System and method for assessing the security posture of a network using goal oriented fuzzy logic decision rules

Claim 3

A method according to claim 1 , and further comprising the step of exporting only the required data from the system object model database via filters associated with respective network vulnerability programs.

Claim 4

A method according to claim 1 , and further comprising the step of exporting the system object model database to the network vulnerability analysis programs via an integrated application programming interface.

Claim 5

A method according to claim 1 , and further comprising the step of modeling the network as a map on a graphical user interface.

Claim 6

A method according to claim 1 , and further comprising the step of establishing a class hierarchy to define components of the network vulnerability analysis programs that share common data and programming traits.

Claim 7

A method according to claim 1 , and further comprising the step of running the network vulnerability analysis programs to obtain data results pertaining to network system details, network topologies, node level vulnerabilities and network level vulnerabilities.

Claim 10

A method according to claim 7 , and further comprising the step of applying the fuzzy logic decision rules based on evidential reasoning.

Claim 11

A method according to claim 7 , and further comprising the step of exporting only the required data via filters associated with respective network vulnerability programs.

Claim 12

A method according to claim 7 , and further comprising the step of exporting the system object model database to the network vulnerability analysis programs via an integrated application programming interface.

Claim 13

A method according to claim 7 , and further comprising the step of modeling the network as a map on a graphical user interface.

Claim 14

A method according to claim 7 , and further comprising the step of establishing a class hierarchy to define components of the disparate network vulnerability analysis programs that share common data and programming traits.

Claim 15

A method according to claim 7 , and further comprising the step of running the network vulnerability analysis programs to obtain data results pertaining to network system details, network topologies, node level vulnerabilities and network level vulnerabilities.

Claim 16

A computer program that resides on a medium that can be read by a program, wherein the computer program comprises instructions to cause a computer to create a system object model database representing a network, wherein the system object model database supports the information data requirements of separate, non-integrated network vulnerability analysis programs; export only the required data from the system object model database representing the network to each respective network vulnerability analysis program; analyze the network with each network vulnerability analysis program to produce data results from each program; store the results from respective network vulnerability analysis programs and the common system model database within a data fact base; and apply goal oriented fuzzy logic decision rules to the data fact base to determine the security posture of the network.

Claim 17

A computer program that resides on a medium that can be read by a program, wherein the computer program comprises instructions to cause a computer to create a system object model database representing a network, wherein the system object model database supports the information data requirements of separate, non-integrated network vulnerability analysis programs; export only the required data from the system object model database representing the network to each respective network vulnerability analysis program; analyze the network with each network vulnerability analysis program to produce data results from each program; store the results from respective network vulnerability analysis programs and the common system model database within a data fact base; and apply goal oriented fuzzy logic decision rules to the data fact base to determine the security posture of the network.

Claim 18

A computer program according to claim 14 , and further comprising instructions for applying the fuzzy logic decision rules by the use of a plurality of fuzzy expert rules to merge results from the network vulnerability analysis programs.

Claim 19

A computer program according to claim 14 , and further comprising instructions for applying the fuzzy logic decision rules based on evidential reasoning.

Claim 20

A computer program according to claim 14 , and further comprising instructions for exporting only the required data via filters associated with respective network vulnerability programs.

Claim 21

A computer program according to claim 14 , and further comprising instructions for importing the system object model database to the network vulnerability analysis programs via an integrated application programming interface.

Claim 22

A computer program according to claim 14 , and further comprising instructions for modeling the network as a map on a graphical user interface.

Claim 23

A computer program according to claim 14 , and further comprising instructions for establishing a class hierarchy to define components of the network vulnerability analysis programs that share common data and programming traits.

Claim 24

A computer program according to claim 14 , and further comprising instructions for running the network vulnerability analysis programs to obtain data results pertaining to network system details, network topologies, node level vulnerabilities and network level vulnerabilities.

Claim 25

A data processing system for assessing the security posture of a network comprising: a plurality of separate, non-integrated network vulnerability analysis programs used for analyzing a network; a system object model database that represents the network to be analyzed, wherein the system object model database supports the information data requirements of the network vulnerability analysis programs; an applications programming interface for importing the system object model database of the network to the network vulnerability analysis programs; a filter associated with the applications programming interface and each respective network vulnerability analysis program for filtering data from the system object model database and importing only the required data; a data fact base for storing the results obtained from respective network vulnerability analysis programs after analyzing the network and the common system model database; and a fuzzy logic processor for applying goal oriented fuzzy logic decision rules to the fact database by the use of a plurality of fuzzy expert rules for merging results from the network vulnerability analysis programs and determining the security posture of the network.

Claim 26

A data processing system for assessing the security posture of a network comprising: a plurality of separate, non-integrated network vulnerability analysis programs used for analyzing a network; a system object model database that represents the network to be analyzed, wherein the system object model database supports the information data requirements of the network vulnerability analysis programs; an applications programming interface for importing the system object model database of the network to the network vulnerability analysis programs; a filter associated with the applications programming interface and each respective network vulnerability analysis program for filtering data from the system object model database and importing only the required data; a data fact base for storing the results obtained from respective network vulnerability analysis programs after analyzing the network and the common system model database; and a fuzzy logic processor for applying goal oriented fuzzy logic decision rules to the fact database by the use of a plurality of fuzzy expert rules for merging results from the network vulnerability analysis programs and determining the security posture of the network.

Claim 27

A data processing system according to claim 22 , wherein the fuzzy logic decision rules are based on evidential reasoning.

Claim 28

A data processing system according to claim 22 , wherein the applications programming interface for exporting the system object model database comprises a graphical user interface.

Claim 29

A data processing system according to claim 22 , and further comprising a graphical user interface that models the network as a map.

Claim 30

A data processing system according to claim 22 , and further comprising a graphical user interface for displaying the security posture of the network.

Claim 31

A data processing system according to claim 22 , wherein the database further comprises an object oriented class hierarchy to define components of the network vulnerability analysis programs that share common data and programming traits.