NUM> includes an adaptor <NUM>, and an asset/vulnerabilities knowledge base <NUM>. In some examples, the adaptor <NUM> is specific to an asset discovery tool (ADT) <NUM>. Although a single ADT <NUM> is depicted, multiple ADTs can be provided, each ADT being specific to an IT/OT site within the enterprise network. Because each adaptor <NUM> is specific to an ADT <NUM>, multiple adaptors <NUM> are provided in the case of multiple ADTs <NUM>.

In some implementations, the AgiDis service <NUM> detects IT/OT assets through the adaptor <NUM> and respective ADT <NUM>. In some implementations, the AgiDis service <NUM> provides both active and passive scanning capabilities to comply with constraints, and identifies device and service vulnerabilities, improper configurations, and aggregate risks through automatic assessment. The discovered assets can be used to generate an asset inventory, and network maps. In general, the AgiDis service <NUM> can be used to discover assets in the enterprise network, and a holistic view of network and traffic patterns. More particularly, the AgiDis service <NUM> discovers assets, their connectivity, and their specifications and stores this information in the asset/vulnerabilities knowledge base <NUM>. In some implementations, this is achieved through passive network scanning and device fingerprinting through the adaptor <NUM> and ADT <NUM>. The AgiDis service <NUM> provides information about device models.

In the example of <FIG>, the Agilnt service <NUM> includes a vulnerability analytics module <NUM> and a threat intelligence knowledge base <NUM> (e.g., CVE, CAPEC, CWE, iDefence API, vendor-specific databases). In some examples, the Agilnt service <NUM> discovers vulnerabilities in the enterprise network based on data provided from the AgiDis service <NUM>. In some examples, the vulnerability analytics module <NUM> processes data provided from the AgiDis service <NUM> to provide information regarding possible impacts of each vulnerability and remediation options (e.g., permanent fix, temporary patch, workaround) for defensive actions. In some examples, the vulnerability analytics module <NUM> can include an application programming interface (API) that pulls out discovered vulnerabilities and identifies recommended remediations using threat intelligence feeds. In short, the AgiInt service <NUM> maps vulnerabilities and threats to discovered IT/OT assets. The discovered vulnerabilities are provided back to the AgiDis service <NUM> and are stored in the asset/vulnerabilities knowledge base <NUM> with their respective assets.

In the example of <FIG>, the AgiHack service <NUM> includes an analytical attack graph (AAG) generator <NUM>, an AAG database <NUM>, and an analytics module <NUM>. In general, the AgiHack service <NUM> generates AAGs using the resource-efficient AAG generation of the present disclosure, and evaluates hacking exploitation complexity. In some examples, the AgiHack service <NUM> understands attack options, leveraging the vulnerabilities to determine how a hacker would move inside the network and identify targets for potential exploitation. The AgiHack service <NUM> proactively explores adversarial options and creates AAGs representing possible attack paths from the adversary's perspective.

In further detail, the AgiHack service <NUM> provides rule-based processing of data provided from the AgiDis service <NUM> to explore all attack paths an adversary can take from any asset to move laterally towards any target (e.g., running critical operations). In some examples, multiple AAGs are provided, each AAG corresponding to a respective target within the enterprise network. Further, the AgiHack service <NUM> identifies possible impacts on the targets. In some examples, the AAG generator <NUM> uses data from the asset/vulnerabilities knowledge base <NUM> of the AgiDis service <NUM>, and generates an AAG. In some examples, the AAG graphically depicts, for a respective target, all possible impacts that may be caused by a vulnerability or network/system configuration, as well as all attack paths from anywhere in the network to the respective target. In some examples, the analytics module <NUM> processes an AAG to identify and extract information regarding critical nodes, paths for every source-destination pair (e.g., shortest, hardest, stealthiest), most critical paths, and critical vulnerabilities, among other features of the AAG. If remediations are applied within the enterprise network, the AgiHack service <NUM> updates the AAG.

In the example of <FIG>, the AgiRem service <NUM> includes a graph explorer <NUM> and a summarizer <NUM>. In general, the AgiRem service <NUM> provides remediation options to avoid predicted impacts. For example, the AgiRem service <NUM> provides options to reduce lateral movement of hackers within the network and to reduce the attack surface. The AgiRem service <NUM> predicts the impact of asset vulnerabilities on the critical processes and adversary capabilities along kill chain/attack paths and identifies the likelihood of attack paths to access critical assets and prioritizes the assets (e.g., based on shortest, easiest, stealthiest). The AgiRem service <NUM> identifies remediation actions by exploring attack graph and paths. For example, the AgiRem service <NUM> can execute a cyber-threat analysis framework that characterizes adversarial behavior in a multi-stage cyber-attack process, as described in further detail herein.

