Attack Graph Research Articles

Empirical risk assessment of attack graphs using time to compromise framework

Empirical risk assessment of attack graphs using time to compromise framework

SD-CPC: SDN Controller Placement Camouflage based on Stochastic Game for Moving-target Defense

The modern paradigm of Software Defined Network (SDN) inspired the research community to develop more innovative and transformative solutions for large scale and complex crucial Cyber Physical Systems (CPS). However, the recent destructive attacks targeting such CPS applications, raised the need to initially secure and scale the core SDN network. These attacks may target the heart of SDN networks itself formed by the controllers. Therefore, recent research works discussed the Controller Placement Problem (CPP) to determine the required number of SDN controller(s) and their optimal locations in synonyms wide area networks. A few of the presented solutions discussed the network security aspect to solve this problem. In addition, none of them addressed the need to secure and dynamically change SDN controller location to confuse attackers. Therefore, in this paper, we introduce a new concept of Controller Placement Camouflage (CPC) to dynamically change the attack surface (SDN controller placements) for Moving-target Defense (MTD). The new paradigm of MTD imposes various asymmetric offensive and defensive modes against cyber-adversaries. We relied on the Zero-Sum game as a stochastic game between the system defender and the attacker to guide our MTD solution. In addition, our presented solution is adapted to consider the network vulnerabilities, evaluate the risk level of the system in real-time using Bayesian Attack Graph (BAG), to frequently shift the SDN controller(s) location. Furthermore, we used the Smart Grid as a case study for a mission critical CPS application. We conducted a scenario of UK Bulk Demand Points (BDP), 50MVA generation network capacity map to simulate a real mini-grid network topology. To the best of our knowledge, this research work may be considered the first introduction for SD-CPC for MTD.

Extending Attack Graphs to Represent Cyber-Attacks in Communication Protocols and Modern IT Networks

An attack graph is a method used to enumerate the possible paths that an attacker can take in the organizational network. MulVAL is a known open-source framework used to automatically generate attack graphs. MulVAL's default modeling has two main shortcomings. First, it lacks the ability to represent network protocol vulnerabilities, and thus it cannot be used to model common network attacks, such as ARP poisoning. Second, it does not support advanced types of communication, such as wireless and bus communication, and thus it cannot be used to model cyber-attacks on networks that include IoT devices or industrial components. In this article, we present an extended network security model for MulVAL that: (1) considers the physical network topology, (2) supports short-range communication protocols, (3) models vulnerabilities in the design of network protocols, and (4) models specific industrial communication architectures. Using the proposed extensions, we were able to model multiple attack techniques including: spoofing, man-in-the-middle, and denial of service attacks, as well as attacks on advanced types of communication. We demonstrate the proposed model in a testbed which implements a simplified network architecture comprised of both IT and industrial components.

Research on Automatic Vulnerability Mining Model Based on Knowledge Graph

In the information extraction, information sources can be screened according to the characteristics of the target network at the present stage, and the knowledge graph generated thereby can play a role in assisting the security analysis of the general network or power grid control network, mobile Internet and other special networks. In the method proposed in this paper, knowledge reasoning is mainly based on the attack conditions and attack methods to reason about the success rate and return of the attack. Through the obtained quality information, map construction information extraction and reasoning are performed to realize the correlation analysis of the information, and the information processing results are stored in the graphic structure. When analyzing the alerts generated by IDS, it is necessary to solve the multi-source alarm format generated by various devices produced by different suppliers. The attack diagram constructs the attack mode to guide the defense side to take targeted defense measures, and the attack success rate is used to judge the defense priority of all network nodes. After completing the construction of the graph, the attack graph is generated for the specific network environment under the guidance of the knowledge graph. In the process of attack graph generation, attack method and attack condition of attack instance can be used to guide the match of pre-condition and post-condition, so as to find the attack path. Attack success rate and attack profit attribute can be used to assist subsequent risk analysis. After simulation tests, the timeliness and availability of the system are verified, and this makes a contribution to the grid network management.

