DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 04/21/2026 has been entered. Claims 1-20 have been examined.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 06/01/2026. The submission is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Response to Arguments
Applicant’s arguments, see Remarks – Pages 13-15, filed on 04/21/2026 with respect to the rejections of claims 1,11,16 under 103 have been fully considered and are persuasive. Therefore, the rejection has been withdrawn. However, upon further consideration, a new ground of rejection is made in view of Phillips.
Claim Objections
Claims 3,9,12,18 are objected to because of the following informalities:
With regards to claims 3,18, the claim recites “ the attack” . The examiner suggests amending the claim to recite “ the attack path”. Appropriate correction is required.
With regards to claim 9, the claim recites “ the one or more attack” . Examiner suggests amending the claim to recite “ the one or more attack paths”. Appropriate correction is required.
With regards to claim 12, the claim recites “ the one or more paths” . Examiner suggests amending the claim to recite “ the one or more attack paths”. Appropriate correction is required.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claim 14 is rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
With regards to claim 14, the claim recites “ the one or more attack paths”. It is unclear what the one or more attack paths are referring to because claim 14 recites “ one or more attack paths” and claim 11 which claim 14 depends on recites “ one or more attack paths”. Therefore, the examiner is unable to determine the metes and bounds of the claim language. Examiner suggests amending claim 14 to recite “ wherein the security posture visualization comprises the one or more attack paths”.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-4,10,16 -18 are rejected under 35 U.S.C. 103 as being unpatentable over Brown et al. Publication No. US 2023/0328094 A1 ( Brown hereinafter) in view of Phillips et al. “ A Graph – Based System for Network-Vulnerability Analysis” ( Phillips hereinafter)
Regarding claim 1,
Brown teaches a computerized system comprising:
one or more computer processors; and computer memory storing computer-useable instructions that, when used by the one or more computer processors, cause the one or more computer processors to perform operations (Fig.4), the operations comprising:
accessing an attack path discovery computation model, wherein the attack path discovery computation model supports automatically discovering attack paths for computing environments associated with computing environment graphs, wherein the attack path discovery computation model is associated with an attack path discovery template that supports discovering the attack paths, the attack path discovery template ( ¶0041 – ¶ 0042 -disclosed herein are embodiments for a comprehensive risk management system, referred to herein as GRAVITAS, for IoT/CPS that can identify undiscovered attack vectors and optimize the placement of defenses within the system for optimal performance and cost. While existing risk management systems consider only known attacks, embodiments of the disclosed model employ a graphical approach to extrapolate undiscovered exploits, enabling identification of attacks overlooked by manual penetration testing (pen-testing). The model is flexible enough to analyze practically any IoT/CPS and provide the system administrator with a concrete list of suggested defenses that can reduce system vulnerability at optimal cost. GRAVITAS can be employed by governments, companies, and system administrators to configure secure IoT/CPS at scale, providing a quantitative measure of security and efficiency in a world where IoT/CPS devices will soon be ubiquitous -With an IoT/CPS configuration and threat model as input, and a list of the most cost-effective defenses as output, GRAVITAS presents a security model that allows the system administrator to discover new attack vectors and proactively configure secure IoT/CPS both pre- and post-deployment – ¶ 0021 -FIG. 6 depicts a table of exploit goals in a master attack graph template according to an embodiment of the present invention – See Also ¶0089, ¶0091). comprising:
an entry point element that defines a starting node where an attacker gains initial access (¶ 0070 -A: The nodes at which an adversary can access the system. These "entry nodes" are the starting points for any attack. They are also vulnerabilities (A c N)).
an advancement step element that defines a conditional operation that enables attacker movement between nodes based on an authenticated connection or a privilege escalation condition ( ¶ 0063 -series of steps that begins at an "entry point" (a root node) and ends at a "goal" (a leaf node). The SHARKS attack graph, shown in FIG. 2 was created by deconstructing 41 known attacks on IoT/CPS into a series of steps represented by a vulnerability node chain (an exploit), and subsequently merging every node chain into a single directed acyclic graph (DAG). This graph makes no distinctions between network-level, hardware-level, or software level nodes: what matters is the procedure that brings attackers to their desired destination – ¶ 0099 – ¶ 0101 -. Permission Subgraphs: GRAVITAS allows the system administrator to specify permissions for every device. Unlike other attack graph models, the access permissions are each represented by a separate copy of a subgraph - Two different types of permissions are modeled: login permissions and execute command permissions. With a login permission, a user with the correct credentials can execute any (permitted) command on the system – See Also Claims 34 -35,¶ 0068).
a target element that defines an endpoint node representing a critical computing asset identified by condition indicating sensitive or high-value (¶ 0071 -The leaf nodes of the graph. These represent the completion of an attack (L c N). These "exploit goals" represent the end goal of an adversary's attack, such as "Disable device" or "DoS attack," as nonlimiting example ¶ 0072 -P: The set of nodes that constitute a complete attack vector. Each exploit begins at an entry node and concludes at an exploit goal node. More formally, an exploit Pis any ordered set of nodes in the form { a, n1 , ... , n1o I} where aEA, 11;EN, !EL. The same entry node and exploit goal pair can be a part of multiple attack vectors – ¶ 0128 - In FIG. 23, it is observed that the end result of the exploit is a DoS attack on the cloud server for the Google Home device. Its origin is a malware downloaded onto a laptop, which in tum instructs the Samsung fridge to flood the Google Home server with bogus traffic, thus launching a DoS attack.. GRAVITAS recognizes the importance of these vulnerabilities due to their crucial role in several attack vectors that lead to attack outcomes with high impact scores – See Fig.24 );
using the attack path discovery computation model. The attack path discovery template, and a computing environment graph for a computing environment, identifying a plurality of attack paths associated with the computing environment; and communicate the plurality of attack paths for the computing environment (¶ 0013, Claim 1 -construct an attack directed acyclic graph (DAG) unique to each CPS or IoT device of the devices, each attack DAG comprising a first plurality of nodes, each node of the first plurality representing a system-level operation of the device, a plurality of paths, each path representing an attack vector of the device, and a second plurality of nodes, each node of the second plurality representing an exploit goal of the device ¶ 0127 -Both attacks demonstrate GRAVITAS's ability to include IoT/CPS-specific vulnerabilities in the attack graph, such as physical tampering for edge-side devices. There are numerous paths through the system available to the adversary, and GRAVITAS can find those attack vectors that are most likely to be targeted – ¶ 0041 -GRAVITAS, for IoT/CPS that can identify undiscovered attack vectors and optimize the placement of defenses within the system for optimal performance and cost. While existing risk management systems consider only known attacks, embodiments of the disclosed model employ a graphical approach to extrapolate undiscovered exploits, enabling identification of attacks overlooked by manual penetration testing (pen-testing). The model is flexible enough to analyze practically any IoT/CPS and provide the system administrator with a concrete list of suggested defenses that can reduce system vulnerability at optimal cost. ¶ 0053 -Discovers novel attack vectors - ¶ 0056 - (5) Incorporates novel attack vectors that have not yet been exploited in real-world systems. – See Also ¶ 0129,¶ 0133).
