Environment Aware Report: A Minimalist Approach To a Complex Problem, Version 1.1

As computer networks continue to grow, it becomes increasingly more important to automate the process of evaluating their vulnerability to attacks. Despite the best efforts of software architects and developers, network hosts inevitably contain a number of vulnerabilities. Hence, it is not feasible for a network administrator to remove all vulnerabilities present in the network hosts. Therefore, the recent focus in security of such networks is on analysis of vulnerabilities globally, finding exploits that are more critical, and preventing them to thwart an intruder. When evaluating the security of a network, it is rarely enough to consider the presence or absence of isolated vulnerabilities. This is because intruders often combine exploits against multiple vulnerabilities in order to reach their goals (Abadi & Jalili, 2005). For example, an intruder might exploit the vulnerability of a particular version of FTP to overwrite the .rhosts file on a victim host. In the next step, the intruder could remotely log in to the victim. In a subsequent step, the intruder could use the victim host as a base to launch another exploit on a new victim, and so on. (Phillips & Swiler, 1998) proposed the concept of attack graphs, where each node represents a possible attack state. Edges represent a change of state caused by a single action taken by the intruder. (Sheyner et al., 2002) used a modified version of the model checker NuSMV (NuSMV, 2010) to produce attack graphs. (Ammann et al., 2002) introduced a monotonicity assumption and used it to develop a polynomial algorithm to encode all of the edges in an attack graph without actually computing the graph itself. These attack graphs are essentially similar to (Phillips & Swiler, 1998), where any path in the graph from an initial node to a goal node shows a sequence of exploits that an intruder can launch to reach his goal. (Noel et al., 2005) presented a number of techniques for managing attack graph complexity through visualization. (Mehta et al., 2006) presented a ranking scheme for the nodes of an attack graph. Rank of a node shows its importance based on factors like the probability of an intruder reaching that node. Given a ranked attack graph, the system administrator can concentrate on relevant subgraphs to figure out how to start deploying security measures. (Ou et al., 2006) presented logical attack graphs, which directly illustrate logical dependencies among attack goals and configuration information. Their attack graph generation tool builds upon MulVAL (Ou et al., 2005), a network security analyzer based on logical programming. The aim of minimization analysis of network attack graphs is to find a minimum critical set of exploits that completely disconnect the initial nodes and the goal nodes of the graph.

An attack graph models the causal relationships between vulnerabilities. Attack graphs have important applications in protecting critical resources in networks against sophisticated multi-step intrusions. Currently, analyses of attack graphs largely depend on proprietary implementations of specialized algorithms. However, developing and implementing algorithms causes a delay to the availability of new analyses. The delay is usually unacceptable due to rapidly-changing needs in defending against network intrusions. An administrator may want to revise an analysis as soon as its outcome is observed. Such an interactive analysis, similar to that in decision support systems, is desirable but difficult with current approaches based on proprietary implementations of algorithms. This paper addresses the above issue through a relational approach. Specifically, we devise a relational model for representing necessary inputs, such as network configurations and domain knowledge, and we generate attack graphs from these inputs as relational views. We show that typical analyses can be supported through different type of searches in an attack graph, and these searches can be realized as relational queries. Our approach eliminates the needs for implementing algorithms, because an analysis is now simply a relational query. The interactive analysis of attack graphs becomes possible, since relational queries can be dynamically constructed and revised at run time. As a side effect, experimental results show that the mature optimization techniques in relational databases can transparently improve the performance of the analysis.

Attack graph is an essential tool for the security assessment of industrial Internet systems. Unfortunately, the traditional attack graph mainly focuses on discrete information and cannot handle continuous information such as temperature and humidity. These continuous data represent the states of the industrial Internet and are also indicators of attacks, which should be included in the attack graph. To this end, this paper presents a hybrid attack graph model, which can simultaneously describe the discrete and continuous information of the system. Based on the hybrid attack graph model, a security analysis method is presented. Firstly, the transformation rule from hybrid attack graph to timed automata is established. Secondly, the security attribute of the system is described by sequential logic of continuous interval, and then the model checker TACK is used to complete the analysis of the system. Finally, an example is analyzed and verified by a smart home system to illustrate the method’s effectiveness. The method in this paper provides a new idea for attack graph construction and analysis for industrial Internet systems.

