Identification of Attack Paths Using Kill Chain and Attack Graphs

Cyber attacks and threats have been developing according to the evolution of protection measures and response to incidents. In the past, the concern was related to the internal networks of the institutions, but nowadays the cyber environments are heterogeneous, with servers, smartphones, internet of things, cloud and even industrial control systems. This research proposes the polymer, an adaptive kill chain to be used in activities related to threat intelligence. After explaining the proposed kill chain, the results of a simulation performed with it are compared to a similar experiment, where it was observed that the polymer is a robust kill chain for modeling and threat hunting.

Attack graphs are important tools for analyzing security vulnerabilities in enterprise networks. Previous work on attack graphs has not provided an account of the scalability of the graph generating process, and there is often a lack of logical formalism in the representation of attack graphs, which results in the attack graph being difficult to use and understand by human beings. Pioneer work by Sheyner, et al. is the first attack-graph tool based on formal logical techniques, namely model-checking. However, when applied to moderate-sized networks, Sheyner's tool encountered a significant exponential explosion problem. This paper describes a new approach to represent and generate attack graphs. We propose logical attack graphs, which directly illustrate logical dependencies among attack goals and configuration information. A logical attack graph always has size polynomial to the network being analyzed. Our attack graph generation tool builds upon MulVAL, a network security analyzer based on logical programming. We demonstrate how to produce a derivation trace in the MulVAL logic-programming engine, and how to use the trace to generate a logical attack graph in quadratic time. We show experimental evidence that our logical attack graph generation algorithm is very efficient. We have generated logical attack graphs for fully connected networks of 1000 machines using a Pentium 4 CPU with 1GB of RAM.

Operating and engineering secure systems is challenging yet a necessary prerequisite for modern life as we know it, flourishing economic systems and society as a whole. This is as digitalization penetrated broad aspects of every facet of life realizing many opportunities. However, digital transformation also leads to increasing vulnerability to cyber threats. Cyber risk quantification thereby has a crucial role as anything that "is not measured cannot be improved. [And] what is not improved will always degrade" (Thomas Kelvin). However, quantifying cyber risks respectively as an inverse quantifying cyber security is still in its infancy and a largely unsolved problem. We propose a novel methodology for cyber risk quantification based on weighted attack graphs. By doing so, we introduce a multi-layered attack ontology which is the basis of the attack graph. The attack graph is developed relying on cyber threat intelligence. We weight each attack path using computational models of motivation. The attack graph is the basis of a defender-attacker game. We analyze and solve the game for deriving quantitative measures describing the risk of getting attacked.

As computer networks continue to grow, it becomes increasingly more important to automate the process of evaluating their vulnerability to attacks. Despite the best efforts of software architects and developers, network hosts inevitably contain a number of vulnerabilities. Hence, it is not feasible for a network administrator to remove all vulnerabilities present in the network hosts. Therefore, the recent focus in security of such networks is on analysis of vulnerabilities globally, finding exploits that are more critical, and preventing them to thwart an intruder. When evaluating the security of a network, it is rarely enough to consider the presence or absence of isolated vulnerabilities. This is because intruders often combine exploits against multiple vulnerabilities in order to reach their goals (Abadi & Jalili, 2005). For example, an intruder might exploit the vulnerability of a particular version of FTP to overwrite the .rhosts file on a victim host. In the next step, the intruder could remotely log in to the victim. In a subsequent step, the intruder could use the victim host as a base to launch another exploit on a new victim, and so on. (Phillips & Swiler, 1998) proposed the concept of attack graphs, where each node represents a possible attack state. Edges represent a change of state caused by a single action taken by the intruder. (Sheyner et al., 2002) used a modified version of the model checker NuSMV (NuSMV, 2010) to produce attack graphs. (Ammann et al., 2002) introduced a monotonicity assumption and used it to develop a polynomial algorithm to encode all of the edges in an attack graph without actually computing the graph itself. These attack graphs are essentially similar to (Phillips & Swiler, 1998), where any path in the graph from an initial node to a goal node shows a sequence of exploits that an intruder can launch to reach his goal. (Noel et al., 2005) presented a number of techniques for managing attack graph complexity through visualization. (Mehta et al., 2006) presented a ranking scheme for the nodes of an attack graph. Rank of a node shows its importance based on factors like the probability of an intruder reaching that node. Given a ranked attack graph, the system administrator can concentrate on relevant subgraphs to figure out how to start deploying security measures. (Ou et al., 2006) presented logical attack graphs, which directly illustrate logical dependencies among attack goals and configuration information. Their attack graph generation tool builds upon MulVAL (Ou et al., 2005), a network security analyzer based on logical programming. The aim of minimization analysis of network attack graphs is to find a minimum critical set of exploits that completely disconnect the initial nodes and the goal nodes of the graph.