However, Brown does not explicitly teach
wherein identifying the plurality of attack paths is based on graph-based constraints defined by the attack path discovery template, the graph-based constraints corresponding to the entry point element, the advancement step element, and the target element, and wherein the attack path discovery computation model applies the graph- based constraints to the computing environment graph to evaluate satisfaction of conditions associated with the entry point element, the advancement step element, and the target element to identify the plurality of attack paths;
Phillips teaches
wherein identifying the plurality of attack paths is based on graph-based constraints defined by the attack path discovery template, the graph-based constraints corresponding to the entry point element, the advancement step element, and the target element, and wherein the attack path discovery computation model applies the graph- based constraints to the computing environment graph to evaluate satisfaction of conditions associated with the entry point element, the advancement step element, and the target element to identify the plurality of attack paths (Abstract – Graph-based tool identifies set of attack paths that have a high probability of success for the attacker - The analysis system requires as input a database of common attacks, broken into atomic steps, specific network configuration and topology info, and an attacker profile. The attack information is "matched" with network configuration info and an attacker profile to create a superset attack graph. Nodes identify a stage of attack, e.g. the class of machines the attacker has accessed and the user privilege level he or she has compromised. The arcs in the attack graph represent attacks or stages of attacks Section 1 - attack templates represent pieces of known attacks or hypothesized methods of moving from one state to another, their combinations can lead to descriptions of new attacks. That is, any path in the attack graph represents an attack– Section 2.3- Attack templates represent generic steps in known attacks, including conditions which must hold for the attack to be possible. Each node in the attack template represents a state of an attack,. Edges in the attack template represent actions taken by the attacker. They indicate an event such as the detection of a particular type of packet on a network by hardware/software under attack control - Each edge has conditions on the users/machines, if all the conditions are met, the attack succeeds with a given probability and/or cost. The edges can be a function of configuration and attacker capability. State field breaks attacks into atomic pieces. An attack may require several steps, each of which could fall and none of which adds a new capability, vulnerability Section 3 - Start with the goal node: achievement of user-level access on machine M. The graph generator checks the database of attack templates and identifies all edges whose heads match the goal node-The goal node also matches the last node of the second template for physical access. Machine M matches the variable X and the instantiation function creates node N4, which in turn generates N5. the attacker does not have physical access to M. Thus, the nodes N4 and N5 are marked with a dotted line to show that under existing conditions, they would not be reachable from the start state - we could have generated an intermediate node for becoming root only on B rather than A or B. We recognize node N3 as a start node in this graph Section 4 - If one wishes to find only a single shortest path, representing the most likely or least-cost attack, from a start node to any number of goal nodes, then any standard shortest-path algorithm will suffice. See Also - Section 6).
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Brown to include the teachings of Phillips. The motivation for doing so is to allow the system utilize a graph based tool to identify set of attack paths that have a high probability of success for the attacker ( Phillips – Abstract) .
Regarding claim 2,
Brown further teaches
wherein the attack path discovery computation model further accesses the attack path discovery template comprising the entry point element, the advancement step element, and the target element associated with corresponding conditions that are evaluated to identify the plurality of attack paths (¶ 0043 - The novelty of the proposed methodology lies in at least the following: (0044] (1) An automated IoT/CPS-specific exploit discovery tool that includes potential vulnerabilities and attack vectors that have yet to be discovered – ¶ 0021 – 0022 - FIG. 6 depicts a table of exploit goals in a master attack graph template according to an embodiment of the present invention – ¶ 0063 - SHARKS eschews a rigid classification and models an exploit chain (attack vector) as it appears to an adversary: a series of steps that begins at an "entry point" (a root node) and ends at a "goal" (a leaf node). ¶ 0070 - The nodes at which an adversary can access the system. These "entry nodes" are the starting points for any attack. They are also vulnerabilities (A c N). ¶ 0071-0072 - The leaf nodes of the graph. These represent the completion of an attack (L c N). These "exploit goals" represent the end goal of an adversary's attack, such as "Disable device" or "DoS attack – ¶ 0042 - These attack vectors are then assigned risk scores according to a probabilistic method that models the interaction between attack impacts and the graph's vulnerabilities. – ¶ 0082 - GRAVITAS solves this issue by creating a unique attack DAG for every device in an IoT/CPS and adding additional pathways between devices based on network topology).
Regarding claim 3,
Brown further teaches
wherein identifying an attack path comprises: based on the entry point element, identifying an entry point in the computing environment graph; based on the advancement step element, identifying an advancement step in the computing environment graph; based on the target element, identifying a target in the computing environment graph; and generating the attack based on the entry point, the advancement step, and the target (¶ 0063 - SHARKS eschews a rigid classification and models an exploit chain (attack vector) as it appears to an adversary: a series of steps that begins at an "entry point" (a root node) and ends at a "goal" (a leaf node) – ¶ 0089 - All device attack graphs used in GRAVITAS are derived in part from an updated version of the SHARKS graph. This master attack graph template (J) includes a subset of the original SHARKS graph, including ML-predicted edges between nodes that indicate new vulnerabilities - ¶ 0070 - The nodes at which an adversary can access the system. These "entry nodes" are the starting points for any attack – ¶ 0090 - Every graph J also contains a new set of nodes designated as exploit goals, L. The table in FIG. 6 lists the exploit goals, which collectively represent IoT/CPS exploits. In addition, certain nodes from the original SHARKS graph are designated as entry nodes, A – ¶ 0079 - The adversary reaches the desired I by starting at an entry node a and passing through other vulnerability nodes n,EN. This complete path P is known as an exploit chain or attack and may involve vulnerabilities in multiple devices – ). ¶ 0071 - The leaf nodes of the graph. These represent the completion of an attack (L c N). These "exploit goals" represent the end goal of an adversary's attack, such as "Disable device" or "DoS attack – ¶ 0072- The set of nodes that constitute a complete attack vector. Each exploit begins at an entry node and concludes at an exploit goal node. More formally, an exploit Pis any ordered set of nodes in the form).
Regarding claim 4,
Brown further teaches
wherein: the entry point element is associated with two or more of: an entry point tile, an entry point node, an entry point insight, and an entry point condition; the advancement step element is associated with three or more of: a source node, an edge, a target node, a target node condition, an edge condition, and an action; and the target element is associated with two or more of : a target title, a target, a target insight, and a target condition (¶0070 - A: The nodes at which an adversary can access the system. These "entry nodes" are the starting points for any attack. They are also vulnerabilities (A c N) – Abstract - The processors are further configured to generate an aggregate attack DAG from a classification of each device and a location of each device in network topology specified by a system administrator – ¶0079 - The adversary reaches the desired I by starting at an entry node a and passing through other vulnerability nodes n,EN – ¶0068 - E: The set of edges in the graph. Edges represent exploits, or pathways between vulnerabilities. Unlike in other attack graph models, edges do not have an access control parameter; each edge instead represents a possible path between vulnerabilities – ¶ 0063 - SHARKS eschews a rigid classification and models an exploit chain (attack vector) as it appears to an adversary: a series of steps that begins at an "entry point" (a root node) and ends at a "goal" (a leaf node). The SHARKS attack graph, shown in FIG. 2 was created by deconstructing 41 known attacks on IoT/CPS into a series of steps represented by a vulnerability node chain (an exploit), and subsequently merging every node chain into a single directed acyclic graph (DAG)- ¶ 077- Exploitability refers to the effort required by an adversary to "succeed" in an attack step, while impact refers to the damage that a successful attack can inflict on the security of the system – ¶0013 - Each attack DAG includes a first plurality of nodes, where each node of the first plurality represents a system level operation of the device. Each attack DAG further includes a plurality of paths, where each path represents an attack vector of the device. Each attack DAG also includes a second plurality of nodes, where each node of the second plurality represents an exploit goal of the device – ¶0079 - The threat model here includes an adversary who wishes to achieve an exploit goal I with a motivation specified by its impact score. The adversary reaches the desired I by starting at an entry node a and passing through other vulnerability nodes n,EN. This complete path P is known as an exploit chain or attack and may involve vulnerabilities in multiple devices).
