Abstract: Implementations of the present disclosure include receiving analytical attack graph data representative of an analytical attack graph, the analytical attack graph including: one or more rule nodes each representing a network configuration rule; and one or more impact nodes each representing an impact of one or more respective network configuration rules; converting the analytical attack graph to a tactic graph including one or more tactic nodes, each tactic node representing at least one rule node and at least one impact node; determining one or more paths of the tactic graph that lead to a particular network impact; generating a process model based on the paths that lead to the particular network impact, the process model representing network activity for execution of a process that leads to the particular network impact; and executing one or more remedial actions based on the process model to mitigate cyber-security risk to the enterprise network.

Abstract: Implementations include evaluating a first sub-set of rules based on a first sub-set of facts to provide a first set of impacts, evaluating including applying the first sub-set of facts to each rule using a hash join operation to determine whether a rule results in an impact, indexes of arguments of facts being used in a probe phase of the hash join operation, evaluating a second sub-set of rules using impacts of the first set of impacts to provide a second set of impacts, determining whether each goal in a set of goals has been achieved using the first set of impacts and the second set of impacts, each goal being provided as an impact, in response to determining that each goal in the set of goals has been achieved, removing paths of the AAG, each of the paths resulting in an impact that is not a goal.

Abstract: Implementations include receiving an AAG that at least partially defines a digital twin of an enterprise network and includes rule nodes each representing an attack tactic that can be used to move along a path, determining security controls each mitigating at least one rule node, executing an iteration of a simulation of a sub-set of security controls in the enterprise network, the iteration including: for each security control in the set of security controls, determining, an influence score that represents a change in a security risk from implementing the security control and a rule distribution, defining the sub-set of security controls based on the first influence scores, and reducing the AAG based on the sub-set of security controls to provide a residual AAG, determining a decrease in a graph risk value and the first AAG, and selectively implementing the sub-set of security controls in the enterprise network.

Abstract: Implementations include a computer-implemented method for mitigating cyber security risk of an enterprise network, the method comprising: receiving an analytical attack graph (AAG) representing paths within the enterprise network with respect to at least one target asset, the AAG defining a digital twin of the enterprise network and comprising a set of rule nodes, each rule node representing an attack tactic that can be used to move along a path of the AAG; integrating the AAG with a knowledge graph comprising a set of asset nodes, each asset node representing a digital asset that can be affected by one or more of the attack tactics; determining, based on integrating the AAG with the knowledge graph, a plurality of security controls, each security control having an assigned priority value; and selectively implementing the security controls in the enterprise network based on the assigned priority values of the security controls.

Abstract: Implementations of the present disclosure include receiving analytical attack graph data representative of an analytical attack graph, the analytical attack graph including: one or more rule nodes each representing a network configuration rule; and one or more impact nodes each representing an impact of one or more respective network configuration rules; converting the analytical attack graph to a tactic graph including one or more tactic nodes, each tactic node representing at least one rule node and at least one impact node; determining one or more paths of the tactic graph that lead to a particular network impact; generating a process model based on the paths that lead to the particular network impact, the process model representing network activity for execution of a process that leads to the particular network impact; and executing one or more remedial actions based on the process model to mitigate cyber-security risk to the enterprise network.

Abstract: Implementations include evaluating a first sub-set of rules based on a first sub-set of facts to provide a first set of impacts, evaluating including applying the first sub-set of facts to each rule using a hash join operation to determine whether a rule results in an impact, indexes of arguments of facts being used in a probe phase of the hash join operation, evaluating a second sub-set of rules using impacts of the first set of impacts to provide a second set of impacts, determining whether each goal in a set of goals has been achieved using the first set of impacts and the second set of impacts, each goal being provided as an impact, in response to determining that each goal in the set of goals has been achieved, removing paths of the AAG, each of the paths resulting in an impact that is not a goal.

Abstract: Implementations include evaluating a first sub-set of rules based on a first sub-set of facts to provide a first set of impacts, evaluating including applying the first sub-set of facts to each rule using a hash join operation to determine whether a rule results in an impact, indexes of arguments of facts being used in a probe phase of the hash join operation, evaluating a second sub-set of rules using impacts of the first set of impacts to provide a second set of impacts, determining whether each goal in a set of goals has been achieved using the first set of impacts and the second set of impacts, each goal being provided as an impact, in response to determining that each goal in the set of goals has been achieved, removing paths of the AAG, each of the paths resulting in an impact that is not a goal.

Abstract: This document describes knowledge graph systems that determine cardinal nodes in a knowledge graph that provide the most impact on target nodes of a system and improves the system by adjusting the impact of the actual elements represented by the cardinal nodes. In one aspect, a method includes obtaining a knowledge graph that represents a given system and that includes multiple nodes that each represent an element of the given system. One or more target nodes are identified in the knowledge graph based on a value parameter for each node in the knowledge graph. A cardinal value that represents an impact that the node has on the one or more target nodes is determined for each node in the knowledge graph. A priority order of the nodes is determined for improvement based on the cardinal values. Data indicating one or more of the nodes is provided based on the order.

Abstract: Implementations include evaluating a first sub-set of rules based on a first sub-set of facts to provide a first set of impacts, evaluating including applying the first sub-set of facts to each rule using a hash join operation to determine whether a rule results in an impact, indexes of arguments of facts being used in a probe phase of the hash join operation, evaluating a second sub-set of rules using impacts of the first set of impacts to provide a second set of impacts, determining whether each goal in a set of goals has been achieved using the first set of impacts and the second set of impacts, each goal being provided as an impact, in response to determining that each goal in the set of goals has been achieved, removing paths of the AAG, each of the paths resulting in an impact that is not a goal.

Abstract: Implementations include receiving an AAG that at least partially defines a digital twin of an enterprise network and includes rule nodes each representing an attack tactic that can be used to move along a path, determining security controls each mitigating at least one rule node, executing an iteration of a simulation of a sub-set of security controls in the enterprise network, the iteration including: for each security control in the set of security controls, determining, an influence score that represents a change in a security risk from implementing the security control and a rule distribution, defining the sub-set of security controls based on the first influence scores, and reducing the AAG based on the sub-set of security controls to provide a residual AAG, determining a decrease in a graph risk value and the first AAG, and selectively implementing the sub-set of security controls in the enterprise network.