Attack Graphs have been widely used by the network security administrators to gain an understanding of possible attack paths, an attacker may follow to compromise critical resources. As networks get larger and more complex, one needs to use databases to perform iterative, interactive analysis tasks with attack graphs. In this paper we investigate how property graph based graph databases like Neo4j can be effectively used towards this application. We show that extending the standard property graph model with a constraint specification mechanism aids attack graph modeling and interactive analytics. We briefly sketch a preliminary attempt to implement a constraint layer over Neo4j and show how attack graph generation and analysis can be performed faithfully in Neo4j using the extended model.

Smart infrastructure integrates cyberphysical systems, self-organizing networks of devices, fog computing to enhance the quality and convenience of manufacturing and social life, providing efficient resource management and increasing productivity and availability of traditional services. New technologies are characterized with a high degree of heterogeneity, structural complexity, and dynamic topology that result in a large number of new information and cyber security threats. Given a high degree of integration of digital cyber space into the processes of management, monitoring, aggregation, and data transferring, an assessment of its security level is a necessary requirement to maintain and control a safe and reliable environment for handling data and performing physical processes. Risk analysis and assessment is an extremely important task at all stages of the life cycle of subsystems and components of the smart environment. It allows us to assess a level of protection, identify vulnerable assets, and counteract the most likely directions of security threats. The known methods for security risk assessment do not consider the features of modern smart technologies, and this forces us to search for new approaches. This paper proposes a comprehensive method that includes a calculation of security indicators, risk assessment and selection of protective measures, based on attack graphs and thus allows us to consider the dynamics of changes in the components of the smart infrastructure. The automated system for assessing the security risks in the smart infrastructure and choosing the protective measures has been implemented.

An attack graph is a succinct representation of all paths through a system that end in a state where an intruder has successfully achieved his goal. Today Red Teams determine the vulnerability of networked systems by drawing gigantic attack graphs by hand. Constructing attack graphs by hand is tedious, error-prone, and impractical for large systems. By viewing an attack as a violation of a safety property, we can use off-the-shelf model checking technology to produce attack graphs automatically: a successful path from the intruder's viewpoint is a counterexample produced by the model checker In this paper we present an algorithm for generating attack graphs using model checking as a subroutine. Security analysts use attack graphs for detection, defense and forensics. In this paper we present a minimization analysis technique that allows analysts to decide which minimal set of security measures would guarantee the safety of the system. We provide a formal characterization of this problem: we prove that it is polynomially equivalent to the minimum hitting set problem and we present a greedy algorithm with provable bounds. We also present a reliability analysis technique that allows analysts to perform a simple cost-benefit trade-off depending on the likelihoods of attacks. By interpreting attack graphs as Markov Decision Processes we can use the value iteration algorithm to compute the probabilities of intruder success for each attack the graph.

Cyber deception has great potential in thwarting cyberattacks [1, 4, 8]. A defender (e.g., network administrator) can use deceptive cyber artifacts such as honeypots and faking services to confuse attackers (e.g., hackers) and thus reduce the success rate and effectiveness of attacks. However, the attackers are often diverse and some attackers may be aware of the deception and adapt to the defender's strategy. Therefore, when the defender designs the deception strategy, he needs to take into account the attacker's strategic response. Game theory is suitable for such strategic interaction between the defender and the attacker. Building upon our previous work on security games,[2, 3] we developed a series of game-theoretic models for cyber deception, as well as algorithms to compute the equilibrium or the optimal defender strategy in the games. The first model we proposed is the Cyber Deception Game, a zero-sum Stackelberg game between the defender and an adversary. In this game, the defender is tasked to protect a set of targets, where each target corresponds to a system or a node in a network. Each target has a true configuration, which consists of a set of attributes, e.g., an operating system, services hosted, etc. The defender can choose an observed configuration for each target when responding to probes and scans that may be launched by the attacker. The observed configuration can be different from the true configuration and thus the deception. The attacker, after collecting information about the observed configuration, chooses which target to attack. We show that finding the defender's optimal strategy is NP-hard and provides mixed-integer linear programming (MILP)-based algorithms to compute the optimal deception scheme, and also several heuristic algorithms. In a follow-up work,[7] we extended this game model to a general-sum one, which captures the fact that the cost for the defender may not always be equal to the gain of the attacker. The general-sum nature of this new game model leads to new computational challenges. We provided a Fully Polynomial Time Approximation Scheme (FPTAS) for solving the game and designed a MILP-based algorithm together with several techniques to speed up the computation. In a recent work,[5] we proposed a new attack graph-based Stackelberg security game model and analyze the optimal deception strategy the defender can use. In contrast to previous models, the attacker in this new game can take sequential actions to reach the targets, which is modeled as taking a path on the attack graph. The defender can strategically manipulate the attack graph through deceptive actions in addition to allocating defensive resources to protect important targets from attackers. We provided a MILP-based solution for a special class of attack graphs and a neural architecture search-based method for general directed acyclic attack graphs. We empirically demonstrated the benefit of deception in all these game models and the scalability of the algorithms. This talk features an introduction to these models and algorithms, together with a discussion on future research directions for game theory-based cyber deception.