In further detail, for a given AAG (e.g., representing all vulnerabilities, network/system configurations, and possible impacts on a respective target) generated by the AgiHack service <NUM>, the AgiRem service <NUM> provides a list of efficient and effective remediation recommendations using data from the vulnerability analytics module <NUM> of the AgiInt service <NUM>. In some examples, the graph explorer <NUM> analyzes each feature (e.g., nodes, edges between nodes, properties) to identify any condition (e.g., network/system configuration and vulnerabilities) that can lead to cyber impacts. Such conditions can be referred to as issues. For each issue, the AgiRem service <NUM> retrieves remediation recommendations and courses of action (CoA) from the AgiInt service <NUM>, and/or a security knowledge base (not shown). In some examples, the graph explorer <NUM> provides feedback to the analytics module <NUM> for recalculating critical nodes/assets/paths based on remediation options. In some examples, the summarizer engine <NUM> is provided as a natural language processing (NLP) tool that extracts concise and salient text from large/unstructured threat intelligence feeds. In this manner, the AgiSec platform can convey information to enable users (e.g., security teams) to understand immediate remediation actions corresponding to each issue.

In the example of <FIG>, the AgiBuiz service <NUM> includes an impact analyzer <NUM>. In general, the AgiBuiz service <NUM> associates services that are provided by the enterprise with IT/OT assets, generates a security map, identifies and highlights risks and possible impacts on enterprise operations and industrial processes, and conducts what-if prediction analyses of potential security actions remediations on service health levels. In other words, the AgiBuiz service <NUM> identifies risk for each impact predicted by the AgiHack service <NUM>. In some examples, the impact analyzer <NUM> interprets cyber risks and possible impacts (e.g., financial risk) based on the relative importance of each critical asset and its relative value within the entirety of the enterprise operations. The impact analyzer <NUM> processes one or more models to compare the financial risks caused by cyber-attacks with those caused by system unavailability due to shutdown time for replacing/patching critical assets.

In the example of <FIG>, the AgiPro service <NUM> includes a prioritizing engine <NUM> and a scheduler <NUM>. In some implementations, the AgiPro service <NUM> prioritizes the remediation recommendations based on their impact on the AAG size reduction and risk reduction on the value. In some examples, the AgiPro service <NUM> determines where the enterprise should preform security enforcement first, in order to overall reduce the risks discovered above, and evaluate and probability to perform harm based on the above lateral movements by moving from one CI to another. In some examples, the AgiPro service <NUM> prioritizes remediation actions based on financial risks or other implications, provides risk reduction recommendations based on prioritized remediations, and identifies and tracks applied remediations for risks based on recommendations.

In some examples, the prioritizing engine <NUM> uses the calculated risks (e.g., risks to regular functionality and unavailability of operational processes) and the path analysis information from the analytics module <NUM> to prioritize remediation actions that reduce the risk, while minimizing efforts and financial costs. In some examples, the scheduler <NUM> incorporates the prioritized CoAs with operational maintenance schedules to find the optimal time for applying each CoA that minimizes its interference with regular operational tasks.

As introduced above, cyber-threat analysis for a computer network leverages one or more AAGs. In some examples, an AAG is generated by a cyber security platform, such as the AgiSec platform described herein. In mathematical terms, an AAG can be described as a directed graph modeled as AAG(V, E) with a set of nodes V = {v<NUM>,. , vn} and a set of edges E = {e<NUM>,. , em} connecting nodes together, where |V| = n and |E| = m.

<FIG> depicts an example portion <NUM> of an example AAG to illustrate implementations of the present disclosure. As depicted in the example of <FIG>, the AAG can include different node types to show how a set of network and system configurations result in unauthorized actions to specific targets. The example portion <NUM> is depicted in a database structure (e.g., Neo4j graph database structure). Nodes in an AAG are of different types: circular nodes representing system or network configurations that are the conditions that provide possibilities for actions by an attacker; circle-shaped nodes representing reasoning rules that represent the attack methodology leveraged by an attacker to achieve a particular goal; and square nodes that represent an impact as a sub-goal for a certain action an attacker could take. The AAG includes two types of edges: configuration-to-rule edges that represent logical AND (i.e., all configuration conditions have to be true to cause the impact; and rule-to-impact edges that represent logical OR (i.e., the impact happens if at least one rule is satisfied).