The article discusses the problems of cyber-security of participants of the educational process, emphasizes the fact that these problems are not limited to the technical aspects of the protection of information resources, they must include in their entirety the following types of protection: legal, technical, informational, organizational and psychological. Among the psychological tools for securing cyber-security, it is proposed to distinguish cognitive ones, as the general population, and especially children and youth, increasingly become targets of cyber-attacks, first of all, their cognitive sphere, becoming the most vulnerable (weak) link in the network. In anthropocentric networks, which make up an ever-increasing share among common networks, the network itself acquires new properties, acting as an independent component (in addition to factors such as the network node, interface and links). Threats to participants in the educational process from the cyberspace should be regarded as passive and active, developing adequate means of protection and viability of the system "subject of educational process-learning-environment". The most significant among cyber-threats for the participants of the educational process are the social engineering methods, which knowledge and resistance can be the most effective for providing cyber-security. As part of the training of participants in the educational process on cyber-security, it is proposed to use "cyber vaccination", that is the formation of a conscious cognitive experience of staying under the influence of a cyber threat and counteracting it as a system of training activities that include, in addition to traditional methods, training of "cyber attacks", as well as the formation of knowledge and skills of resilience (recovery) in relation to cyber-threats. Further research is suggested to focus on the detailed development of types of threats to participants in the education process, as well as methods of counteraction. A special place should be a problem of resistance to cyber-threats, which can use the experience of training operators in emergent industries, including assessing the current state of the person and necessary adjustments in order to optimize its performance.

As networks continue to grow in size and complexity, automatic assessment of the security vulnerability becomes increasingly important. The typical means by which an attacker breaks into a network is through a series of exploits, where each exploit in the series satisfies the pre-condition for subsequent exploits and makes a causal relationship among them. Such a series of exploits constitutes an attack path where the set of all possible attack paths form an attack graph. Attack graphs reveal the threat by enumerating all possible sequences of exploits that can be followed to compromise a given critical resource. The contribution of this chapter is to identify the most probable attack path based on the attack surface measures of the individual hosts for a given network and also identify the minimum possible network securing options for a given attack graph in an automated fashion. The identified network securing options are exhaustive and the proposed approach aims at detecting cycles in forward reachable attack graphs. As a whole, the chapter deals with identification of probable attack path and risk mitigation which may facilitate in improving the overall security of an enterprise network.

Attack graph plays an important role in network security, as it directly shows the existence of vulnerabilities in network and how attackers use these vulnerabilities to implement an effective attack, the analysis on the attack graph or the simulation of dynamic attacks through attack graph can help us easily find out the vulnerabilities in network, and take corresponding security measures, in order to strengthen network security. Previous attack graph generation methods are generally not suitable for large network, because of their high complexity of time, high consumption of space, and the large scale of attack graphs. Based on substantive analysis of the vulnerabilities in network, this paper describes a model for automatically generating and analyzing network attack graph. Besides, a prototype system bases on this model has been designed. At last, this prototype system was tested by a model network we built, and it was proved to be simple, flexible, and efficient.