Attack graph analysis has been established as a powerful tool for analyzing network vulnerability. However, previous approaches to network hardening look for exact solutions and thus do not scale. Further, hardening elements have been treated independently, which is inappropriate for real environments. For example, the cost for patching many systems may be nearly the same as for patching a single one. Or patching a vulnerability may have the same effect as blocking traffic with a firewall, while blocking a port may deny legitimate service. By failing to account for such hardening interdependencies, the resulting recommendations can be unrealistic and far from optimal. Instead, we formalize the notion of hardening strategy in terms of allowable actions, and define a cost model that takes into account the impact of interdependent hardening actions. We also introduce a near-optimal approximation algorithm that scales linearly with the size of the graphs, which we validate experimentally.

In this paper, an invocation chain technology is used to test the security of fog computing systems. Atomic attacks based on the attack graph are combined according to the type, time sequence, and causal relationship. Different test sequences have gone through according to the principle of depth-first. In addition, the vulnerability assessment based on an invocation chain is evaluated to verify whether it can detect existing or unknown vulnerability in fog computing systems. Finally, the experimental results show that the invocation chain test and evaluation method based on the attack graph can evaluate the system risk quantitatively rather than qualitatively by calculating comprehensive probability on all test sequences.

Most IoT systems involve IoT devices, communication protocols, remote cloud, IoT applications, mobile apps, and the physical environment. However, existing IoT security analyses only focus on a subset of all the essential components, such as device firmware or communication protocols, and ignore IoT systems' interactive nature, resulting in limited attack detection capabilities. In this work, we propose Iota, a logic programming-based framework to perform system-level security analysis for IoT systems. Iota generates attack graphs for IoT systems, showing all of the system resources that can be compromised and enumerating potential attack traces. In building Iota, we design novel techniques to scan IoT systems for individual vulnerabilities and further create generic exploit models for IoT vulnerabilities. We also identify and model physical dependencies between different devices as they are unique to IoT systems and are employed by adversaries to launch complicated attacks. In addition, we utilize NLP techniques to extract IoT app semantics based on app descriptions. Iota automatically translates vulnerabilities, exploits, and device dependencies to Prolog clauses and invokes MulVAL to construct attack graphs. To evaluate vulnerabilities' system-wide impact, we propose two metrics based on the attack graph, which provide guidance on fortifying IoT systems. Evaluation on 127 IoT CVEs (Common Vulnerabilities and Exposures) shows that IOTA's exploit modeling module achieves over 80% accuracy in predicting vulnerabilities' preconditions and effects. We apply Iota to 37 synthetic smart home IoT systems based on real-world IoT apps and devices. Experimental results show that our framework is effective and highly efficient. Among 27 shortest attack traces revealed by the attack graphs, 62.8% are not anticipated by the system administrator. It only takes 1.2 seconds to generate and analyze the attack graph for an IoT system consisting of 50 devices.

