Attack Path Modeling Research

It is well known that the cyber security industry is both talent and resource starved. It is therefore critical that cyber security blue teams prioritize the defense of their networks to ensure maximum protection per unit cost. While red teams can provide insight into where effort and resource should be most immediately applied, the exercises themselves are often costly, nonexhaustive and infrequently run.

In this paper, the Attack Path modeling (APM) module of the Darktrace Prevent Framework is outlined. This technology sits at the core of the Darktrace Prevent product family, offering a real-time, automated, dual-aspect, multi-data-source, end-to-end attack-path-modeling capability. This module in particular, is designed to give blue teams a comprehensive view of realistic, risk-prioritized attack paths so that resources can be best allocated to defend key assets. As a proactive risk-reducing approach, this technology builds on Darktrace Self-Learning AI, an “engine” that produces continuously updated data for all assets across the entire digital domain.

In this paper, the internal aspect of the network takes the primary focus. Greater detail on other areas of the Darktrace Prevent product family will be discussed in separate, forthcoming literature.