PowerLang: a probabilistic attack simulation language for the power domain

Cyber-attacks on power-related IT and OT infrastructures can have disastrous consequences for individuals, regions, as well as whole nations. In order to respond to these threats, the cyber security assessment of IT and OT infrastructures can foster a higher degree of safety and resilience against cyber-attacks. Therefore, the use of attack simulations based on system architecture models is proposed. To reduce the effort of creating new attack graphs for each system under assessment, domain-specific languages (DSLs) can be employed. DSLs codify the common attack logics of the considered domain.Previously, MAL (the Meta Attack Language) was proposed, which serves as a framework to develop DSLs and generate attack graphs for modeled infrastructures. In this article, powerLang as a MAL-based DSL for modeling IT and OT infrastructures in the power domain is proposed. Further, it allows analyzing weaknesses related to known attacks. To comprise powerLang, two existing MAL-based DSL are combined with a new language focusing on industrial control systems (ICS). Finally, this first version of the language was validated against a known cyber-attack.

Adaptive Cyber Defense Against Multi-Stage Attacks Using Learning-Based POMDP

Growing multi-stage attacks in computer networks impose significant security risks and necessitate the development of effective defense schemes that are able to autonomously respond to intrusions during vulnerability windows. However, the defender faces several real-world challenges, e.g., unknown likelihoods and unknown impacts of successful exploits. In this article, we leverage reinforcement learning to develop an innovative adaptive cyber defense to maximize the cost-effectiveness subject to the aforementioned challenges. In particular, we use Bayesian attack graphs to model the interactions between the attacker and networks. Then we formulate the defense problem of interest as a partially observable Markov decision process problem where the defender maintains belief states to estimate system states, leverages Thompson sampling to estimate transition probabilities, and utilizes reinforcement learning to choose optimal defense actions using measured utility values. The algorithm performance is verified via numerical simulations based on real-world attacks.

An intelligent recommendation algorithm for red team strategy in edge computing powered massive Cyber Defense Exercise

The recent surge in the frequency and seriousness of cyber attacks is alarming and poses a critical threat against the stability of our society. Previously, most effort to mitigate cyber attacks has focused on the technical countermeasures. However, a number of recent cyber attacks showed the necessity of constantly offering proper massive Cyber Defense eXercise (CDX) to the workforce in a timely manner. In order to meet the ever growing demand, the most recent massive CDX platform utilizes various edge computing concepts to locally manage the overhead related to the trainees (blue team members) in real time unlike the traditional centralized CDX platform. So far, such massive CDX platform cannot be fully operational without sufficient number of qualified trainers (red team members) who have strong expertise in cyber offense and are willing to participate the CDX. Unfortunately, securing enough number of such red team members is greatly challenging in practice. To address this issue, this paper introduces an intelligent recommendation algorithm for the red team in a massive CDX so that such massive CDX can be organized without enough number of red team members with a strong expertise in cyber offense. Given a known attack graph for each cyber defense training module, we formally define the problem of identifying a subgraph including a victorious strategy for the red team as the victory subgraph computation problem. Then, we introduce a new algorithm to solve this problem as well as a new strategy to obtain a winning strategy for the offense team to assist such red team members. Besides, we also discuss about various approach to utilize our result to organize massive CDXs in an efficient manner.

Automated Security Risk Identification Using AutomationML-Based Engineering Data

Systems integrators and vendors of industrial components need to establish a security-by-design approach, which includes the assessment and subsequent treatment of security risks. However, conducting security risk assessments along the engineering process is a costly and labor-intensive endeavor due to the complexity of the system(s) under consideration and the lack of automated methods. This, in turn, hampers the ability of security analysts to assess risks pertaining to cyber-physical systems (CPSs) in an efficient manner. In this work, we propose a method that automatically identifies security risks based on the CPS's data representation, which exists within engineering artifacts. To lay the foundation for our method, we present security-focused semantics for the engineering data exchange format AutomationML (AML). These semantics enable the reuse of security-relevant know-how in AML artifacts by means of a formal knowledge representation, modeled with a security-enriched ontology. Our method is capable of automating the identification of security risk sources and potential consequences in order to construct cyber-physical attack graphs that capture the paths adversaries may take. We demonstrate the benefits of the proposed method through a case study and an open-source prototypical implementation. Finally, we prove that our solution is scalable by conducting a rigorous performance evaluation.

