Automatic Generation of Host-Based Network Attack Graph

Attack graphs are important tools for analyzing security vulnerabilities in enterprise networks. Previous work on attack graphs has not provided an account of the scalability of the graph generating process, and there is often a lack of logical formalism in the representation of attack graphs, which results in the attack graph being difficult to use and understand by human beings. Pioneer work by Sheyner, et al. is the first attack-graph tool based on formal logical techniques, namely model-checking. However, when applied to moderate-sized networks, Sheyner's tool encountered a significant exponential explosion problem. This paper describes a new approach to represent and generate attack graphs. We propose logical attack graphs, which directly illustrate logical dependencies among attack goals and configuration information. A logical attack graph always has size polynomial to the network being analyzed. Our attack graph generation tool builds upon MulVAL, a network security analyzer based on logical programming. We demonstrate how to produce a derivation trace in the MulVAL logic-programming engine, and how to use the trace to generate a logical attack graph in quadratic time. We show experimental evidence that our logical attack graph generation algorithm is very efficient. We have generated logical attack graphs for fully connected networks of 1000 machines using a Pentium 4 CPU with 1GB of RAM.

As computer networks continue to grow, it becomes increasingly more important to automate the process of evaluating their vulnerability to attacks. Despite the best efforts of software architects and developers, network hosts inevitably contain a number of vulnerabilities. Hence, it is not feasible for a network administrator to remove all vulnerabilities present in the network hosts. Therefore, the recent focus in security of such networks is on analysis of vulnerabilities globally, finding exploits that are more critical, and preventing them to thwart an intruder. When evaluating the security of a network, it is rarely enough to consider the presence or absence of isolated vulnerabilities. This is because intruders often combine exploits against multiple vulnerabilities in order to reach their goals (Abadi & Jalili, 2005). For example, an intruder might exploit the vulnerability of a particular version of FTP to overwrite the .rhosts file on a victim host. In the next step, the intruder could remotely log in to the victim. In a subsequent step, the intruder could use the victim host as a base to launch another exploit on a new victim, and so on. (Phillips & Swiler, 1998) proposed the concept of attack graphs, where each node represents a possible attack state. Edges represent a change of state caused by a single action taken by the intruder. (Sheyner et al., 2002) used a modified version of the model checker NuSMV (NuSMV, 2010) to produce attack graphs. (Ammann et al., 2002) introduced a monotonicity assumption and used it to develop a polynomial algorithm to encode all of the edges in an attack graph without actually computing the graph itself. These attack graphs are essentially similar to (Phillips & Swiler, 1998), where any path in the graph from an initial node to a goal node shows a sequence of exploits that an intruder can launch to reach his goal. (Noel et al., 2005) presented a number of techniques for managing attack graph complexity through visualization. (Mehta et al., 2006) presented a ranking scheme for the nodes of an attack graph. Rank of a node shows its importance based on factors like the probability of an intruder reaching that node. Given a ranked attack graph, the system administrator can concentrate on relevant subgraphs to figure out how to start deploying security measures. (Ou et al., 2006) presented logical attack graphs, which directly illustrate logical dependencies among attack goals and configuration information. Their attack graph generation tool builds upon MulVAL (Ou et al., 2005), a network security analyzer based on logical programming. The aim of minimization analysis of network attack graphs is to find a minimum critical set of exploits that completely disconnect the initial nodes and the goal nodes of the graph.

In order to discover the network vulnerability timely and solve the very serious problems of network security, this paper puts forward the attack graph which is based on intrusion detection method. The method uses the generation global network attack graph algorithm to build network initial attack graph, and call attack graph optimization algorithm to remove global attack graph unreasonable path, and achieve the goal of simply attack graph. Finally, management personnel get the basis which is computed nodes in each state attack graph algorithms degree of loss to optimize the network security. Experiments show that the intrusion detection method is reasonable and effective, and has the advantages of simple and easy.

Today cyber adversaries utilize advanced techniques to victimize target assets. To tackle the adversaries, it is of utmost importance to understand potential techniques they may use to exploit network vulnerabilities. Attack graph has always been a crucial tool for network vulnerability analysis. However, the current state-of-the-art attack graph can not predict adversarial techniques. To overcome the gap, we utilize the MITRE ATT&CK matrix in this work and map the techniques with the attack graph node descriptions. We first formulate a comprehensive dataset from ATT&CK consisting of all the adversarial strategies, subtechniques, associated tactics, and mitigation for the enterprise network. We then capture the attack graph node descriptions and apply the term frequency-inverse document frequency (TF-IDF) algorithm to map the attack techniques with the available node descriptions. Next, we generate the cosine similarity to determine an adversary’s top methods to attack a network. We then map those techniques with the associated tactics and mitigation strategies as enumerated in the ATT&CK matrix. Finally, we illustrate the analysis using a networked system’s attack graph. This proposed method would help identify and validate adversarial techniques and guide in selecting mitigation mechanisms for security enhancement.

