Impact-Driven Sampling Strategies for Hybrid Attack Graphs

Attack graphs are important tools for analyzing security vulnerabilities in enterprise networks. Previous work on attack graphs has not provided an account of the scalability of the graph generating process, and there is often a lack of logical formalism in the representation of attack graphs, which results in the attack graph being difficult to use and understand by human beings. Pioneer work by Sheyner, et al. is the first attack-graph tool based on formal logical techniques, namely model-checking. However, when applied to moderate-sized networks, Sheyner's tool encountered a significant exponential explosion problem. This paper describes a new approach to represent and generate attack graphs. We propose logical attack graphs, which directly illustrate logical dependencies among attack goals and configuration information. A logical attack graph always has size polynomial to the network being analyzed. Our attack graph generation tool builds upon MulVAL, a network security analyzer based on logical programming. We demonstrate how to produce a derivation trace in the MulVAL logic-programming engine, and how to use the trace to generate a logical attack graph in quadratic time. We show experimental evidence that our logical attack graph generation algorithm is very efficient. We have generated logical attack graphs for fully connected networks of 1000 machines using a Pentium 4 CPU with 1GB of RAM.

Developing mission-centric impact assessment techniques to address cyber resiliency in the cyber-physical systems (CPSs) requires integrating system inter-dependencies to the risk and resilience analysis process. Generally, network administrators utilize attack graphs to estimate possible consequences in a networked environment. Attack graphs lack to incorporate the operations-specific dependencies. Localizing the dependencies among operational missions, tasks, and the hosting devices in a large-scale CPS is also challenging. In this work, we offer a graphical modeling technique to integrate the mission-centric impact assessment of cyberattacks by relating the effect to the operational resiliency by utilizing a combination of the logical attack graph and mission impact propagation graph. We propose formal techniques to compute cyberattacks’ impact on the operational mission and offer an optimization process to minimize the same, having budgetary restrictions. We also relate the effect to the system functional operability. We illustrate our modeling techniques using a SCADA (supervisory control and data acquisition) case study for the cyber-physical power systems. We believe our proposed method would help evaluate and minimize the impact of cyber attacks on CPS’s operational missions and, thus, enhance cyber resiliency.

The ever-evolving capabilities of cyber attackers force security\nadministrators to focus on the early identification of emerging threats.\nTargeted cyber attacks usually consist of several phases, from initial\nreconnaissance of the network environment to final impact on objectives. This\npaper investigates the identification of multi-step cyber threat scenarios\nusing kill chain and attack graphs. Kill chain and attack graphs are threat\nmodeling concepts that enable determining weak security defense points. We\npropose a novel kill chain attack graph that merges kill chain and attack\ngraphs together. This approach determines possible chains of attacker's actions\nand their materialization within the protected network. The graph generation\nuses a categorization of threats according to violated security properties. The\ngraph allows determining the kill chain phase the administrator should focus on\nand applicable countermeasures to mitigate possible cyber threats. We\nimplemented the proposed approach for a predefined range of cyber threats,\nespecially vulnerability exploitation and network threats. The approach was\nvalidated on a real-world use case. Publicly available implementation contains\na proof-of-concept kill chain attack graph generator.\n

Attack graphs compute potential attack paths from a system configuration and known vulnerabilities of a system. Evidence graphs model intrusion evidence and dependencies among them. In this paper, we show how to map evidence graphs to attack graphs. This mapping is useful for application of attack graphs and evidence graphs for forensic analysis. In addition to helping to refine attack graphs by using known sets of dependent attack evidence, important probabilistic information contained in evidence graphs can be used to compute or refine potential attack success probabilities obtained from repositories like CVSS. Conversely, attack graphs can be used to add missing evidence or remove irrelevant evidence trails to build a complete evidence graph. We illustrated the mapping by using a database attack as a case study.

The identification and analysis of potential paths that an adversary may exploit to attack Cyber Physical Systems comprising sub-systems enables the comprehensive understanding of the attacks and the impact that may have to the overall system, thus facilitating the definition of appropriate countermeasures that will satisfy the pertinent security requirements. To this end, several attack modelling techniques can be employed, the attack graph being the most prevalent among them. Unfortunately, the discovery and analysis of all possible attack paths in an attack graph is not possible in systems even of a moderate size. In this work we propose a novel systematic method for discovering and analyzing attack paths in real-world scale interconnected Cyber Physical Systems. The method considers the criticality of each sub-system in discovering paths and the risk to the overall system that each path presents to analyze and prioritize paths. We illustrate the workings of the method by applying to the navigational Cyber Physical Systems of the Cyber-Enabled Ship to identify and analyze highly critical attack paths originating from the Automatic Identification System (AIS) and targeting the Autonomous Navigation System (ANS).

