Patent ID: 8196178

Claim:
A method of generating a privilege elevation graph, the method comprising: performing a privilege elevation analysis on a computer system having a plurality of associated security identifiers, each security identifier corresponding to an object that potentially accesses another object and gains elevated privileges on the computer system, the performing of the privilege elevation analysis on the computer system including detecting privilege elevations between security identifier pairs; and generating a graph illustrating the results of the privilege elevation analysis, the generating of the graph comprising: generating a node for each of the security identifiers; and for each detected privilege elevation between security identifier pairs, generating at least one edge directly between the nodes corresponding to the security identifier pairs, the edges including a first edge and a second edge directly leading from a first node to a second node of a first security identifier pair; and displaying the generated graph, the displaying comprising: displaying the first and the second edges as two separate edges between the first node and the second node; and providing an option to combine the first and the second edges into a single edge directly leading from the first node to the second node, and further providing an ability to view underlying privilege elevations.