Attack graphs enable computation of important network security metrics by revealing potential attack paths an adversary could use to gain control of network assets. This paper presents GARNET (Graphical Attack graph and Reachability Network Evaluation Tool), an interactive visualization tool that facilitates attack graph analysis. It provides a simplified view of critical steps that can be taken by an attacker and of host-to-host network reachability that enables these exploits. It allows users to perform what-if experiments including adding new zero-day attacks, following recommendations to patch software vulnerabilities, and changing the attacker starting location to analyze external and internal attackers. Users can also compute and view metrics of assets captured versus attacker effort to compare the security of complex networks. For adversaries with three skill levels, it is possible to create graphs of assets captured versus attacker steps and the number of unique exploits required. GARNET is implemented as a Java application and is built on top of an existing C++ engine that performs reachability and attack graph computations. An initial round of user evaluations described in this paper led to many changes that significantly enhance usability.

We study the problem of allocating limited security countermeasures to protect network data from cyber-attacks, for scenarios modeled by Bayesian attack graphs. We consider multistage interactions between a network administrator and cybercriminals, formulated as a security game. This formulation is capable of representing security environments with significant dynamics and uncertainty and very large strategy spaces. We propose parameterized heuristic strategies for the attacker and defender and provide detailed analysis of their time complexity. Our heuristics exploit the topological structure of attack graphs and employ sampling methods to overcome the computational complexity in predicting opponent actions. Due to the complexity of the game, we employ a simulation-based approach and perform empirical game analysis over an enumerated set of heuristic strategies. Finally, we conduct experiments in various game settings to evaluate the performance of our heuristics in defending networks, in a manner that is robust to uncertainty about the security environment.

Attack graph is a general paradigm to model the weakness of an information system network and all possible attack sequences that attackers can obtain specific targets. In real systems, a vast majority of attack graph generation methods suffer from the states explosion issue. However, if we can predict which attack actions will own the maximum probability to be exploited by intruders precisely, namely finding the optimal attack path, we can solve this problem. In this paper, we propose an attack graph generation algorithm based on supervised Kohonen neural network. Using this method, we can presage the attack success rate and attack status types which would be attained if attackers successfully exploit vulnerabilities. Based on these results and the network topology, a probabilistic matrix and an optimal atomic attack matrix are proposed by us. Finally, the two matrices can be effectively used to generate the optimal attack path. After modeling the optimal path, the core nodes in the target network can be located, and network administrators can enact a series of effective defense strategies according to them.

Attack graphs have been proposed as useful tools for analyzing security vulnerabilities in network systems. Even when they are produced efficiently, the size and complexity of attack graphs often prevent a human from fully comprehending the information conveyed. A distillation of this overwhelming amount of information is crucial to aid network administrators in efficiently allocating scarce human and financial resources. This paper introduces AssetRank, a generalization of Google’s PageRank algorithm which ranks web pages in web graphs. AssetRank addresses the unique semantics of dependency attack graphs and incorporates vulnerability data from public databases to compute metrics for the graph vertices (representing attacker privileges and vulnerabilities) which reveal their importance in attacks against the system. The results of applying the algorithm on a number of network scenarios show that the numeric ranks computed are consistent with the intuitive importance that the privileges and vulnerabilities have to an attacker. The vertex ranks can be used to prioritize countermeasures, help a human reader to better comprehend security problems, and provide input to further security analysis tools.Keywordsattack graphsecurity metricPageRankeigenvector

Developing mission-centric impact assessment techniques to address cyber resiliency in the cyber-physical systems (CPSs) requires integrating system inter-dependencies to the risk and resilience analysis process. Generally, network administrators utilize attack graphs to estimate possible consequences in a networked environment. Attack graphs lack to incorporate the operations-specific dependencies. Localizing the dependencies among operational missions, tasks, and the hosting devices in a large-scale CPS is also challenging. In this work, we offer a graphical modeling technique to integrate the mission-centric impact assessment of cyberattacks by relating the effect to the operational resiliency by utilizing a combination of the logical attack graph and mission impact propagation graph. We propose formal techniques to compute cyberattacks’ impact on the operational mission and offer an optimization process to minimize the same, having budgetary restrictions. We also relate the effect to the system functional operability. We illustrate our modeling techniques using a SCADA (supervisory control and data acquisition) case study for the cyber-physical power systems. We believe our proposed method would help evaluate and minimize the impact of cyber attacks on CPS’s operational missions and, thus, enhance cyber resiliency.