Cyber-attacks threaten the safety of cyber physical systems (CPSs) as a result of the existence of weaknesses in the multiple structural units constituting them. In this paper, three cyber physical systems case studies of a pressurized water nuclear power plant (NPP), an industrial control system (ICS), and a vehicular network system (VNS) are examined, formally presented, and implemented utilizing Architecture Analysis and Design Language, determining system design, links, weaknesses, resources, potential attack instances, and their pre-and post-conditions. Then, the developed plant models are checked with a security property using JKind model checker embedded software. The attack graphs causing plants disruptions for the three applications are graphically visualized using a new graphical user interface (GUI) windows application.

The complex nature of recent attacks on cyber-physical systems calls for more expressive models for contingency prediction and response. In this paper, in an attempt to address the primary difficulties facing the design of models for cyber-physical systems security, we propose a general model, termed secure contingency prediction and response (SCPR), that explicitly links the security status of the cyber layer with the operational status of the physical system. This is achieved by describing the security status of the cyber layer as the progression of an attacker through an attack graph and drawing a correspondence between compromised nodes in the attack graph and attacker capabilities in the physical layer. Using the proposed model, we formulate a novel cyber-physical systems security problem, termed control-aware intrusion response, in which actions in the cyber layer take into account the structural controllability of the physical system. The expressiveness of the proposed model is further illustrated by briefly discussing its applicability to some foundational cyber-physical systems security problems.

As computer networks continue to grow, it becomes increasingly more important to automate the process of evaluating their vulnerability to attacks. Despite the best efforts of software architects and developers, network hosts inevitably contain a number of vulnerabilities. Hence, it is not feasible for a network administrator to remove all vulnerabilities present in the network hosts. Therefore, the recent focus in security of such networks is on analysis of vulnerabilities globally, finding exploits that are more critical, and preventing them to thwart an intruder. When evaluating the security of a network, it is rarely enough to consider the presence or absence of isolated vulnerabilities. This is because intruders often combine exploits against multiple vulnerabilities in order to reach their goals (Abadi & Jalili, 2005). For example, an intruder might exploit the vulnerability of a particular version of FTP to overwrite the .rhosts file on a victim host. In the next step, the intruder could remotely log in to the victim. In a subsequent step, the intruder could use the victim host as a base to launch another exploit on a new victim, and so on. (Phillips & Swiler, 1998) proposed the concept of attack graphs, where each node represents a possible attack state. Edges represent a change of state caused by a single action taken by the intruder. (Sheyner et al., 2002) used a modified version of the model checker NuSMV (NuSMV, 2010) to produce attack graphs. (Ammann et al., 2002) introduced a monotonicity assumption and used it to develop a polynomial algorithm to encode all of the edges in an attack graph without actually computing the graph itself. These attack graphs are essentially similar to (Phillips & Swiler, 1998), where any path in the graph from an initial node to a goal node shows a sequence of exploits that an intruder can launch to reach his goal. (Noel et al., 2005) presented a number of techniques for managing attack graph complexity through visualization. (Mehta et al., 2006) presented a ranking scheme for the nodes of an attack graph. Rank of a node shows its importance based on factors like the probability of an intruder reaching that node. Given a ranked attack graph, the system administrator can concentrate on relevant subgraphs to figure out how to start deploying security measures. (Ou et al., 2006) presented logical attack graphs, which directly illustrate logical dependencies among attack goals and configuration information. Their attack graph generation tool builds upon MulVAL (Ou et al., 2005), a network security analyzer based on logical programming. The aim of minimization analysis of network attack graphs is to find a minimum critical set of exploits that completely disconnect the initial nodes and the goal nodes of the graph.

A Cyber-Physical System (CPS) is usually composed of subnetworks where each subnetwork is under ownership of one defender. Security threats on such CPS can be represented by an attack graph where the defenders are required to invest wisely their limited budget in order to protect their critical assets from being compromised. We model such CPS using hybrid input/output automaton (HIOA) where each subnetwork is represented by a HIOA module. We first establish the building blocks needed in our setting. We then present our model that characterizes the continuous time evolution of the investments and discrete transitions between different system's states (where each state represents a different condition within the system). Finally, we provide a representative real-world CPS to validate our modeling and show its benefit for CPS security.