Among the many hacking attempts carried out against information systems for the past few years, cyber-attacks that could lead to a national-level threat included attacks against nuclear facilities particularly nuclear power stations. Two of the typical examples are the Stuxnet attack against an Iranian nuclear facility and the cyber threat against Korea Hydro and Nuclear Power in December 2015. The former has proven that a direct cyber-attack can actually stop the nuclear power station, and the latter has shown that people can be terrorized with only a (cyber) threat. After these incidents, security measures for cyber-attacks against industrial control systems have been strengthened. The nuclear power stations also changed their passive concept of executing security measures by operating the plant with an isolated network to prepare for the cyber-attacks carried out by malicious codes. The difference between the two concepts is that the latter has been formulated based on the possibility that most of the control systems can be targets of cyber-attacks. Threats against control systems are gradually increasing nowadays, so the relevant industries are implementing some measures to identify/develop safe and reliable digital equipment and identify risks to establish effective cyber security plans. Thus, this paper proposes a security measure based on the classification of past attack incidents against control systems and the big data analysis technique that processes the data generated from individual security equipment. The security of control systems is expected to be strengthened through such effective measure.

Current simulations supporting the Net-Centric Test battlespace do not accurately represent the impact of cyber threats and information operations. When cyber threats are considered, they are typically limited to a small number of isolated physical devices. To further limit consideration, insufficient attention is paid to cyber attacks launched on the basis of passive threats like the eavesdroppers or the coordinated threats. Further, the test technologies are typically limited to incorporation of threats that can be realized physically, which limits both the scale and sophistication of representing such attacks; a Live-Virtual-Constructive (LVC) paradigm for modeling of threats is missing. Lastly, for threats such as jamming, wormhole attacks, large-scale Denial of Service attacks, use of physical threats is expensive, since specialized equipment and manpower is required to realize these threats. The net consequence of these deficiencies is to leave a major gap in the DoD test infrastructure with respect to our ability to realistically test the vulnerabilities and resiliency of Blue Force communication architectures to sophisticated cyber attacks, particularly in networks that include both current force & Future Force communication infrastructure. In this paper, we present StealthNet, a Live-Virtual-Constructive (LVC) framework that provides a real-time, hardware-in-the-loop capability for simulation of cyber threats to the entire net-centric infrastructure. It also provides the ability to evaluate the effectiveness of the threats in disrupting Blue Force communications via key performance indicators, i.e. bandwidth, reliability, delay and quality of service metrics. The StealthNet framework provides models for accurate cyber threat simulation at all layers of the networking stack to include passive, active, coordinated and adaptive attacks on networks with hundreds to thousands of wired and wireless components. The LVC technology can stimulate physical Networked-System Under Test (NSUT) with simulated cyber threats that span all the protocol stack layers for real-time testing. Additionally, the framework enables composability with existing Test and Evaluation (T&E) architecture and tools (TENA, SBE environments, etc) to facilitate transition to other T&E programs.

Attack graphs are the graphs which describe attack scenarios, play important roles in analyzing network threats. These attack graphs are able to reveal such potential threats by evaluating the all possible sequences that an attacker can follow to compromise given critical resources or nodes. An Attack graph specifies an attack scenario that results in compromising network values. There are so many methods proposed to evaluate the network security in attack graphs. But no method specifies the overhead occurred due to the evaluation of network security at each and every node. This paper addresses the problem of overhead occurred due to the network security evaluation in Short-Normalizedattack graphs by evaluating a factor called network security risk. In this paper first the possible n valid attack paths are going to be calculated and then the security risk is going to be calculated for those n valid paths. This security risk denotes the amount of overhead occurred due to this evaluation.