Attack graphs are the graphs which describe attack scenarios, play important roles in analyzing network threats. These attack graphs are able to reveal such potential threats by evaluating the all possible sequences that an attacker can follow to compromise given critical resources or nodes. An Attack graph specifies an attack scenario that results in compromising network values. There are so many methods proposed to evaluate the network security in attack graphs. But no method specifies the overhead occurred due to the evaluation of network security at each and every node. This paper addresses the problem of overhead occurred due to the network security evaluation in Short-Normalizedattack graphs by evaluating a factor called network security risk. In this paper first the possible n valid attack paths are going to be calculated and then the security risk is going to be calculated for those n valid paths. This security risk denotes the amount of overhead occurred due to this evaluation.

An attack graph is a succinct representation of all paths through a system that end in a state where an intruder has successfully achieved his goal. Today Red Teams determine the vulnerability of networked systems by drawing gigantic attack graphs by hand. Constructing attack graphs by hand is tedious, error-prone, and impractical for large systems. By viewing an attack as a violation of a safety property, we can use off-the-shelf model checking technology to produce attack graphs automatically: a successful path from the intruder's viewpoint is a counterexample produced by the model checker In this paper we present an algorithm for generating attack graphs using model checking as a subroutine. Security analysts use attack graphs for detection, defense and forensics. In this paper we present a minimization analysis technique that allows analysts to decide which minimal set of security measures would guarantee the safety of the system. We provide a formal characterization of this problem: we prove that it is polynomially equivalent to the minimum hitting set problem and we present a greedy algorithm with provable bounds. We also present a reliability analysis technique that allows analysts to perform a simple cost-benefit trade-off depending on the likelihoods of attacks. By interpreting attack graphs as Markov Decision Processes we can use the value iteration algorithm to compute the probabilities of intruder success for each attack the graph.

In order to improve the invulnerability of electric power optical transmission network in the smart grid, based on complex network theory, experimental simulation of random attacks and selective attacks on electric power optical transmission network in Jiangbei District of Nanjing City is carried out, and the method of improving the invulnerability of the network is given according to the simulation results. In the experiment of random attacks, we investigate the impact of single node failure on network connectivity and screen the hub nodes, and get the hub nodes that need to be protected. In selective attacks, two kinds of attack strategies are proposed, namely, network efficiency relative loss rate first attacks and real-time betweenness first attacks. From three aspects that include connectivity, network efficiency and network efficiency relative loss rate to evaluate the invulnerability of the network. The experimental results show that the electric power optical transmission network has the worst invulnerability to real-time betweenness first attacks. On this basis, an important node evaluation and protection method is proposed to improve the invulnerability of electric power optical transmission network, and the feasibility and effectiveness of the proposed method is verified by the example simulation.

Nowadays, networks are exposed to a set of risks and threats that can potentially cause damage and losses for companies. The security of networks must be assessed in order to measure the effectiveness of the protective measures that have been implemented. However, the impact of the dynamic behavior of these systems on the attacker's strategy is rarely considered. In this paper, we propose an attack graph-based solution that consider the evolution of system properties such as network topology changes, vulnerability discovery and patching, as well as attack detection and wiping of some system components. The topology of the attack graph evolves over time considering the evolution of the system state. Several simulations of the attacker infiltration in the system are performed by following the attack paths present in the attack graph in order to assess the security of the system. The proposed solution has been tested on a use case where a user is in remote work. By considering the changes in the network topology, new attack paths can be identified.

As networks continue to grow in size and complexity, automatic assessment of the security vulnerability becomes increasingly important. The typical means by which an attacker breaks into a network is through a series of exploits, where each exploit in the series satisfies the pre-condition for subsequent exploits and makes a causal relationship among them. Such a series of exploits constitutes an attack path where the set of all possible attack paths form an attack graph. Attack graphs reveal the threat by enumerating all possible sequences of exploits that can be followed to compromise a given critical resource. The contribution of this chapter is to identify the most probable attack path based on the attack surface measures of the individual hosts for a given network and also identify the minimum possible network securing options for a given attack graph in an automated fashion. The identified network securing options are exhaustive and the proposed approach aims at detecting cycles in forward reachable attack graphs. As a whole, the chapter deals with identification of probable attack path and risk mitigation which may facilitate in improving the overall security of an enterprise network.

We propose in this paper a novel approach to analyze network vulnerability and to obtain a quantitative value representing the level of security achieved in an arbitrary network. Unlike previous graph-based algorithms that generate attack trees (or graphs) to cover all possible sequences of vulnerabilities and therefore are not scalable, our method utilizes the attack graph’s principles, but directly analyzes and produces the desired security measure for a network without building the actual attack graph. The proposed approach relies on a unique evaluation of vulnerability metric defined in this paper and is demonstrated through an example of a network that provides voice over IP services.