Regarding claim 10,
Brown further teaches
receiving an indication to execute a remediation action associated with an attack path associated with a security visualization; and executing the remediation action (¶0041 - provide the system administrator with a concrete list of suggested defenses that can reduce system vulnerability at optimal cost – ¶ 0042 – GRAVITAS suggests defenses to the system using an optimization process
that lowers the risk score at minimum cost. With an IoT/CPS configuration and threat model as input, and a list of the most cost-effective defenses as output, GRAVITAS presents a security model that allows the system administrator to discover new attack vectors and proactively configure secure IoT/CPS both pre- and post-deployment – See also ¶ 0012).
Regarding claim 16,
Brown teaches a computerized implemented method, the method comprising:
accessing an attack path discovery computation model, wherein the attack path discovery computation model supports automatically discovering attack paths for computing environments associated with computing environment graphs, accessing a computing environment graph comprising computing components of a computing environment; using the attack path discovery computation model and the computing environment graph, identifying a plurality of attack paths associated with the computing environment, wherein the attack path discovery computation model is associated with an attack path discovery template that supports discovering the attack paths, the attack path discovery template ( ¶ 0041 – ¶ 0042 -disclosed herein are embodiments for a comprehensive risk management system, referred to herein as GRAVITAS, for IoT/CPS that can identify undiscovered attack vectors and optimize the placement of defenses within the system for optimal performance and cost. While existing risk management systems consider only known attacks, embodiments of the disclosed model employ a graphical approach to extrapolate undiscovered exploits, enabling identification of attacks overlooked by manual penetration testing (pen-testing). The model is flexible enough to analyze practically any IoT/CPS and provide the system administrator with a concrete list of suggested defenses that can reduce system vulnerability at optimal cost. GRAVITAS can be employed by governments, companies, and system administrators to configure secure IoT/CPS at scale, providing a quantitative measure of security and efficiency in a world where IoT/CPS devices will soon be ubiquitous -With an IoT/CPS configuration and threat model as input, and a list of the most cost-effective defenses as output, GRAVITAS presents a security model that allows the system administrator to discover new attack vectors and proactively configure secure IoT/CPS both pre- and post-deployment – ¶ 0021 -FIG. 6 depicts a table of exploit goals in a master attack graph template according to an embodiment of the present invention – See Also ¶0089, ¶0091) . comprising:
an entry point element that defines a starting node where an attacker gains initial access (¶ 0070 - A: The nodes at which an adversary can access the system. These "entry nodes" are the starting points for any attack. They are also vulnerabilities (A c N). ).
an advancement step element that defines a conditional operation that enables attacker movement between nodes based on an authenticated connection or a privilege escalation condition ( ¶ 0063 -series of steps that begins at an "entry point" (a root node) and ends at a "goal" (a leaf node). The SHARKS attack graph, shown in FIG. 2 was created by deconstructing 41 known attacks on IoT/CPS into a series of steps represented by a vulnerability node chain (an exploit), and subsequently merging every node chain into a single directed acyclic graph (DAG). This graph makes no distinctions between network-level, hardware-level, or software level nodes: what matters is the procedure that brings attackers to their desired destination – ¶ 0099 – ¶ 0101 -. Permission Subgraphs: GRAVITAS allows the system administrator to specify permissions for every device. Unlike other attack graph models, the access permissions are each represented by a separate copy of a subgraph - Two different types of permissions are modeled: login permissions and execute command permissions. With a login permission, a user with the correct credentials can execute any (permitted) command on the system – See Also Claims 34 -35,¶ 0068).
a target element that defines an endpoint node representing a critical computing asset identified by condition indicating sensitive or high-value ( ¶ 0071 -The leaf nodes of the graph. These represent the completion of an attack (L c N). These "exploit goals" represent the end goal of an adversary's attack, such as "Disable device" or "DoS attack," as nonlimiting example ¶ 0072 -P: The set of nodes that constitute a complete attack vector. Each exploit begins at an entry node and concludes at an exploit goal node. More formally, an exploit Pis any ordered set of nodes in the form { a, n1 , ... , n1o I} where aEA, 11;EN, !EL. The same entry node and exploit goal pair can be a part of multiple attack vectors – ¶ 0128 - In FIG. 23, it is observed that the end result of the exploit is a DoS attack on the cloud server for the Google Home device. Its origin is a malware downloaded onto a laptop, which in tum instructs the Samsung fridge to flood the Google Home server with bogus traffic, thus launching a DoS attack.. GRAVITAS recognizes the importance of these vulnerabilities due to their crucial role in several attack vectors that lead to attack outcomes with high impact scores – See Fig.24 ) ;
communicate the plurality of attack paths for the computing environment ( ¶ 0013, Claim 1 -construct an attack directed acyclic graph (DAG) unique to each CPS or IoT device of the devices, each attack DAG comprising a first plurality of nodes, each node of the first plurality representing a system-level operation of the device, a plurality of paths, each path representing an attack vector of the device, and a second plurality of nodes, each node of the second plurality representing an exploit goal of the device = ¶ 0127 -Both attacks demonstrate GRAVITAS's ability to include IoT/CPS-specific vulnerabilities in the attack graph, such as physical tampering for edge-side devices. There are numerous paths through the system available to the adversary, and GRAVITAS can find those attack vectors that are most likely to be targeted – ¶ 0041 -GRAVITAS, for IoT/CPS that can identify undiscovered attack vectors and optimize the placement of defenses within the system for optimal performance and cost. While existing risk management systems consider only known attacks, embodiments of the disclosed model employ a graphical approach to extrapolate undiscovered exploits, enabling identification of attacks overlooked by manual penetration testing (pen-testing). The model is flexible enough to analyze practically any IoT/CPS and provide the system administrator with a concrete list of suggested defenses that can reduce system vulnerability at optimal cost. ¶ 0053 -Discovers novel attack vectors - ¶ 0056 - (5) Incorporates novel attack vectors that have not yet been exploited in real-world systems. – See Also ¶ 0129,¶ 0133).
However, Brown does not explicitly teach
wherein identifying the plurality of attack paths is based on graph-based constraints defined by the attack path discovery template, the graph-based constraints corresponding to the entry point element, the advancement step element, and the target element, and wherein the attack path discovery computation model applies the graph- based constraints to the computing environment graph to evaluate satisfaction of conditions associated with the entry point element, the advancement step element, and the target element to identify the plurality of attack paths;
Phillips teaches
wherein identifying the plurality of attack paths is based on graph-based constraints defined by the attack path discovery template, the graph-based constraints corresponding to the entry point element, the advancement step element, and the target element, and wherein the attack path discovery computation model applies the graph- based constraints to the computing environment graph to evaluate satisfaction of conditions associated with the entry point element, the advancement step element, and the target element to identify the plurality of attack paths (Abstract – Graph-based tool identifies set of attack paths that have a high probability of success for the attacker - The analysis system requires as input a database of common attacks, broken into atomic steps, specific network configuration and topology info, and an attacker profile. The attack information is "matched" with network configuration info and an attacker profile to create a superset attack graph. Nodes identify a stage of attack, e.g. the class of machines the attacker has accessed and the user privilege level he or she has compromised. The arcs in the attack graph represent attacks or stages of attacks Section 1 - attack templates represent pieces of known attacks or hypothesized methods of moving from one state to another, their combinations can lead to descriptions of new attacks. That is, any path in the attack graph represents an attack– Section 2.3- Attack templates represent generic steps in known attacks, including conditions which must hold for the attack to be possible. Each node in the attack template represents a state of an attack,. Edges in the attack template represent actions taken by the attacker. They indicate an event such as the detection of a particular type of packet on a network by hardware/software under attack control - Each edge has conditions on the users/machines, if all the conditions are met, the attack succeeds with a given probability and/or cost. The edges can be a function of configuration and attacker capability. State field breaks attacks into atomic pieces. An attack may require several steps, each of which could fall and none of which adds a new capability, vulnerability Section 3 - Start with the goal node: achievement of user-level access on machine M. The graph generator checks the database of attack templates and identifies all edges whose heads match the goal node-The goal node also matches the last node of the second template for physical access. Machine M matches the variable X and the instantiation function creates node N4, which in turn generates N5. the attacker does not have physical access to M. Thus, the nodes N4 and N5 are marked with a dotted line to show that under existing conditions, they would not be reachable from the start state - we could have generated an intermediate node for becoming root only on B rather than A or B. We recognize node N3 as a start node in this graph Section 4 - If one wishes to find only a single shortest path, representing the most likely or least-cost attack, from a start node to any number of goal nodes, then any standard shortest-path algorithm will suffice. See Also - Section 6).