Distributed Attack Modeling Approach Based on Process Mining and Graph Segmentation

Attack graph modeling aims to generate attack models by investigating attack behaviors recorded in intrusion alerts raised in network security devices. Attack models can help network security administrators discover an attack strategy that intruders use to compromise the network and implement a timely response to security threats. However, the state-of-the-art algorithms for attack graph modeling are unable to obtain a high-level or global-oriented view of the attack strategy. To address the aforementioned issue, considering the similarity between attack behavior and workflow, we employ a heuristic process mining algorithm to generate the initial attack graph. Although the initial attack graphs generated by the heuristic process mining algorithm are complete, they are extremely complex for manual analysis. To improve their readability, we propose a graph segmentation algorithm to split a complex attack graph into multiple subgraphs while preserving the original structure. Furthermore, to handle massive volume alert data, we propose a distributed attack graph generation algorithm based on Hadoop MapReduce and a distributed attack graph segmentation algorithm based on Spark GraphX. Additionally, we conduct comprehensive experiments to validate the performance of the proposed algorithms. The experimental results demonstrate that the proposed algorithms achieve considerable improvement over comparative algorithms in terms of accuracy and efficiency.

Attack Graph-Based Moving Target Defense in Software-Defined Networks

Moving target defense (MTD) has emerged as a proactive defense mechanism aiming to thwart a potential attacker. The key underlying idea of MTD is to increase uncertainty and confusion for attackers by changing the attack surface (i.e., system or network configurations) that can invalidate the intelligence collected by the attackers and interrupt attack execution; ultimately leading to attack failure. Recently, the significant advance of software-defined networking (SDN) technology has enabled several complex system operations to be highly flexible and robust; particularly in terms of programmability and controllability with the help of SDN controllers. Accordingly, many security operations have utilized this capability to be optimally deployed in a complex network using the SDN functionalities. In this paper, by leveraging the advanced SDN technology, we developed an attack graph-based MTD technique that shuffles a host’s network configurations (e.g., MAC/IP/port addresses) based on its criticality, which is highly exploitable by attackers when the host is on the attack path(s). To this end, we developed a hierarchical attack graph model that provides a network’s vulnerability and network topology, which can be utilized for the MTD shuffling decisions in selecting highly exploitable hosts in a given network, and determining the frequency of shuffling the hosts’ network configurations. The MTD shuffling with a high priority on more exploitable, critical hosts contributes to providing adaptive, proactive, and affordable defense services aiming to minimize attack success probability with minimum MTD cost. We validated the out performance of the proposed MTD in attack success probability and MTD cost via both simulation and real SDN testbed experiments.

An Invocation Chain Test and Evaluation Method for Fog Computing

In this paper, an invocation chain technology is used to test the security of fog computing systems. Atomic attacks based on the attack graph are combined according to the type, time sequence, and causal relationship. Different test sequences have gone through according to the principle of depth-first. In addition, the vulnerability assessment based on an invocation chain is evaluated to verify whether it can detect existing or unknown vulnerability in fog computing systems. Finally, the experimental results show that the invocation chain test and evaluation method based on the attack graph can evaluate the system risk quantitatively rather than qualitatively by calculating comprehensive probability on all test sequences.

Attack scenario reconstruction approach using attack graph and alert data mining

Existing alert correlation methods do not consider the unsuccessful paths and true negative alerts of IDS, which affects the completeness and visualization of attack restoring. To overcome this, an attack graph based alert correlation approach is proposed. The attack graph is first created using the toolkit MulVAL based on the network connectivity and known vulnerabilities, which gives the full view of all the vulnerabilities and their interdependence. Then, the alerts were mapped to attack graph to exhibit the intrusion situation initially. Afterwards, the attack sequences are output from the set of mapped alerts to reflect the initial attack paths. Afterwards, similar attack sequences are clustered together to obtain the preliminary attack scenarios. Finally, by analyzing the cohesive relationship between the subscenarios, the unreported true negative alerts are detected to improve the reconstruction by merging the broken attack scenarios. Experiments on the tested network and Defcon CTF23 dataset indicate that the proposed approach can restore attack scenarios more completely and further be used for attack forensics and traceability as well as for providing visualization support for comprehensive vulnerability analysis and targeted intrusion prevention.