In general, the AAG is created by taking into account the configurations directed by some rules in order to make some impacts on the target network. In some examples, all configuration nodes, impact nodes, and rule nodes can be provided in sets Np, Nd, Nr, respectively. Accordingly, Np ={np,j|np,j ∈ V, ∀np,j is a configuration}, Nd = {nd,j|nd,j ∈ V, ∀nd,j is an impact}, and Nr = {nr,j|nr,j ∈ V, ∀nr,j is a rule}. Consequently, the combination of these sets accounts for all vertices of the graph. In some examples, a configuration node is referred to herein as an input fact node indicating facts that are provided as input within a configuration. In some examples, impact nodes are referred to herein as derived fact nodes indicating a derived fact that results from applying one or more input facts and/or one or more derived facts to a rule.

AAGs can be used in cyber-threat analysis to determine attack paths of external attackers into and through a computer network. Use of AAGs in mitigating attacks on computer networks is described in further detail in commonly assigned <CIT>. Further, generation of AAGs is described in further detail in commonly assigned <CIT>.

To provide further context for implementations of the present disclosure, the AAG model presented in MulVAL will be briefly discussed. MulVAL can be described as an automatic end-to-end AAG generation framework. In general, MulVAL takes a specification, such as, but not limited to, MITRE Common Vulnerabilities and Exposures (CVE), describing the configuration of an enterprise network and rules that depict how an attacker can exploit the system configurations to advance in the enterprise network towards a target goal. MulVAL uses datalog as a specification language. In datalog, logical and physical entities of the enterprise network are formally modelled by datalog predicates; n-ary relations between entities are defined by datalog relations; and attack rules are modelled as datalog derivation rules in a datalog program. Derivation rules define preconditions (set of predicates connected by logical 'and') that, if met, derive new predicates. The specification of the predicates and derivation rules can be referred to as the datalog program of the system (enterprise network).

For purposes of illustration, a non-limiting example is introduced in Listing <NUM>, below, which shows a specification of an example datalog program for an enterprise network (system). ## predicates. decl domainUser(_user: UserFqdn, _domain: Domain). decl groupContains(_group: GroupFqdn, _principal: Principal). decl isUser(_user: UserFqdn). decl localGroup(_host: Host, _groupName: GroupName, _groupFqdn:
GroupFqdn). decl userInLocalGroup(_host: Host, _groupName: GroupName, _user:
UserFqdn). decl isUser(_user: UserFqdn, rule_id: String). decl groupContainsDirect(_group: GroupFqdn, _principal: Principal)
 
## attack rules
groupContains(Group,Principal):-groupContainsDirect(Group,Principal). # rule label: <NUM>
isUser(User):-domainUser(User,_). # rule label: <NUM>
userInLocalGroup(Host,GroupName,User):
localGroup(Host,GroupName,GroupFqdn),groupContains(GroupFqdn,User,_),i
sUser(User,_). # rule label: <NUM>.

The example datalog program of Listing <NUM> lists seven predicates. Each predicate is a function that maps objects of different types to a Boolean value. For example, the predicate domainUser maps objects of type User and objects of type Domain to True if the user belongs to the domain, and False otherwise.

The example datalog program of Listing <NUM> lists three attack rules. The first attack rule indicates that a predicate groupContains is derived from the predicate groupContainsDirect (with the corresponding objects). The third attack rule indicates that three precondition predicates: isUser, localGroup, groupContains derive the predicate userInLocalGroup (with the corresponding objects). Each rule has a unique identifier (id). For example, <NUM> for the first attack rule and <NUM> for the third attack rule. The system configuration (e.g., instance of hosts, users, privileges on host, etc.) is provided as an array of facts (also referred to as grounds), each fact associated with a predicate of the datalog program.

Table <NUM>: Example Input Facts for domainUserTable <NUM>, below, lists four input facts of the is Domain predicate.

The listed user-domain pairs represent mappings that are True. Combinations (of user and domain) that are not listed in the input facts are considered False, until proven otherwise (i.e., derived by a rule).