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Brown to include the teachings of Phillips. The motivation for doing so is to allow the system utilize a graph based tool to identify set of attack paths that have a high probability of success for the attacker ( Phillips – Abstract) .
Regarding claim 17,
Brown further teaches
wherein the attack path discovery computation model further accesses the attack path discovery template comprising the entry point element, the advancement step element, and the target element associated with corresponding conditions that are evaluated to identify the plurality of attack paths (¶ 0043 - The novelty of the proposed methodology lies in at least the following: (0044] (1) An automated IoT/CPS-specific exploit discovery tool that includes potential vulnerabilities and attack vectors that have yet to be discovered – ¶ 0021 – 0022 - FIG. 6 depicts a table of exploit goals in a master attack graph template according to an embodiment of the present invention – ¶ 0063 - SHARKS eschews a rigid classification and models an exploit chain (attack vector) as it appears to an adversary: a series of steps that begins at an "entry point" (a root node) and ends at a "goal" (a leaf node). ¶ 0070 - The nodes at which an adversary can access the system. These "entry nodes" are the starting points for any attack. They are also vulnerabilities (A c N). ¶ 0071-0072 - The leaf nodes of the graph. These represent the completion of an attack (L c N). These "exploit goals" represent the end goal of an adversary's attack, such as "Disable device" or "DoS attack – ¶ 0042 - These attack vectors are then assigned risk scores according to a probabilistic method that models the interaction between attack impacts and the graph's vulnerabilities. – ¶ 0082 - GRAVITAS solves this issue by creating a unique attack DAG for every device in an IoT/CPS and adding additional pathways between devices based on network topology).
Regarding claim 18,
Brown further teaches
wherein identifying an attack path comprises: based on the entry point element, identifying an entry point in the computing environment graph; based on the advancement step element, identifying an advancement step in the computing environment graph; based on the target element, identifying a target in the computing environment graph; and generating the attack based on the entry point, the advancement step, and the target (¶ 0063 - SHARKS eschews a rigid classification and models an exploit chain (attack vector) as it appears to an adversary: a series of steps that begins at an "entry point" (a root node) and ends at a "goal" (a leaf node) – ¶ 0089 - All device attack graphs used in GRAVITAS are derived in part from an updated version of the SHARKS graph. This master attack graph template (J) includes a subset of the original SHARKS graph, including ML-predicted edges between nodes that indicate new vulnerabilities - ¶ 0070 - The nodes at which an adversary can access the system. These "entry nodes" are the starting points for any attack – ¶ 0090 - Every graph J also contains a new set of nodes designated as exploit goals, L. The table in FIG. 6 lists the exploit goals, which collectively represent IoT/CPS exploits. In addition, certain nodes from the original SHARKS graph are designated as entry nodes, A – ¶ 0079 - The adversary reaches the desired I by starting at an entry node a and passing through other vulnerability nodes n,EN. This complete path P is known as an exploit chain or attack and may involve vulnerabilities in multiple devices – ). ¶ 0071 - The leaf nodes of the graph. These represent the completion of an attack (L c N). These "exploit goals" represent the end goal of an adversary's attack, such as "Disable device" or "DoS attack – ¶ 0072- The set of nodes that constitute a complete attack vector. Each exploit begins at an entry node and concludes at an exploit goal node. More formally, an exploit Pis any ordered set of nodes in the form).
Claims 5,19 are rejected under 35 U.S.C. 103 as being unpatentable over Brown in view of Phillips further in view of Komarov et al. Publication No. US 2025/0112949 A1 ( Komarov hereinafter) further in view of Soroush et al. Publication No. US 2021/0012012 A1 ( Soroush hereinafter)
Regarding claim 5,
Brown does not explicitly teach
storing the plurality of attack paths in an attack path database, wherein the attack path database is associated with one or more security services via an attack path data Application Programming Interface (API), wherein the one or more security services access the plurality of attack paths to support executing security operations.
However, Komarov teaches
storing the plurality of attack paths in an attack path database, wherein the attack path database is associated with one or more security services via an interface, wherein the one or more security services access the plurality of attack paths to support executing security operations (Fig.4 – shows a table storing a plurality of network attack paths – ¶ 0163 - The network attack path visualization 600 of this example includes at least one GUI element containing information about an attack path definition 604 to which a relational representation of the attack path conforms. For example, the attack path 602 may be identified as an attack path because portion(s) of the network attack path table 400, the network attack path resource table 410, and/or the network attack path network connection table 420 corresponding to the attack path 602 conform to the attack path definition of a publicly exposed compute instance with attached privileged role. The at least one GUI element also includes a description, impact, and remediation measures (e.g., measures that may mitigate and/or resolve the security vulnerability).
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Brown to include the teachings of Komarov. The motivation for doing so is to allow the system to mitigate and/or resolve the security vulnerability (Komarov – ¶ 0163).
Brown in view of Komarov does not explicitly teach wherein the attack path database is associated with one or more security services via an attack path data Application Programming Interface (API),
Soroush teaches
wherein the attack path database is associated with one or more security services via an attack path data Application Programming Interface (API), wherein the one or more security services access the plurality of attack paths to support executing security operations (¶ 0039 - based on the data ingested in the data ingestion framework, build a query able, graph-based representation of the relationships between configuration vulnerabilities and attack scenarios, configuration parameters, and system components (modeling framework); provide an application programming interface (API) to perform a quantitative, comparative analysis of the security impact of configuration settings (reasoning framework); automatically construct a constraint satisfaction problem based on the model and utilize a Z3 SMT solver to solve for optimal parameter values (reasoning framework); and provide human-readable evidence about the optimality of the selected configuration. the modeling framework can store relationships between system components, configuration parameters, configuration predicates, and vulnerabilities in a query able, graph-based form. The modeling framework can also provide an application programming interface (API) to quantitatively evaluate the security of different system configurations using topological vulnerability analysis (e.g., by assessing and calculating the impact of one or more attack paths). The modeling framework can be built using a graph database platform, such as Neo4j, and the modeling framework can convert all ingested information into a graphical format. The modeling framework APis which provide security evaluation and configuration impact analysis may be implemented as a Neo4j plug-in, which can: analyze attack scenarios) .
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Brown in view of Komarov to include the teachings of Soroush. The motivation for doing so is to allow the system to provide an application programming interface (API) to quantitatively evaluate the security of different system configurations using topological vulnerability analysis by assessing and calculating the impact of one or more attack paths (Soroush– ¶ 0039).
Regarding claim 19,
Brown does not explicitly teach
storing the plurality of attack paths in an attack path database, wherein the attack path database is associated with one or more security services via an attack path data Application Programming Interface (API), wherein the one or more security services access the plurality of attack paths to support executing security operations.