IP Traceback using Flow Based Classification

Background:Distributed Denial of Service (DDoS) attack is a major threat over the internet. The IP traceback mechanism defends against DDoS attacks by tracing the path traversed by attack packets. The existing traceback techniques proposed till now are found with few short comings. The victim required many number of packets to trace the attack path. The requirement of a large number of packets resulted in more number of combinations and more false positives.Methods:To generate a unique value for the IP address of the routers in the attack path Chinese Remainder theorem is applied. This helped in combining the exact parts of the IP address at the victim. We also applied K-Nearest Neighbor (KNN) algorithm to classify the packets depending on their traffic flow, this reduced the number of packets to reconstruct the attack path.Results:The proposed approach is compared with the existing approaches and the results demonstrated that the attack graph is effectively constructed with higher precision and lower combination overhead under large scale DDoS attacks. In this approach, packets from diverse flows are separated as per flow information by applying KNN algorithm. Hence, the reconstruction procedure could be applied on each group separately to construct the multiple attack paths. This results in reconstruction of the complete attack graph with fewer combinations and false positive rate.Conclusion:In case of DDoS attacks the reconstruction of the attack path plays a major role in revealing IP addresses of the participated routers without false positives and false negatives. Our algorithm FRS enhances the feasibility of information pertaining to even the farthest routers by incorporating a flag condition while marking the packets. The rate of false positives and false negatives are drastically reduced by the application of Chinese Remainder Theorem on the IP addresses of the router. At the victim, the application of KNN algorithm reduced the combination overhead and the computation cost enormously.

Efficient Defense Decision-Making Approach for Multistep Attacks Based on the Attack Graph and Game Theory

In the multistep attack scenario, each rational attack-defense player tries to maximize his payoff, but the uncertainty about his adversary prevents him from taking the favorable actions. How to select the best strategy from the candidate strategies to maximize the defense payoff becomes the core issue. For this purpose, the paper innovatively designs a game theory model from the point of network survivability in combination with the attribute attack graph. The attack graph is created based on the network connectivity and known vulnerabilities using the MulVAL toolkit, which gives the full view of all the known vulnerabilities and their interdependence. Then, we use the attack graph to extract attack-defense actions, candidate attack-defense strategies, attack-defense payoffs, and network states, as well as other game modeling elements. Afterwards, the payoffs of attack-defense strategies are quantified by integrating attack-defense strength and network survivability. In addition, we input the above elements into the game model. Through repeated learning, deduction, and improvement, we can optimize the layout of defense strategies. Finally, the efficient strategy selection approach is designed on the tradeoff between defense cost and benefit. The simulation of attack-defense confrontation in small-scale LAN shows that the proposed approach is reliable and effective.

On packet marking and Markov modeling for IP Traceback: A deep probabilistic and stochastic analysis

From many years, the methods to defend against Denial of Service attacks have been very attractive from different point of views, although network security is a large and very complex topic. Different techniques have been proposed and so-called packet marking and IP tracing procedures have especially demonstrated a good capacity to face different malicious attacks. While host-based DoS attacks are more easily traced and managed, network-based DoS attacks are a more challenging threat. In this paper, we discuss a powerful aspect of the IP traceback method, which allows a router to mark and add information to attack packets on the basis of a fixed probability value. We propose a potential method for modeling the classic probabilistic packet marking algorithm as Markov chains, allowing a closed form to be obtained for evaluating the correct number of received marked packets in order to build a meaningful attack graph and analyze how marking routers must behave to minimize the overall overhead.