MulVAL uses a datalog solver on the program specification to check whether there exists an attack path from the input facts to a target goal. It does this by iteratively applying the derivation rules on facts until either reaching a target goal (a path exists) or reaching a fixed point, from which no new fact can be derived. In this case, no attack path to the target exists and the system is considered to be secure.

The derivation process from the grounded facts to the target goals is represented in the resulting AAG. An AAG is provided as a data object that records nodes and edges between nodes, described herein. The data object underlying an AAG can be processed to generate a visual representation, a graph, of the AAG.

In further detail, MulVAL generates an AAG that shows the derivation of grounded facts by the application of rules. Formally, the AAG is defined as: AAG = (Nr, Np, Nd, E, L, Args, G), where Nr, Np, Nd are the sets of nodes (rules (r), input facts (p), and derived facts (d), respectively), E is a set of edges that connect from facts to derivation rules (precondition) and from derivation rules to derived facts, L is a mapping from a node (i.e., an input fact, a derived fact, a rule) to its label (i.e., the predicate or rule that it is associated with), Args is a mapping of facts to their arguments (i.e., objects they are associated with), and G ∈ Nd describes the target goal (e.g., crown jewel that may be a target for hackers). N denotes the union of all node elements in the graph (i.e., N = Nr U Np U Nd). In some examples, primitive nodes and derived nodes (i.e., fact nodes) are denoted by Nf, where Nf = Np U Nd. Every fact node in the graph is labeled with a logical statement in the form of a predicate applied to its arguments. In some examples, Args and L are separately encoded. For example, a configuration c = {"DomainUser", "BERTHA. DAVIES@CYBER. LOCAL", "CYBER. LOCAL" } can be encoded as Np = {node_<NUM>}; L(node_1) = "DomainUser"; Args(node_1) = ["BERTHA. DAVIES@CYBER. LOCAL", "CYBER.

Every element of the AAG is uniquely identifiable. Each fact (input fact, derived fact) node is uniquely defined by its arguments and predicate label (i.e., no two nodes may have the same label and arguments). As described in further detail herein, a unique identifier (index) for each fact node can be provided based on this information. Every rule node is uniquely defined by its label, preconditions and derived fact. As also described in further detail herein, a unique index for each rule node can be provided based on this information. The AAG size can be defined as the number of nodes and edges in the AAG.

In some implementations, each node and each edge is uniquely identified by a respective identifier that is generated by encoding. Each identifier enables the respective node or edge to be indexed within dictionaries and/or libraries in a time- and resource-efficient manner. In some examples, each fact node includes a respective identifier that is determined based on a concatenation of the predicate label and the arguments of the fact node. In some examples, each rule node includes a respective identifier that is determined based on a concatenation of the rule label, the unique identifier(s) of predicate node(s) (i.e., one or more fact nodes input to the rule node), and the unique identifier(s) of derivative node(s) (i.e., one or more derived fact nodes output by the rule node). In some examples, lexicographical ordering is used for the precondition nodes and/or derived nodes to provide the order used in the concatenation. In some examples, each edge includes a respective unique identifier that is determined based on a concatenation of the unique identifier of the source node and the unique identifier of the target node. In some implementations, a concatenation is itself the encoding used to uniquely identify a respective node. In some implementations, each concatenation is processed through a hash function (e.g., a deterministic hash function) to generate a hash value, the hash value being the encoding used to uniquely identify a respective node.

In accordance with implementations of the present disclosure, and as described in further detail herein, automated prioritization of remedial actions is provided. In some implementations, a risk assessment of an enterprise network (or a portion thereof) is determined based on a process-aware AAG that is representative of the enterprise network. A risk profile is provided that represent a risk tolerance per risk aspect. A mitigation simulator processes the risk assessment and the risk profile to generate a prioritized list of remedial actions. In some examples, a remedial action (also referred to as a security control) is in action that can be executed to mitigate (e.g., reduce) risk within the enterprise network. For example, a remedial action can be executed to mitigate a fact (e.g., input fact, derived fact).