Attack graphs are important tools for analyzing network security vulnerabilities. Recently, the generation method of attack graphs is a hot topic to the security researchers. As previous works encounter the scalability problem and inaccurate input information problem, we propose a novel method to automatic construction of attack graphs based on probability. After introducing prior-probability, match-probability,and transition-probability into attack graphs generation process, we develop a new attack model and relevant generation algorithms. Our method uses threshold and key states to control the scale of result attack graphs with important attack paths reserved. The following experiments show our approach could get meaningful results with less time and space, especially when one wants to get a few shortest attack paths quickly.

Smart Grid is one of the critical technologies that provide essential services to sustain social and economic developments. There are various cyber attacks on the Smart Grid system in recent years, which resulted in various negative repercussions. Therefore, understanding the characteristics and evaluating the consequences of an attack on the Smart Grid system is essential. The combination of Graphical Security Model (GrSM), including Attack Tree (AT) and Attack Graph (AG), and the Common Vulnerability Score System (CVSS) is a potential technology to analyze attack on Smart Grid system. However, there are a few research works about Smart Grid attack analysis using GrSM and CVSS. In this research, we first conduct a comprehensive study of the existing research on attack analysis using GrSM and CVSS, ranging from (1) Traditional Networks, (2) Emerging Technologies, to (3) Smart Grid. We indicate that the framework for automating security analysis of the Internet of Things is a promising direction for Smart Grid attack analysis using GrSM and CVSS. The framework has been applied to assess security of the Smart Grid system. A case study using the PNNL Taxonomy Feeders R4-12.47-2 and Smart Grid network model with gateways was conducted to validate the utilized framework. Our research is enriched by capturing all potential attack paths and calculating values of selected security metrics during the vulnerability analysis process. Furthermore, AG can be generated automatically. The research can potentially be utilized in Smart Grid cybersecurity training.KeywordsSmart GridGraphical Security Model (GrSM)Common Vulnerability Score System (CVSS)Attack analysisAttack treeAttack graph

Improving infrastructure, information and communication technologies to significantly increase the use of the Internet is still in use in cyber risks and network threats. Complex movements and new risks and threats systematically paved the way for the language has become a new field of land, air, sea, and space. It is quite clear that the cyber threat is likely to continue to intervene in theaters in the world of cyber year. But sometimes it is difficult to determine, first, column’s Cyber-specific threats—remotely simple computer code into cash Cyber sure that the cyber attacks, cyber terrorism, and industrial espionage. Because, combined with the price of “exponential language and complex cyber attacks, multivariate caused, it becomes a requirement for designers, how to deal with cyber activities and problems in this area in the operational planning process. In this article, we tried to achieve a continuous production flow Cyber in order to understand and visualize complex question of the complexity of cyber crime, and the scope and systematic prevention provide a standard Internet operating model. Disguised as standard, we aim to help designers understand the complex task Cyber demonstrates, the advantage of using the force of gravity analysis of the factors (COG), which is usually dealt with military decision-making (MDMP) at the end of using technicians have an understanding of business planning. Operational cyber proposal will be presented as an example in this study; there are plans to provide a comprehensive Internet-based leader.

IDERES: Intrusion detection and response system using machine learning and attack graphs

The identification and analysis of potential paths that an adversary may exploit to attack Cyber Physical Systems comprising sub-systems enables the comprehensive understanding of the attacks and the impact that may have to the overall system, thus facilitating the definition of appropriate countermeasures that will satisfy the pertinent security requirements. To this end, several attack modelling techniques can be employed, the attack graph being the most prevalent among them. Unfortunately, the discovery and analysis of all possible attack paths in an attack graph is not possible in systems even of a moderate size. In this work we propose a novel systematic method for discovering and analyzing attack paths in real-world scale interconnected Cyber Physical Systems. The method considers the criticality of each sub-system in discovering paths and the risk to the overall system that each path presents to analyze and prioritize paths. We illustrate the workings of the method by applying to the navigational Cyber Physical Systems of the Cyber-Enabled Ship to identify and analyze highly critical attack paths originating from the Automatic Identification System (AIS) and targeting the Autonomous Navigation System (ANS).