An attack graph models the causal relationships between vulnerabilities. Attack graphs have important applications in protecting critical resources in networks against sophisticated multi-step intrusions. Currently, analyses of attack graphs largely depend on proprietary implementations of specialized algorithms. However, developing and implementing algorithms causes a delay to the availability of new analyses. The delay is usually unacceptable due to rapidly-changing needs in defending against network intrusions. An administrator may want to revise an analysis as soon as its outcome is observed. Such an interactive analysis, similar to that in decision support systems, is desirable but difficult with current approaches based on proprietary implementations of algorithms. This paper addresses the above issue through a relational approach. Specifically, we devise a relational model for representing necessary inputs, such as network configurations and domain knowledge, and we generate attack graphs from these inputs as relational views. We show that typical analyses can be supported through different type of searches in an attack graph, and these searches can be realized as relational queries. Our approach eliminates the needs for implementing algorithms, because an analysis is now simply a relational query. The interactive analysis of attack graphs becomes possible, since relational queries can be dynamically constructed and revised at run time. As a side effect, experimental results show that the mature optimization techniques in relational databases can transparently improve the performance of the analysis.

Attack Graphs have been widely used by the network security administrators to gain an understanding of possible attack paths, an attacker may follow to compromise critical resources. As networks get larger and more complex, one needs to use databases to perform iterative, interactive analysis tasks with attack graphs. In this paper we investigate how property graph based graph databases like Neo4j can be effectively used towards this application. We show that extending the standard property graph model with a constraint specification mechanism aids attack graph modeling and interactive analytics. We briefly sketch a preliminary attempt to implement a constraint layer over Neo4j and show how attack graph generation and analysis can be performed faithfully in Neo4j using the extended model.

Attack graphs enable computation of important network security metrics by revealing potential attack paths an adversary could use to gain control of network assets. This paper presents GARNET (Graphical Attack graph and Reachability Network Evaluation Tool), an interactive visualization tool that facilitates attack graph analysis. It provides a simplified view of critical steps that can be taken by an attacker and of host-to-host network reachability that enables these exploits. It allows users to perform what-if experiments including adding new zero-day attacks, following recommendations to patch software vulnerabilities, and changing the attacker starting location to analyze external and internal attackers. Users can also compute and view metrics of assets captured versus attacker effort to compare the security of complex networks. For adversaries with three skill levels, it is possible to create graphs of assets captured versus attacker steps and the number of unique exploits required. GARNET is implemented as a Java application and is built on top of an existing C++ engine that performs reachability and attack graph computations. An initial round of user evaluations described in this paper led to many changes that significantly enhance usability.

Intrusion Detection Systems (IDS) have been used widely to detect malicious behavior in network communication and hosts. IDS management is an important capability for distributed IDS solutions, which makes it possible to integrate and handle different types of sensors or collect and synthesize alerts generated from multiple hosts located in the distributed environment. Sophisticated attacks are difficult to detect and make it necessary to integrate multiple data sources for detection and correlation. Attack graph (AG) is used as an effective method to model, analyze, and evaluate the security of complicated computer systems or networks. The attack graph workflow consists of three parts: information gathering, attack graph construction, and visualization. This paper proposes the integration of the AG workflow with an IDS management system to improve alert and correlation quality. The vulnerability and system information is used to prioritize and tag the incoming IDS alerts. The AG is used during the correlation process to filter and optimize correlation results. A prototype is implemented using automatic vulnerability extraction and AG creation based on unified data models.

The network security assessment is vital for improving the overall security posture. With diverse opportunities for using networking devices and configuring them, varying software application portfolios, and the increased flexibility of using numerous applications, today's computer networks are subject to continuous evolution. Such ever-growing computer networks in size and complexity lead to information exposure to an increased threat landscape and attack surface variation. The network attack surface constitutes exploitable technical vulnerabilities, software/hardware misconfigurations (i.e., configuration gaps), vulnerable service connectivities, and service-cum-user privileges. An adversary may exploit the network attack surface to penetrate the enterprise networks incrementally. The discovery of new vulnerabilities and vague access control rules can further set off the attack surface variation. Hence, it is essential to consider the temporal aspect of network security. Attack graph, a graphical network security modeling tool, succinctly captures the attack surface of a vulnerable network in the form of initial security conditions, much needed for an adversary for successful incremental network penetration. Existing attack graph-based metrics are inadequate in capturing the variation in the attack surface. We propose to use a Boolean similarity metric to assess the similarity between the goal-oriented attack graphs generated successively for an enterprise network within the chosen sampling interval. We represent individual attack graphs as a Boolean expression to serve our purpose. A Boolean expression is a sum-of-product expression, i.e., a disjunction of attack paths, each a conjunction of initial conditions. We have conducted a set of experiments to validate the efficacy and applicability of the Boolean similarity metric. The results indicate that the Boolean similarity measure can detect the variation in the network attack surface.