However, Komarov teaches
storing the plurality of attack paths in an attack path database, wherein the attack path database is associated with one or more security services via an interface, wherein the one or more security services access the plurality of attack paths to support executing security operations (Fig.4 – shows a table storing a plurality of network attack paths – ¶ 0163 - The network attack path visualization 600 of this example includes at least one GUI element containing information about an attack path definition 604 to which a relational representation of the attack path conforms. For example, the attack path 602 may be identified as an attack path because portion(s) of the network attack path table 400, the network attack path resource table 410, and/or the network attack path network connection table 420 corresponding to the attack path 602 conform to the attack path definition of a publicly exposed compute instance with attached privileged role. The at least one GUI element also includes a description, impact, and remediation measures (e.g., measures that may mitigate and/or resolve the security vulnerability).
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Brown to include the teachings of Komarov. The motivation for doing so is to allow the system to mitigate and/or resolve the security vulnerability (Komarov – ¶ 0163).
Brown in view of Komarov does not explicitly teach wherein the attack path database is associated with one or more security services via an attack path data Application Programming Interface (API),
Soroush teaches
wherein the attack path database is associated with one or more security services via an attack path data Application Programming Interface (API), wherein the one or more security services access the plurality of attack paths to support executing security operations (¶ 0039 - based on the data ingested in the data ingestion framework, build a query able, graph-based representation of the relationships between configuration vulnerabilities and attack scenarios, configuration parameters, and system components (modeling framework); provide an application programming interface (API) to perform a quantitative, comparative analysis of the security impact of configuration settings (reasoning framework); automatically construct a constraint satisfaction problem based on the model and utilize a Z3 SMT solver to solve for optimal parameter values (reasoning framework); and provide human-readable evidence about the optimality of the selected configuration. the modeling framework can store relationships between system components, configuration parameters, configuration predicates, and vulnerabilities in a query able, graph-based form. The modeling framework can also provide an application programming interface (API) to quantitatively evaluate the security of different system configurations using topological vulnerability analysis (e.g., by assessing and calculating the impact of one or more attack paths). The modeling framework can be built using a graph database platform, such as Neo4j, and the modeling framework can convert all ingested information into a graphical format. The modeling framework APis which provide security evaluation and configuration impact analysis may be implemented as a Neo4j plug-in, which can: analyze attack scenarios)
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Brown in view of Komarov to include the teachings of Soroush. The motivation for doing so is to allow the system to provide an application programming interface (API) to quantitatively evaluate the security of different system configurations using topological vulnerability analysis by assessing and calculating the impact of one or more attack paths (Soroush– ¶ 0039).
Claims 6,8,9 are rejected under 35 U.S.C. 103 as being unpatentable over Brown in view of Phillips further in view of Napper et al Publication No. US 2024/0265112 A1 ( Napper hereinafter)
Regarding claim 6,
Brown further teaches
communicating a security visualization comprising an attack path, wherein the attack path is associated with a prioritization identifier and a risk score (¶0082 employing a "defense-in-depth" optimization approach that is intractable to human analysis. By giving an administrator the ability to visualize and mitigate IoT/CPS exploits before the system is deployed, GRAVITAS hopes to prevent the next Mirai-like attack before it happens – ¶ 0042 - These attack vectors are then assigned risk scores according to a probabilistic method that models the interaction between attack impacts and the graph's vulnerabilities. Using these quantitative scores as a foundation for measuring risk, GRAVITAS suggests defenses to the system using an optimization process that lowers the risk score at minimum cost – ¶ 0058 - 7) Can find "the weakest link" (most vulnerable
part of the system) ).
However, Brown does not explicitly teach that the security visualization is a posture visualization
Napper teaches
A posture visualization ( ¶ 0070 - FIG. 4 shows a visualization interface 400 comprising a representation of the attack path visualization 300, in accordance with one or more embodiments. Specifically, FIG. 4 illustrates an example embodiment of a security posture graph modified by one or more user visualization commands 278 indicating a view selection, a time selection, a data type selection, a region selection, and a vulnerability (e.g., risk tolerance level 222) selection. The visualization interface 400 comprises an overview of any impacted assets 320 and corresponding vulnerabilities 410, which are shown to comprise three attack vectors 192, twelve attack paths 155, six services, and four sensitive asset groups 272 or categories. In some embodiments, the visualization interface 400 may be generated based on a particular view, a particular time period (e.g., last 1 month), a data type, a region, a vulnerability, and the like [0072] FIG. 5 shows a visualization interface 500 comprising a representation of the attack path visualization 300, in accordance with one or more embodiments. Specifically, FIG. 5 illustrates an example embodiment of a security posture diagram modified by one or more user visualization commands 278 indicating a view selection, a time selection, a data type selection, a region selection, and a vulnerability (e.g., risk tolerance level 222) selection. The visualization interface 500 comprises an overview of any impacted assets 320 and corresponding vulnerabilities 410, which are shown to comprise twelve attack vectors 192 and thirty attack paths 155. In some embodiments, the visualization interface 400 may be generated based on a particular view, a particular time period (e.g., last 1 month), a data type, a region, a vulnerability, and the like. The visualization interface 500 may comprise twelve attack techniques 510, three attack types 530, and three severity levels 540.)
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Brown to include the teachings of Napper. The motivation for doing so is to allow the system to map attack paths in a visualization interface (Napper– Abstract).
Regarding claim 8,
Brown further teaches
generating a security [..] visualization associated with the computing environment, wherein the security [..] visualization comprises one or more attack paths; and communicating the security [..] visualization comprising the one or more attack paths (¶ 0082 -. By giving an administrator the ability to visualize and mitigate IoT/CPS exploits before the system is deployed, GRAVITAS hopes to prevent the next Mirai-like attack before it happens – ¶ 0042 - With an
IoT/CPS configuration and threat model as input, and a list of the most cost-effective defenses as output, GRAVITAS presents a security model that allows the system administrator to discover new attack vectors and proactively configure
secure IoT/CPS both pre- and post-deployment.) .
However, Brown does not explicitly teach
receiving a request for the security posture of the computing environment; generating a security posture visualization associated with the computing environment, wherein the security posture visualization comprises one or more attack paths; and communicating the security posture visualization comprising the one or more attack paths
Napper teaches
receiving a request for the security posture of the computing environment; generating a security posture visualization associated with the computing environment, wherein the security posture visualization comprises one or more attack paths; and communicating the security posture visualization comprising the one or more attack paths ( ¶ 0016 - In some cases, in conjunction with determining the first attack path connecting the first vulnerable assets, the processor may obtain multiple user visualization commands from a user device and map the first attack path to the application layers and the first security parameters in the visual interface based at least in part upon the user visualization commands ¶ 0070 - FIG. 4 shows a visualization interface comprising a representation of the attack path visualization 300, in accordance with one or more embodiments. Specifically, FIG. 4 illustrates an example embodiment of a security posture graph modified by one or more user visualization commands indicating a view selection, a time selection, a data type selection, a region selection, and a vulnerability (e.g., risk tolerance level) selection. The visualization interface comprises an overview of any impacted assets and corresponding vulnerabilities, which are shown to comprise three attack vectors , twelve attack paths, six services, and four sensitive asset groups or categories. In some embodiments, the visualization interface may be generated based on a particular view, a particular time period, a data type, a region, a vulnerability, and the like [0072] FIG. 5 shows a visualization interface comprising a representation of the attack path visualization 300, in accordance with one or more embodiments. Specifically, FIG. 5 illustrates an example embodiment of a security posture diagram modified by one or more user visualization commands indicating a view selection, a time selection, a data type selection, a region selection, and a vulnerability selection. The visualization interface comprises an overview of any impacted assets 320 and corresponding vulnerabilities, which are shown to comprise twelve attack vectors and thirty attack paths. In some embodiments, the visualization interface may be generated based on a particular view, a particular time period (e.g., last 1 month), a data type, a region, a vulnerability, and the like. The visualization interface 500 may comprise twelve attack techniques 510, three attack types 530, and three severity levels 540. – See ¶ 0059,¶ 0060)
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Brown to include the teachings of Napper. The motivation for doing so is to allow the system to map attack paths in a visualization interface (Napper– Abstract).
