Patent Document ID: 10108803
Application ID: 15087310
Patent Status: 1

Claim One:
1. A computer-implemented method for generating an attack graph to protect sensitive data objects located on a network from attack, the computer-implemented method comprising: identifying, by a computer, a set of sensitive data corresponding to a regulated service; scanning, by the computer, for a set of components corresponding to the regulated service that are authorized to perform activities associated with sensitive data; identifying, by the computer, vulnerability and risk metrics corresponding to each component in the set of components of the regulated service; generating, by the computer, the attack graph that includes nodes representing components in the set of components of the regulated service and edges between nodes representing relationships between related components in the set of components based on the vulnerability and risk metrics corresponding to each component in the set of components; calculating, by the computer, a risk score for each component represented by a node in the attack graph based on a level of compromisability, a sensitivity rank, an integrity rank, and a criticality rank corresponding to each respective component; aggregating, by the computer, risk scores for each component along each edge path connecting a node of a particular component to a node of a related component to form an aggregated risk score for each component; and responsive to the computer determining that the aggregated risk score of a component is greater than or equal to a risk threshold, performing, by the computer, an action to mitigate a risk to sensitive data corresponding to the component posed by an attack via the network.