A network attack path prediction method using attack graph

The prediction of intrusion intention of abnormal information in wireless network can effectively guarantee the security and stability of network. Traditional methods describe the relationship between different types of attacks. When building the model, only the path of the network nodes involved in the current attack behavior is considered, so the vulnerability of the network can not be analyzed in detail. Then, a network attack node path detection model based on attack graph is proposed. Firstly, according to the theory of attack graph, the network attack graph is defined, the right state of attacker is detected, the connection matrix of network is obtained, and the formal description of vulnerability, attack effect and attack premise is obtained. Then, the attack path graph is used to describe the transfer relationship between nodes, map the process of the attack from one host or vulnerability to the next host or vulnerability, and give the shortest path to achieve the attack intention. Further obtain the maximum possibility of intrusion under each attack path of the network, and build a network attack node path detection model based on the detection results. The experimental results show that the proposed model has high accuracy and effectively improves the efficiency of network security analysis.

Risk Analysis for Railway Signaling Safety Data Network Based on Extend Bayesian Attack Graph

The railway signaling safety data network is a key network to ensure the safety of train operation and improve transportation efficiency. Its information security is closely related to the safe and efficient operation of trains. This paper proposes an extend Bayesian attack graph model for risk analysis of railway signaling safety data network. Based on the traditional Bayesian attack graph, the model introduces the protection node, and describes the causality among network attack, protection and network state through the Bayesian network. First of all, based on the analysis of the vulnerabilities and possible malicious attack paths in the railway signaling safety data network, the extend Bayesian attack graph model is established with the system functional safety accidents as the target nodes. Then calculate the probability of functional safety accidents by Bayesian network, and combine the impact of different accidents to evaluate the risk of system information security. In addition, according to different attacks and the implementation of different protective measures, evidence node state can be set up, and the extend Bayesian attack graph model is able to use Bayesian inference to analyze the system risk.

Dynamic Trilateral Game Model for Attack Graph Security Game

Internal threats have a huge impact on the attack graph security game. The failure of the MTD model defence measures would be caused by the existence of internal users with certain authority. Dynamic trilateral game model was proposed to extend the original two-part game model. By materializing internal threats, the uncertainty of two-part game model was eliminated, which was expressed as the probability equation used by the players in the observation state process. And the relationship between the offensive and defensive sides became indirect. The user strategy, based on mixed strategy game model, was proposed to increase the coupling between stealth attack and internal threats. The income matrix was dynamically constructed to measure the behavioural outcomes of users and attackers. User behavioural references were obtained through dynamic programming. For the defender, the heuristic strategy in the model reduces the complexity of parties’s behaviour through random sampling. Experiments were carried out on the attack graph model under various game settings. Compared with the two-part game model, our model’s experimental results showed that the cyber security risks were reduced by 17.9% and 18.8% respectively on the strong and weak structural attack graph.

Attack Graph Modeling for Implantable Pacemaker.

Remote health monitoring systems are used to audit implantable medical devices or patients’ health in a non-clinical setting. These systems are prone to cyberattacks exploiting their critical vulnerabilities. Thus, threatening patients’ health and confidentiality. In this paper, a pacemaker automatic remote monitoring system (PARMS) is modeled using architecture analysis and design language (AADL), formally characterized, and checked using the JKind model checker tool. The generated attack graph is visualized using the Graphviz tool, and classifies security breaches through the violation of the security features of significance. The developed attack graph showed the essentiality of setting up appropriate security measures in PARMS.

A Framework for Real-Time Intrusion Response in Software Defined Networking Using Precomputed Graphical Security Models

Software defined networking (SDN) has been adopted in many application domains as it provides functionalities to dynamically control the network flow more robust and more economical compared to the traditional networks. In order to strengthen the security of the SDN against cyber attacks, many security solutions have been proposed. However, those solutions need to be compared in order to optimize the security of the SDN. To assess and evaluate the security of the SDN systematically, one can use graphical security models (e.g., attack graphs and attack trees). However, it is difficult to provide defense against an attack in real time due to their high computational complexity. In this paper, we propose a real-time intrusion response in SDN using precomputation to estimate the likelihood of future attack paths from an ongoing attack. We also take into account various SDN components to conduct a security assessment, which were not available when addressing only the components of an existing network. Our experimental analysis shows that we are able to estimate possible attack paths of an ongoing attack to mitigate it in real time, as well as showing the security metrics that depend on the flow table, including the SDN component. Hence, the proposed approach can be used to provide effective real-time mitigation solutions for securing SDN.