Regarding claim 9,
Brown further teaches
receiving a security [..]visualization associated with the computing environment, wherein the security visualization is associated with one or more attack path; and causing display of the security visualization comprising the one or more attack for the computing environment paths (¶ 0082 -. By giving an administrator the ability to visualize and mitigate IoT/CPS exploits before the system is deployed, GRAVITAS hopes to prevent the next Mirai-like attack before it happens – ¶ 0042 - With an IoT/CPS configuration and threat model as input, and a list of the most cost-effective defenses as output, GRAVITAS presents a security model that allows the system administrator to discover new attack vectors and proactively configure secure IoT/CPS both pre- and post-deployment.) .
However, Brown does not explicitly teach the posture security visualization
communicating a request for security posture associated with a computing environment; based on the request, receiving a security posture visualization associated with the computing environment, wherein the security posture visualization is associated with one or more attack path; and causing display of the security visualization comprising the one or more attack for the computing environment
Napper teaches
communicating a request for security posture associated with a computing environment; based on the request, receiving a security posture visualization associated with the computing environment, wherein the security posture visualization is associated with one or more attack path; and causing display of the security visualization comprising the one or more attack for the computing environment ( ¶ 0016 - In some cases, in conjunction with determining the first attack path connecting the first vulnerable assets, the processor may obtain multiple user visualization commands from a user device and map the first attack path to the application layers and the first security parameters in the visual interface based at least in part upon the user visualization commands ¶0070 - FIG. 4 shows a visualization interface comprising a representation of the attack path visualization, in accordance with one or more embodiments. Specifically, FIG. 4 illustrates an example embodiment of a security posture graph modified by one or more user visualization commands indicating a view selection, a time selection, a data type selection, a region selection, and a vulnerability selection. The visualization interface comprises an overview of any impacted assets and corresponding vulnerabilities, which are shown to comprise three attack vectors, twelve attack paths, six services, and four sensitive asset groups or categories. In some embodiments, the visualization interface may be generated based on a particular view, a particular time period, a data type, a region, a vulnerability, ¶0072 FIG. 5 shows a visualization interface comprising a representation of the attack path visualization, in accordance with one or more embodiments. Specifically, FIG. 5 illustrates an example embodiment of a security posture diagram modified by one or more user visualization commands indicating a view selection, a time selection, a data type selection, a region selection, and a vulnerability selection. The visualization interface comprises an overview of any impacted assets and corresponding vulnerabilities, which are shown to comprise twelve attack vectors and thirty attack paths. In some embodiments, the visualization interface may be generated based on a particular view, a particular time period, a data type, a region, a vulnerability, and the like. The visualization interface may comprise twelve attack techniques, three attack types, and three severity levels. – See ¶ 0059,¶ 0060)
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Brown to include the teachings of Napper. The motivation for doing so is to allow the system to map attack paths in a visualization interface (Napper– Abstract).
Claims 7,20 are rejected under 35 U.S.C. 103 as being unpatentable over Brown in view of Phillips further in view of Neupane et al. Publication No. US 2025/0131098 A1 ( Neupane hereinafter)
Regarding claim 7,
Brown does not explicitly teach
accessing an updated version of the computing environment graph; using the attack path computation model and the updated version of the computing environment graph, identify a second plurality of attack paths for the computing environment; communicate the second plurality of attack paths for the computing environment
However, Neupane teaches
accessing an updated version of the computing environment graph; using the attack path computation model and the updated version of the computing environment graph, identify a second plurality of attack paths for the computing environment; communicate the second plurality of attack paths for the computing environment (¶ 0022 - At stage C, the graph analyzer 110 analyzes the graph 108 to discover and rank attack paths. The graph analyzer 110 discovers attack paths in the graph 108 and ranks the discovered attack paths. To discover attack paths, the graph analyzer 110 can traverse the graph 108 from source nodes corresponding to identities and/or sink nodes corresponding to resources that can host assets. The graph analyzer 110 can analyze the graph 110 according to configured parameters. For example, a configuration file can be maintained that identifies resources that host sensitive and/or high-value assets. The graph analyzer 110 ranks the discovered attack paths based on the weights assigned to the nodes and edges of the discovered attack paths. The graph analyzer 110 can then provide the discovered information as an alert or notification, for example. As the graph 108 may be updated periodically and/or based on detected events (e.g., addition of a resource), the analysis can be triggered after each update. such as a defined JavaScript® Object Notation (JSON) object. As another example, the graph analyzer 110 returns the extracted information in an in-memory data structure that the query interface 109 uses to generate a response for presentation (e.g., a notification, a visualization, etc.)
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Brown to include the teachings of Neupane. The motivation for doing so is to allow the system to parse policies and builds a resource access graph that represents entities and analyzes the graph to detect resource access paths that are potential attack paths (Neupane – ¶ 0017).
Regarding claim 20,
Brown does not explicitly teach
accessing an updated version of the computing environment graph; using the attack path computation model and the updated version of the computing environment graph, identify a second plurality of attack paths for the computing environment; communicate the second plurality of attack paths for the computing environment
However, Neupane teaches
accessing an updated version of the computing environment graph; using the attack path computation model and the updated version of the computing environment graph, identify a second plurality of attack paths for the computing environment; communicate the second plurality of attack paths for the computing environment (¶ 0022 - At stage C, the graph analyzer 110 analyzes the graph 108 to discover and rank attack paths. The graph analyzer 110 discovers attack paths in the graph 108 and ranks the discovered attack paths. To discover attack paths, the graph analyzer 110 can traverse the graph 108 from source nodes corresponding to identities and/or sink nodes corresponding to resources that can host assets. The graph analyzer 110 can analyze the graph 110 according to configured parameters. For example, a configuration file can be maintained that identifies resources that host sensitive and/or high-value assets. The graph analyzer 110 ranks the discovered attack paths based on the weights assigned to the nodes and edges of the discovered attack paths. The graph analyzer 110 can then provide the discovered information as an alert or notification, for example. As the graph 108 may be updated periodically and/or based on detected events (e.g., addition of a resource), the analysis can be triggered after each update. such as a defined JavaScript® Object Notation (JSON) object. As another example, the graph analyzer 110 returns the extracted information in an in-memory data structure that the query interface 109 uses to generate a response for presentation (e.g., a notification, a visualization, etc.)
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Brown to include the teachings of Neupane. The motivation for doing so is to allow the system to parse policies and builds a resource access graph that represents entities and analyzes the graph to detect resource access paths that are potential attack paths (Neupane – ¶ 0017).
Claims 11-15 are rejected under 35 U.S.C. 103 as being unpatentable over Napper in view of Brown further in view of Phillips.