<FIG> depicts a conceptual architecture <NUM> for prioritizing risk mitigation for cyber security in accordance with implementations of the present disclosure. In the example of <FIG>, the conceptual architecture <NUM> includes a process-aware risk assessment module <NUM> and a mitigation simulator <NUM>. The process-aware risk assessment module <NUM> receives a process-aware AAG <NUM> and a risk profile <NUM>, and generates a risk assessment <NUM>. The mitigation simulator <NUM> receives the process-aware AAG <NUM>, the risk assessment <NUM>, and the risk profile <NUM>, and generates a prioritized risk mitigation profile <NUM>. In some examples, the prioritized risk mitigation profile <NUM> includes a prioritized list of remedial actions that can be executed within the enterprise network to mitigate cyber security risk therein.

In further detail, process-aware risk assessment module <NUM> performs a process-aware risk assessment based on the process-aware AAG <NUM> and the risk profile <NUM>. In some examples, the process-aware AAG <NUM> is generated as described herein and/or as described in commonly assigned <CIT> and <CIT>, introduced above.

In some examples, a process-aware AAG, such as the process-aware AAG <NUM>, includes fact nodes (i.e., configuration (condition) nodes of <FIG>), impact nodes (i.e., impact (effect) nodes of <FIG>), and rule nodes (i.e., reasoning rule nodes of <FIG>). An entry point to the process-aware AAG, and thus the enterprise network represented by the process-aware AAG, is fact node (e.g., potential entry point of an attacker). In some examples, a so-called crown-jewel is an asset within the enterprise network (e.g., administrator credentials) that is targeted by attackers (e.g., a target asset). In some examples, an attack goal can refer to an impact node that is considered as a capability that an attacker could get over a crown-jewel.

In some examples, attributes of a process-aware AAG include, without limitation, hardness scores, impact vectors, asset identifier, and process context. In some examples, each rule (represented as a rule node) holds a hardness score (e.g., in range [<NUM>, <NUM>]) that represents a measure on a required maturity level of an adversary to be able to execute the rule, resulting in an impact. In some examples, the hardness this score is set as an attribute of an outgoing edge of the rule node (e.g., incoming edge(s) have value of <NUM> set as hardness score). In some examples, each hardness score is specified by domain experts and embedded within an ontology per rule. In some examples, an attack goal holds an impact vector that includes a set of impact scores (e.g., each in range [<NUM>, <NUM>]), each impact score corresponding to a respective risk aspect. Example risk aspects include, without limitation, safety, availability, integrity, and confidentiality. In some examples, an impact vector expresses the potential impact caused by execution of a rule. In some examples, impact vectors are specified by domain experts and are embedded within the ontology per impact type (e.g., denial of service (DoS) has a high impact on availability). In some examples, each asset (represented as a node that represents an asset), has an asset identifier, which enables mapping to the asset (e.g., rules are mapped to assets based on asset identifiers according to outgoing impacts).

In some examples, nodes of the AAG hold a process attribute based on a node-to-process mapping. In some examples, the node-to-process mapping maps a process to nodes (e.g., assets) that execute the process within the enterprise network. For example, the mapping can map different levels (e.g., process, sub-process, activity, task) of a process to one or more assets. Accordingly, assets of the enterprise network, as represented in the AAG, are mapped to processes the assets contribute to. In this manner, the AAG is considered to be a process-aware AAG.

<FIG> depicts an example user interface (UI) <NUM> depicting an example process-aware AAG. The process-aware AAG represents a pulp and paper process. The pulp and paper process includes multiple steps, which can be considered assets. The assets include woodyard (raw material preparation), pulping, and paper making. In the AAG, shown in the UI <NUM>, "F" represents a fact about the network and "I" represents an impact.

Referring again to <FIG>, the risk assessment <NUM> is provided as a risk vector representative of the context of process, crown-jewel, and attack goals. More particularly, the risk vector holds configurable risk aspects (e.g., availability, confidentiality, integrity, safety).

<FIG> depicts an example process-aware AAG <NUM> representing processes and assets. Specifically, the process-aware AAG <NUM> includes nodes representing Asset A and Asset B, and nodes representing process elements A, B, and C. Thus, whereas the process-aware AAG illustrated in <FIG> can be used to determine risk at an asset level, the process-aware AAG <NUM> can permit risk assessment at a process level.

The process-aware AAG <NUM> also includes connections representing process dependencies between assets and processes, and dependencies between process elements. For example, the process-aware AAG <NUM> includes a connection <NUM> representing a correlation between Asset A and Process A, and a connection <NUM> representing a correlation between Asset B and Process A. The process-aware AAG <NUM> includes a connection <NUM> representing that Process C follows Process A, and a connection <NUM> representing that Process C follows Process B.

