Abstract: Disclosed are techniques for determining the probability that a computing resource will be compromised during a cyberattack. In some configurations, a collection of computing resources is modeled with a resource graph. Computing resources are represented by nodes while connections between computing resources are represented by edges. Random walks are performed through the resource graph. Different random walk algorithms may be applied to identify different properties of the resource graph. For example, nodes that are visited frequently by the random walks may correspond to computing resources that are likely to be compromised during a cyberattack. Various security operations may be performed in response to determining that a computing resource is likely to be compromised, including increased security measures, introduction of honeypots or honeytokens, sending or prioritizing security alerts, etc.

Abstract: Systems, methods, and techniques are directed to reducing cardinality in graphs of network-based computer systems. In an example, a graph representative of resources in the network-based computer system is generated. The graph comprises nodes representative of resources and edges between nodes representative of relationships between respective nodes. A level of structural similarity between first and second nodes to satisfy a structural similarity criterion. The first and second nodes are grouped in a grouped node, resulting in a modified graph. A security vulnerability of the computer system is identified based on the modified graph. Performance of a mitigation step with respect to the security vulnerability is caused. In another aspect, an edge associated with the first node is grouped in a grouped edge with an edge associated with the second node. In another aspect, a grouped node is grouped with another grouped node as a parent grouped node.

Abstract: Techniques are described herein that are capable of performing a security action based on an AI-determined intent and/or impact of a resource in an enterprise. A security alert regarding an identified resource of an enterprise is received. Intents of subsets of information regarding a software application utilized by the enterprise are determined using an AI model. The intents are mapped to subsets of resources in the enterprise and/or the AI model is used to determine impacts of the subsets of the resources on the enterprise. In response to the security alert, a security action is performed with regard to the identified resource as a result of an intent and/or impact associated with the identified resource satisfying an action criterion associated with the security action.