Attack graph plays an important role in network security, as it directly shows the existence of vulnerabilities in network and how attackers use these vulnerabilities to implement an effective attack, the analysis on the attack graph or the simulation of dynamic attacks through attack graph can help us easily find out the vulnerabilities in network, and take corresponding security measures, in order to strengthen network security. Previous attack graph generation methods are generally not suitable for large network, because of their high complexity of time, high consumption of space, and the large scale of attack graphs. Based on substantive analysis of the vulnerabilities in network, this paper describes a model for automatically generating and analyzing network attack graph. Besides, a prototype system bases on this model has been designed. At last, this prototype system was tested by a model network we built, and it was proved to be simple, flexible, and efficient.

Attack graphs are important tools for analyzing network security vulnerabilities. Recently, the generation method of attack graphs is a hot topic to the security researchers. As previous works encounter the scalability problem and inaccurate input information problem, we propose a novel method to automatic construction of attack graphs based on probability. After introducing prior-probability, match-probability,and transition-probability into attack graphs generation process, we develop a new attack model and relevant generation algorithms. Our method uses threshold and key states to control the scale of result attack graphs with important attack paths reserved. The following experiments show our approach could get meaningful results with less time and space, especially when one wants to get a few shortest attack paths quickly.

Modern attack-graph techniques can automatically discover all possible ways an attacker can compromise an enterprise network by analyzing configuration information of the hosts and network [7, 12, 13, 19, 20, 24, 26, 27, 37, 38, 39, 41, 44, 46, 47, 50, 52]. We will use the MulVAL logical attack graph [38, 39] as the foundation to build themetric models. A logical attack graph directly encodes the logical causality relationship among configuration settings and potential attacker privileges. It shows “why an attack can happen”, instead of “how an attack happens” as in some earlier attack-graph works [41, 46, 47, 50]. Its semantics is similar to the “exploit dependency attack graph” in the Cauldron project [7, 20, 35], and to a lesser degree also similar to the “multiple-prerequisite attack graph” [19] in the NetSPA project [27].KeywordsDatabase ServerEnterprise NetworkReasoning EngineAttack GraphAttack PathThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Attack Graphs are an important support for assessment and subsequent improvement of network security. They reveal possible paths an attacker can take to break through security perimeters and traverse a network to reach valuable assets deep inside the network. Although scalability is no longer the main issue, Attack Graphs still have some problems that make them less useful in practice. First, Attack Graphs remain difficult to relate to the network topology. Second, Attack Graphs traditionally only consider the exploitation of vulnerable hosts. Third, Attack Graphs do not rely on automatic identification of potential attack targets. We address these gaps in our MsAMS (Multi-step Attack Modelling and Simulation) tool, based on Mobile Ambients. The tool not only allows the modelling of more static aspects of the network, such as the network topology, but also the dynamics of network attacks. In addition to Mobile Ambients, we use the PageRank algorithm to determine targets and hub scores produced by the HITS (Hypertext Induced Topic Search) algorithm to guide the simulation of an attacker searching for targets.

The increasing complexity of cloud-native applications has necessitated advanced methodologies for threat modeling and security analysis. This paper presents ThreatCompute, a novel framework that combines LLMs with attack graphs to automate the generation of threat hypotheses and the quantification of risk in Kubernetes environments. While traditional approaches to attack graph generation require significant manual effort from security experts, ThreatCompute leverages LLMs to extract security insights from system information, reducing reliance on manual intervention while maintaining high accuracy and generating context-specific, system-aware threat insights. The framework utilizes the MITRE ATT&CK Matrix and the Microsoft Threat Matrix for Kubernetes as structured domains of possible attack techniques. Based on LLM-generated threat hypotheses and a quantitative risk metric, ThreatCompute constructs detailed attack graphs that illustrate potential attack paths and assess their associated risks. This enables both qualitative and quantitative evaluations of application security across varying levels of granularity. Through real-world examples of Kubernetes applications, we demonstrate the effectiveness of our approach in identifying and quantifying security risks.

Attack Graphs have been widely used by the network security administrators to gain an understanding of possible attack paths, an attacker may follow to compromise critical resources. As networks get larger and more complex, one needs to use databases to perform iterative, interactive analysis tasks with attack graphs. In this paper we investigate how property graph based graph databases like Neo4j can be effectively used towards this application. We show that extending the standard property graph model with a constraint specification mechanism aids attack graph modeling and interactive analytics. We briefly sketch a preliminary attempt to implement a constraint layer over Neo4j and show how attack graph generation and analysis can be performed faithfully in Neo4j using the extended model.