Regarding claim 11,
Napper teaches one or more computer-storage media having computer-executable instructions embodied thereon that, when executed by a computing system having a processor and memory, cause the processor to perform operations, the operations comprising:
communicating a request for security posture associated with a computing environment; based on the request, receiving a security posture visualization associated with the computing environment, wherein the security posture visualization is associated with one or more attack path, the one or more attack paths are associated with an attack path discovery computation model supports automatically discovering attack paths for computing environments associated with computing environment graphs; and causing display of the posture security visualization comprising the one or more attack paths for the computing environment( ¶ 0016 - In some cases, in conjunction with determining the first attack path connecting the first vulnerable assets, the processor may obtain multiple user visualization commands from a user device and map the first attack path to the application layers and the first security parameters in the visual interface based at least in part upon the user visualization commands ¶ 0070 - FIG. 4 shows a visualization interface comprising a representation of the attack path visualization, in accordance with one or more embodiments. Specifically, FIG. 4 illustrates an example embodiment of a security posture graph modified by one or more user visualization commands indicating a view selection, a time selection, a data type selection, a region selection, and a vulnerability selection. The visualization interface comprises an overview of any impacted assets and corresponding vulnerabilities, which are shown to comprise three attack vectors, twelve attack paths, six services, and four sensitive asset groups or categories. the visualization interface may be generated based on a particular view, a particular time period, a data type, a region, a vulnerability, and the like ¶ 0072 -FIG. 5 shows a visualization interface comprising a representation of the attack path visualization, in accordance with one or more embodiments. Specifically, FIG. 5 illustrates an example embodiment of a security posture diagram modified by one or more user visualization commands indicating a view selection, a time selection, a data type selection, a region selection, and a vulnerability selection. The visualization interface comprises an overview of any impacted assets and corresponding vulnerabilities, which are shown to comprise twelve attack vectors and thirty attack paths, The visualization interface may be generated based on a particular view, a particular time period, a data type, a region, a vulnerability, and the like. The visualization interface may comprise twelve attack techniques, three attack types 530, and three severity levels – See ¶ 0059,¶ 0060)
However, Napper does not explicitly teach
wherein the attack path discovery computation model is associated with an attack path discovery template that supports discovering the one or more attack paths, the attack path discovery template comprising: an entry point element that defines a starting node where an attacker gains initial access, an advancement step element that defines a conditional operation that enables attacker movement between nodes based on an authenticated connection or a privilege escalation condition, and a target element that defines an endpoint node representing a critical computing asset identified by condition indicating sensitive or high-value data;
wherein discovering the one or more attack paths is based on graph-based constraints defined by the attack path discovery template, the graph-based constraints corresponding to the entry point element, the advancement step element, and the target element, and wherein the attack path discovery computation model applies the graph- based constraints to the computing environment graph to evaluate satisfaction of conditions associated with the entry point element, the advancement step element, and the target element to identify the one or more attack paths;
Brown teaches
wherein the attack path discovery computation model is associated with an attack path discovery template that supports discovering the one or more attack paths, the attack path discovery template ( ¶ 0041 – ¶ 0042 -disclosed herein are embodiments for a comprehensive risk management system, referred to herein as GRAVITAS, for IoT/CPS that can identify undiscovered attack vectors and optimize the placement of defenses within the system for optimal performance and cost. While existing risk management systems consider only known attacks, embodiments of the disclosed model employ a graphical approach to extrapolate undiscovered exploits, enabling identification of attacks overlooked by manual penetration testing (pen-testing). The model is flexible enough to analyze practically any IoT/CPS and provide the system administrator with a concrete list of suggested defenses that can reduce system vulnerability at optimal cost. GRAVITAS can be employed by governments, companies, and system administrators to configure secure IoT/CPS at scale, providing a quantitative measure of security and efficiency in a world where IoT/CPS devices will soon be ubiquitous -With an IoT/CPS configuration and threat model as input, and a list of the most cost-effective defenses as output, GRAVITAS presents a security model that allows the system administrator to discover new attack vectors and proactively configure secure IoT/CPS both pre- and post-deployment – ¶ 0021 -FIG. 6 depicts a table of exploit goals in a master attack graph template according to an embodiment of the present invention – See Also ¶0089, ¶0091) . comprising:
an entry point element that defines a starting node where an attacker gains initial access (¶ 0070 -A: The nodes at which an adversary can access the system. These "entry nodes" are the starting points for any attack. They are also vulnerabilities (A c N). ).
an advancement step element that defines a conditional operation that enables attacker movement between nodes based on an authenticated connection or a privilege escalation condition ( ¶ 0063 -series of steps that begins at an "entry point" (a root node) and ends at a "goal" (a leaf node). The SHARKS attack graph, shown in FIG. 2 was created by deconstructing 41 known attacks on IoT/CPS into a series of steps represented by a vulnerability node chain (an exploit), and subsequently merging every node chain into a single directed acyclic graph (DAG). This graph makes no distinctions between network-level, hardware-level, or software level nodes: what matters is the procedure that brings attackers to their desired destination – ¶ 0099 – ¶ 0101 -. Permission Subgraphs: GRAVITAS allows the system administrator to specify permissions for every device. Unlike other attack graph models, the access permissions are each represented by a separate copy of a subgraph - Two different types of permissions are modeled: login permissions and execute command permissions. With a login permission, a user with the correct credentials can execute any (permitted) command on the system – See Also Claims 34 -35,¶ 0068).
a target element that defines an endpoint node representing a critical computing asset identified by condition indicating sensitive or high-value ( ¶ 0071 -The leaf nodes of the graph. These represent the completion of an attack (L c N). These "exploit goals" represent the end goal of an adversary's attack, such as "Disable device" or "DoS attack," as nonlimiting example ¶ 0072 -P: The set of nodes that constitute a complete attack vector. Each exploit begins at an entry node and concludes at an exploit goal node. More formally, an exploit Pis any ordered set of nodes in the form { a, n1 , ... , n1o I} where aEA, 11;EN, !EL. The same entry node and exploit goal pair can be a part of multiple attack vectors – ¶ 0128 - In FIG. 23, it is observed that the end result of the exploit is a DoS attack on the cloud server for the Google Home device. Its origin is a malware downloaded onto a laptop, which in tum instructs the Samsung fridge to flood the Google Home server with bogus traffic, thus launching a DoS attack.. GRAVITAS recognizes the importance of these vulnerabilities due to their crucial role in several attack vectors that lead to attack outcomes with high impact scores – See Fig.24 ) ;
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Napper to include the teachings of Brown. The motivation for doing so is to allow the system to detect security vulnerabilities in at least one of cyber-physical systems (CPSs) and Internet of Things (IoT) devices and optimize placement of defenses to reduce an adversary score of the aggregate attacks (Brown - Abstract).
Phillips teaches
wherein discovering the one or more attack paths is based on graph-based constraints defined by the attack path discovery template, the graph-based constraints corresponding to the entry point element, the advancement step element, and the target element, and wherein the attack path discovery computation model applies the graph- based constraints to the computing environment graph to evaluate satisfaction of conditions associated with the entry point element, the advancement step element, and the target element to identify the one or more attack paths (Abstract – Graph-based tool identifies set of attack paths that have a high probability of success for the attacker - The analysis system requires as input a database of common attacks, broken into atomic steps, specific network configuration and topology info, and an attacker profile. The attack information is "matched" with network configuration info and an attacker profile to create a superset attack graph. Nodes identify a stage of attack, e.g. the class of machines the attacker has accessed and the user privilege level he or she has compromised. The arcs in the attack graph represent attacks or stages of attacks Section 1 - attack templates represent pieces of known attacks or hypothesized methods of moving from one state to another, their combinations can lead to descriptions of new attacks. That is, any path in the attack graph represents an attack– Section 2.3- Attack templates represent generic steps in known attacks, including conditions which must hold for the attack to be possible. Each node in the attack template represents a state of an attack,. Edges in the attack template represent actions taken by the attacker. They indicate an event such as the detection of a particular type of packet on a network by hardware/software under attack control - Each edge has conditions on the users/machines, if all the conditions are met, the attack succeeds with a given probability and/or cost. The edges can be a function of configuration and attacker capability. State field breaks attacks into atomic pieces. An attack may require several steps, each of which could fall and none of which adds a new capability, vulnerability Section 3 - Start with the goal node: achievement of user-level access on machine M. The graph generator checks the database of attack templates and identifies all edges whose heads match the goal node-The goal node also matches the last node of the second template for physical access. Machine M matches the variable X and the instantiation function creates node N4, which in turn generates N5. the attacker does not have physical access to M. Thus, the nodes N4 and N5 are marked with a dotted line to show that under existing conditions, they would not be reachable from the start state - we could have generated an intermediate node for becoming root only on B rather than A or B. We recognize node N3 as a start node in this graph Section 4 - If one wishes to find only a single shortest path, representing the most likely or least-cost attack, from a start node to any number of goal nodes, then any standard shortest-path algorithm will suffice. See Also - Section 6).