The process-aware AAG <NUM>, includes process element nodes, can be used to account for risk propagation through various types of dependencies between process elements. For example, for each process element node, a direct risk (DR), indirect risk (IDR), and total risk (TR).

For each connection of the process-aware AAG <NUM>, an importance vector (IV) can be assigned. The IV is a transformation vector of the risk from one element to another element. The IV indicates an amount of the risk that is to be carried from one node to a connected node.

For each node of the process-aware AAG <NUM>, a set of incoming nodes (IN) can be determined. For example, for the process element node for Process C, The set of incoming nodes includes Process A and Process B.

Direct risk is a risk vector that is measured directly over an element and propagated to its connected nodes. The following example relationship is provided: <MAT> where:.

Indirect risk, or followed risk, is an impact of a risk vector from an element to another that has process dependency relation. If the set of incoming nodes is zero, then indirect risk is zero and the importance vector is zero.

Total risk is the overall risk vector over an element considering both direct and indirect risk vectors for the element. The following example relationship is provided: <MAT>.

The indirect risk for a following node is based on the total risk of incoming nodes. The following example relationship is provided: <MAT> where:.

The process-aware AAG <NUM> can be traversed using an algorithm such as a depth-first search (DFS) algorithm. DFS is an algorithm for traversing or searching graph data structures. The algorithm starts at the root node (selecting some arbitrary node as the root node in the case of a graph) and explores as far as possible along each branch before backtracking. Input to the DFS algorithm includes the AAG with source node and related child node, and a function to be applied. Output of the DFS algorithm includes the AAG with propagated risk.

For consideration of risk propagation, assumptions can be made. In some examples, an assumption is that a node can be represented only within a single graph level. Other assumptions can include that leaf nodes do not hold incoming edges, that each leaf node has a pre-defined direct risk which is domain specific, and that risk propagation uses the same risk function across all graph levels.

<FIG> depicts an example UI <NUM> displaying an example process-aware risk assessment in accordance with implementations of the present disclosure.

Referring again to <FIG>, in some implementations, a total score is calculated based on a user-defined risk tolerance. During mitigation simulation by the mitigation simulator module <NUM>, a single risk aspect (e.g., safety) can be minimized or the total score can be minimized.

In further detail, the risk profile <NUM> defines a minimal risk level for each risk aspect in a set of configurable risk aspects (e.g., availability, confidentiality, integrity, safety). In some examples, the risk profile includes user-assigned acceptance scores to each risk aspect, an acceptance score represents an enterprise's minimal acceptance rate of a risk aspect. For example, if an enterprise accepts <NUM>% safety risk, the acceptance score for the safety risk aspect is set to <NUM>. The risk profile <NUM> is a risk vector holding the acceptance scores of all of the configurable risk aspects.

In some examples, a risk vector is calculated for each attack goal. For example, a risk vector per attack goal is calculated as a multifaction between the impact vector and the easiest way of reaching the attack goal. As long as it is easier to reach the attack goal, the risk vector converges to the impact vector, and as long as it is harder to reach the attack goal, the risk vector converges to <NUM>. The following example relationship is provided: <MAT> where:.

Direct risk can be calculated over the attack goals to and can be used to account for risk propagation through various types of dependencies between asset elements, similar to as described above with reference to <FIG>. For example, for each leaf node representing an attack goal, a direct risk (DR), indirect risk (IDR), and total risk (TR) can be determined. In this way, risk propagation between assets can be considered.

In some examples, a risk vector is calculated for each crown-jewel level. For example, a risk vector per crown-jewel is determined as the maximal risk over the attack goals that relate to the respective crown-jewel, where calculation is performed per risk aspect. The following example relationship is provided: <MAT> where:.

In some examples, a risk vector is calculated for process-level risk. For example, a risk vector per process is determined as the maximal risk over the crown-jewels that relate to the process, where calculation is performed per risk aspect. The following example relationship is provided: <MAT> where:.

In some implementations, a total score is calculated as a sigmoid function of the sum of differences between risk aspects to their tolerance. In general, a sigmoid function is a mathematical function having a characteristic "S"-shaped curve (sigmoid curve). In some examples, when the sum of differences is equal to <NUM>, the total score is equal to <NUM>. As long as risk exceeds tolerance total, the total score converges to <NUM>. As long as risk decreases from tolerance, the total score converges to <NUM>. The following example relationship is provided: <MAT> where:.

