20240056470. METHOD FOR GENERATING ATTACK GRAPHS BASED ON MARKOV CHAINS simplified abstract (AttackIQ, Inc.)
METHOD FOR GENERATING ATTACK GRAPHS BASED ON MARKOV CHAINS
Organization Name
Inventor(s)
Stephen Lincoln of San Diego CA (US)
Rajesh Sharma of San Diego CA (US)
Jeremy Miller of San Diego CA (US)
Stephan Chenette of San Diego CA (US)
Albert Lopez of San Diego CA (US)
METHOD FOR GENERATING ATTACK GRAPHS BASED ON MARKOV CHAINS - A simplified explanation of the abstract
This abstract first appeared for US patent application 20240056470 titled 'METHOD FOR GENERATING ATTACK GRAPHS BASED ON MARKOV CHAINS
Simplified Explanation
The method described in the abstract involves using a hidden Markov model to analyze a sequence of observations and determine the most probable sequence of techniques that will result in the absence of detection or prevention of those techniques.
- Transition probability matrix defines probabilities of transitioning between techniques
- Emission probability vectors represent probabilities of detecting and preventing techniques
- Initial technique vector represents initial probability distribution of techniques
- Hidden Markov model correlates observations with techniques based on probabilities
- Calculates sequence of techniques with highest probability of avoiding detection or prevention
Potential Applications
- Cybersecurity
- Intrusion detection
- Fraud detection
Problems Solved
- Identifying and preventing malicious activities
- Improving security measures
- Enhancing threat detection capabilities
Benefits
- Increased accuracy in predicting and preventing threats
- Efficient utilization of resources
- Enhanced security measures
Original Abstract Submitted
a method includes: generating a transition probability matrix defining a set of transition probabilities for a set of techniques, each transition probability representing a probability of transitioning from a technique i to a technique j; defining a set of emission probability vectors corresponding to the set of techniques, each emission probability vector representing a probability of detecting a technique i and a probability of preventing a technique i; defining an initial technique vector representing an initial probability distribution of techniques; generating a hidden markov model correlating a target sequence of observations with a hidden state sequence of techniques based on the transition probability matrix, the set of emission probability vectors, and the initial technique vector; and calculating a sequence of techniques, based on the hidden markov model, exhibiting greatest probability to yield, for each technique in the sequence of techniques, absence of detection or prevention of the technique.