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Napper in view of Brown to include the teachings of Phillips. The motivation for doing so is to allow the system utilize a graph based tool to identify set of attack paths that have a high probability of success for the attacker ( Phillips – Abstract) .
Regarding claim 12,
Napper does not explicitly teach
wherein the attack path discovery computation model further accesses the attack path discovery template comprising the entry point element, the advancement step element, and the target elements associated with corresponding conditions that are evaluated to identify the one or more paths.
However, Brown teaches
wherein the attack path discovery computation model further accesses the attack path discovery template comprising the entry point element, the advancement step element, and the target elements associated with corresponding conditions that are evaluated to identify the one or more paths (¶ 0043 - The novelty of the proposed methodology lies in at least the following: (0044] (1) An automated IoT/CPS-specific exploit discovery tool that includes potential vulnerabilities and attack vectors that have yet to be discovered – ¶ 0021 – ¶0022 - FIG. 6 depicts a table of exploit goals in a master attack graph template according to an embodiment of the present invention – ¶ 0063 - SHARKS eschews a rigid classification and models an exploit chain (attack vector) as it appears to an adversary: a series of steps that begins at an "entry point" (a root node) and ends at a "goal" (a leaf node). ¶ 0070 - The nodes at which an adversary can access the system. These "entry nodes" are the starting points for any attack. They are also vulnerabilities (A c N). ¶ 0071-0072 - The leaf nodes of the graph. These represent the completion of an attack (L c N). These "exploit goals" represent the end goal of an adversary's attack, such as "Disable device" or "DoS attack – ¶ 0042 - These attack vectors are then assigned risk scores according to a probabilistic method that models the interaction between attack impacts and the graph's vulnerabilities. – ¶ 0082 - GRAVITAS solves this issue by creating a unique attack DAG for every device in an IoT/CPS and adding additional pathways between devices based on network topology).
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Napper to include the teachings of Brown. The motivation for doing so is to allow the system to detect security vulnerabilities in at least one of cyber-physical systems (CPSs) and Internet of Things (IoT) devices and optimize placement of defenses to reduce an adversary score of the aggregate attacks (Brown - Abstract).
Regarding claim 13,
Napper does not explicitly teach
wherein the attack path discovery model is operable on a plurality of computing environment based on traversing corresponding computing environment graphs that include set of nodes and set of edges representing computing components and features of corresponding computing environments
However, Brown teaches
wherein the attack path discovery model is operable on a plurality of computing environment based on traversing corresponding computing environment graphs that include set of nodes and set of edges representing computing components and features of corresponding computing environments (¶0041 - Internet-of-Things (IoT) and cyber-physical systems (CPSs) may include thousands of devices connected in a complex network topology - the disclosed model employ a graphical approach to extrapolate undiscovered exploits, enabling identification of attacks overlooked by manual penetration testing (pen-testing). The model is flexible enough to analyze practically any IoT/CPS and provide the system administrator with a concrete list of suggested defenses that can reduce system vulnerability at optimal cost – ¶ 0067 -¶0068 -The set of nodes in the graph. Each node represents a single vulnerability in the system, such as "sensor tampering" or "no SSL pinning," as nonlimiting examples. E: The set of edges in the graph. Edges represent exploits, or pathways between vulnerabilities. Unlike in other attack graph models, edges do not have an access control parameter; each edge instead represents a possible path between vulnerabilities. Different permissions are instead represented by different nodes – Abstract - generate an aggregate attack DAG from a classification of each device and a location of each device in network topology specified by a system administrator).
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Napper to include the teachings of Brown. The motivation for doing so is to allow the system to detect security vulnerabilities in at least one of cyber-physical systems (CPSs) and Internet of Things (IoT) devices and optimize placement of defenses to reduce an adversary score of the aggregate attacks (Brown - Abstract).
Regarding claim 14,
Napper further teaches
receiving the request for the security posture of the computing environment; generating the security posture visualization associated with the computing environment, wherein the security posture visualization comprises one or more attack paths; and communicating the security posture visualization comprising the one or more attack paths( ( ¶ 0016 - In some cases, in conjunction with determining the first attack path connecting the first vulnerable assets, the processor may obtain multiple user visualization commands from a user device and map the first attack path to the application layers and the first security parameters in the visual interface based at least in part upon the user visualization commands ¶ 0070 - FIG. 4 shows a visualization interface comprising a representation of the attack path visualization, in accordance with one or more embodiments. Specifically, FIG. 4 illustrates an example embodiment of a security posture graph modified by one or more user visualization commands indicating a view selection, a time selection, a data type selection, a region selection, and a vulnerability selection. The visualization interface comprises an overview of any impacted assets and corresponding vulnerabilities, which are shown to comprise three attack vectors, twelve attack paths, six services, and four sensitive asset groups or categories. In some embodiments, the visualization interface may be generated based on a particular view, a particular time period, a data type, a region, a vulnerability, and the like ¶ 0072 -FIG. 5 shows a visualization interface comprising a representation of the attack path visualization, in accordance with one or more embodiments. Specifically, FIG. 5 illustrates an example embodiment of a security posture diagram modified by one or more user visualization commands indicating a view selection, a time selection, a data type selection, a region selection, and a vulnerability selection. The visualization interface comprises an overview of any impacted assets and corresponding vulnerabilities, which are shown to comprise twelve attack vectors and thirty attack paths. In some embodiments, the visualization interface may be generated based on a particular view, a particular time period, a data type, a region, a vulnerability, and the like. The visualization interface may comprise twelve attack techniques, three attack types, and three severity levels 540. – See ¶ 0059,¶ 0060).
Regarding claim 15,
Napper further teaches
receiving an indication to execute a remediation action associated with an attack path associated with the security visualization; and executing the remediation action (¶0025 – In another example, another technical advantage of one embodiment may identify critical threats detected by the attack path analysis, prioritize these threats, and provide detailed guidance enabling remediation actions to mitigate, reduce, or eliminate the threats. These are particularly important to prevent, reduce, or eliminate coordinated cyberattacks – Para 0012 - The visual representation may map the vulnerable assets in an attack path comprising one or more indicators associating the vulnerable assets with one
another and remediations for preventing attacks via the attack path. Further, the visual representation may provide multiple indicators that show a level of priority of a vulnerable asset in the attack path and remediation costs of each vulnerable asset The system and the method may generate remediation techniques for the filtered assets.).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's amendments.
Phillips et al. “ computer -Attach Graph generation tool”
Kaynar et al. “Distributed Attack Graph Generation”
Any inquiry concerning this communication or earlier communications from the examiner should be directed to YOUNES NAJI whose telephone number is (571)272-2659. The examiner can normally be reached Monday - Friday 8:30 AM -5:30 PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Oscar A Louie can be reached on (571) 270-1684. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/YOUNES NAJI/Primary Examiner, Art Unit 2445
Prosecution Insights