Patent ID: 6952779

Claim:
A method for performing risk assessment in a computer network, the method comprising: generating a network topology model for the computer network, the network topology model including a set of network nodes, a set of actual vulnerabilities associated with the network nodes, and a set of access rules associated with the network nodes; determining, among the set of network nodes, one or more start points, by analyzing a set of access control lists and filtering rules from one or more network devices, the set of access control lists and filtering rules collected by a network discovery agent to determine the start points, and one or more end points of one or more potential attack paths through the network topology model; generating an attack graph comprising a set of graph nodes wherein each graph node represents a state of a single service in the network; simulating one or more attacks from one or more start points to one or more end points using the attack graph; and storing the results of the attack simulation in a computer memory.