In accordance with implementations of the present disclosure, the mitigation simulator (e.g., executed by the mitigation simulator module <NUM>) takes a process-aware AAG and a risk tolerance as input, and automatically outputs mitigation priority in a manner that minimizes risk in the context of the process. As noted above, the mitigation priority can be based on minimizing a single risk aspect (e.g. safety) or the total score. In some examples, the mitigation priority is provided as a prioritized list of ordered facts (input facts, derived facts) that should be addressed (e.g., repaired). In some implementations, the mitigation simulator is provided as a greedy algorithm that, in each step, searches for the attack goal with the maximal process-level risk loss and mitigates the attack goal.

In mitigation simulation, the following example functions are defined:.

The following algorithm of Listing <NUM> represents a mitigation simulator in accordance with implementations of the present disclosure:
<IMG>.

In some implementations, the mitigation list output by the mitigation simulator is input to an automatic remediation system. In some examples, the automatic remediation system maps each fact of the mitigation list to a pre-defined automatic remediation action. For example, a remediation action can be associated with a fact, as a known remediation action for mitigating the fact (e.g., preventing the fact from occurring). The remediation actions are executed to mitigate risk within the enterprise network.

As described herein, implementations of the present disclosure enable enterprise to have clear visibility into security postures in the context of processes (at least partially) executed within enterprise networks. Further implementations of the present disclosure prioritizes mitigation efforts according to the impact over enterprise processes. Further, both the simulation and the risk assessment are based on a process-aware AAG. Implementations of the present disclosure are driven by information that is embedded within the twin ontology of risk vectors and rule hardness, and are instantiated to the instance level to the favor of risk calculation and mitigation prioritization. Considering risk-tolerance to automatically prioritize mitigations enables implementations of the present disclosure to be sensitive to user preferences.

<FIG> depicts an example process <NUM> that can be executed in accordance with implementations of the present disclosure. In some implementations, the example process <NUM> may be performed using one or more computer-executable programs executed using one or more computing devices.

A process-aware AAG and a risk profile are received (<NUM>). For example, a process-aware AAG representative of an enterprise network (or portion thereof) and a risk tolerance representative of risk tolerances of the enterprise across a set of risk aspects are received by each of a process-aware risk assessment module and a mitigation simulator module. A risk assessment is generated (<NUM>). For example, the process-aware risk assessment module generates a risk assessment based on the process-aware AAG and the risk profile. The risk assessment is received (<NUM>). For example, the mitigation simulator receives the risk assessment from the process-aware risk assessment module.

A mitigation list is generated (<NUM>). For example, the mitigation simulator executes a simulation (e.g., per Listing <NUM>) based on the process-aware AAG, the risk profile, and the risk assessment and outputs a mitigation list. As described herein, the mitigation list includes a prioritized list of facts (input facts, derived facts) that can be mitigated to reduce risk. A set of remediation actions is determined (<NUM>). For example, one or more facts of the mitigation list can be mapped to at least one mitigation action. In some examples, a fact-to-mitigation action mapping can be retrieved from computer-readable memory, which identifies remediation actions that can be executed for respective facts. Remediation actions are executed (<NUM>). For example, a remediation action is executed to mitigate risk resulting from a respective fact.

Implementations and all of the functional operations described in this specification may be realized in digital electronic circuitry, or in computer software, firmware, or hardware, including the structures disclosed in this specification and their structural equivalents, or in combinations of one or more of them. Implementations may be realized as one or more computer program products, i.e., one or more modules of computer program instructions encoded on a computer readable medium for execution by, or to control the operation of, data processing apparatus. The computer readable medium may be a machine-readable storage device, a machine-readable storage substrate, a memory device, a composition of matter effecting a machine-readable propagated signal, or a combination of one or more of them. The term "computing system" encompasses all apparatus, devices, and machines for processing data, including by way of example a programmable processor, a computer, or multiple processors or computers. The apparatus may include, in addition to hardware, code that creates an execution environment for the computer program in question (e.g., code) that constitutes processor firmware, a protocol stack, a database management system, an operating system, or a combination of one or more of them. A propagated signal is an artificially generated signal (e.g., a machine-generated electrical, optical, or electromagnetic signal) that is generated to encode information for transmission to suitable receiver apparatus.

A computer program (also known as a program, software, software application, script, or code) may be written in any appropriate form of programming language, including compiled or interpreted languages, and it may be deployed in any appropriate form, including as a standalone program or as a module, component, subroutine, or other unit suitable for use in a computing environment. A program may be stored in a portion of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the program in question, or in multiple coordinated files (e.g., files that store one or more modules, sub programs, or portions of code). A computer program may be deployed to be executed on one computer or on multiple computers that are located at one site or distributed across multiple sites and interconnected by a communication network.

The processes and logic flows described in this specification may be performed by one or more programmable processors executing one or more computer programs to perform functions by operating on input data and generating output. The processes and logic flows may also be performed by, and apparatus may also be implemented as, special purpose logic circuitry (e.g., an FPGA (field programmable gate array) or an ASIC (application specific integrated circuit)).

Processors suitable for the execution of a computer program include, by way of example, both general and special purpose microprocessors, and any one or more processors of any appropriate kind of digital computer. Elements of a computer can include a processor for performing instructions and one or more memory devices for storing instructions and data. Generally, a computer will also include, or be operatively coupled to receive data from or transfer data to, or both, one or more mass storage devices for storing data (e.g., magnetic, magneto optical disks, or optical disks). Moreover, a computer may be embedded in another device (e.g., a mobile telephone, a personal digital assistant (PDA), a mobile audio player, a Global Positioning System (GPS) receiver). Computer readable media suitable for storing computer program instructions and data include all forms of non-volatile memory, media and memory devices, including by way of example semiconductor memory devices (e.g., EPROM, EEPROM, and flash memory devices); magnetic disks (e.g., internal hard disks or removable disks); magneto optical disks; and CD ROM and DVD-ROM disks.

To provide for interaction with a user, implementations may be realized on a computer having a display device (e.g., a CRT (cathode ray tube), LCD (liquid crystal display), LED (light-emitting diode) monitor, for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball), by which the user may provide input to the computer. Other kinds of devices may be used to provide for interaction with a user as well; for example, feedback provided to the user may be any appropriate form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any appropriate form, including acoustic, speech, or tactile input.

Implementations may be realized in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a client computer having a graphical user interface or a Web browser through which a user may interact with an implementation), or any appropriate combination of one or more such back end, middleware, or front end components. The components of the system may be interconnected by any appropriate form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN") and a wide area network ("WAN") (e.g., the Internet).

While this specification contains many specifics, these should not be construed as limitations on the scope of the disclosure or of what may be claimed, but rather as descriptions of features specific to particular implementations. Certain features that are described in this specification in the context of separate implementations may also be implemented in combination in a single implementation. Conversely, various features that are described in the context of a single implementation may also be implemented in multiple implementations separately or in any suitable sub-combination. Moreover, although features may be described above as acting in certain combinations and even initially claimed as such, one or more features from a claimed combination may in some cases be excised from the combination, and the claimed combination may be directed to a sub-combination or variation of a sub-combination.

Moreover, the separation of various system components in the implementations described above should not be understood as requiring such separation in all implementations, and it should be understood that the described program components and systems may generally be integrated together in a single software product or packaged into multiple software products.

Claim 1:
A computer-implemented method for prioritizing mitigation in enterprise networks (<NUM>), the method being executed by one or more processors and comprising:
receiving graph data representative of a process-aware analytical attack graph, AAG, (<NUM>; <NUM>; <NUM>) that is representative of potential lateral movement of adversaries within a computer network, wherein nodes of the process-aware AAG are associated with process attributes, a process attribute maps a node to at least a portion of a process that is at least partially executed within the computer network, and wherein the nodes indicate facts of the process-aware AAG;
receiving risk profile data representative of a risk profile of an enterprise with respect to two or more risk aspects, wherein the risk profile comprises a user-assigned acceptance score to each risk aspect, an acceptance score representing the enterprise's minimal acceptance rate of a risk aspect;
generating, by a process-aware risk assessment module (<NUM>), a risk assessment (<NUM>) based on the process-aware AAG and the risk profile;
generating, by a mitigation simulator module (<NUM>), a mitigation list based on the process-aware AAG, the risk profile, and the risk assessment, the mitigation list comprising a prioritized list of two or more of the facts of the process-aware AAG;
providing a set of remediation actions based on the mitigation list; and
executing at least one remediation action in the set of remediation actions to mitigate cyber security risk to the computer network.