Vulnerability Scanning Research Articles

Transportation Network Vulnerability

Transport is a fundamental part of logistics activities, which play a critical role in the development of society. The safety and the reliability of logistics transportation networks significantly affect those activities. Network vulnerability assessment has been applied in the passenger transport mode. However, the methodology to assess the vulnerability of logistics transportation networks should be developed differently from that of passenger or other transport modes because of the networks’ specific requirements for trip success. This paper proposes a methodology applicable in logistics transportation network vulnerability assessment. To evaluate the performance of logistics transportation networks, logistics value is included in the generalized cost of logistics transportation. Moreover, network vulnerability assessment is affected by the nature of the component degradation. Here, the performance of logistics transportation networks is evaluated in transportation facility degradation scenarios. A vulnerability scanning algorithm is applied in link and node degradation scenarios. To reduce computational demands, an efficient vulnerability scanning algorithm is applied to the simulation, and a computer program is developed to make this methodology feasible in large-scale networks. Finally, this methodology based on future highspeed railway planning is applied in a real logistics transport network in northern Japan. The research was undertaken to assist logistics managers, researchers, and transportation planners in defining and comprehending the basic views of the vulnerability of logistics transportation networks and their various applications.

A quality metric for IDS signatures: in the wild the size matters

The manual forensics investigation of security incidents is an opaque process that involves the collection and correlation of diverse evidence. In this work we first conduct a complex experiment to expand our understanding of forensics analysis processes. During a period of 4 weeks, we systematically investigated 200 detected security incidents about compromised hosts within a large operational network. We used data from four commonly used security sources, namely Snort alerts, reconnaissance and vulnerability scanners, blacklists, and a search engine, to manually investigate these incidents. Based on our experiment, we first evaluate the (complementary) utility of the four security data sources and surprisingly find that the search engine provided useful evidence for diagnosing many more incidents than more traditional security sources, i.e., blacklists, reconnaissance, and vulnerability reports. Based on our validation, we then identify and make publicly available a list of 165 good Snort signatures, i.e., signatures that were effective in identifying validated malware without producing false positives. In addition, we analyze the characteristics of good signatures and identify strong correlations between different signature features and their effectiveness, i.e., the number of validated incidents in which a good signature is identified. Based on our experiment, we finally introduce an IDS signature quality metric that can be exploited by security specialists to evaluate the available rulesets, prioritize the generated alerts, and facilitate the forensics analysis processes. We apply our metric to characterize the most popular Snort rulesets. Our analysis of signatures is useful not only for configuring Snort but also for establishing best practices and for teaching how to write new IDS signatures.

A Picture is Worth a Thousand Alerts

Situation awareness (SA) in cyber-security is difficult to measure, yet new tools from research and industry promise improved cyber SA. This paper describes a human-subjects experiment using a high task fidelity cyber-security simulator. Participants from two groups (novice and experienced) were recruited and assigned to one of two interfaces (text and visual analytic), in a 2x2 between-subjects experimental design. The underlying cyber-security data presented to participants was the same for each interface, and included intrusion detection, firewall and vulnerability scan reports spanning the same time period. The participant’s situation awareness was measured using different techniques including a freeze-probe, post-trial assessments of perceived workload and perceived SA as well as a measure of task effectiveness. Comparison of the results indicate that this multi-method approach of cognitive assessment may be useful in understanding a phenomenon like SA, especially where tasks are complex and virtual such as is common in cyber-security.

General Discussion on Prevention Technologies of Network Security

Definition of network security is stated first. Network security threats; roughly including network connection threat, physical environment threat, authentication treat, malicious programs and system vulnerabilities, which can be further divided into more detailed categories. 8 prevention technology and strategies consisting of physical security means, firewall technology, intrusion detection, information encryption technology, vulnerability scanning, antivirus software, disaster recovery technology, and honeypots and honeynet technology are elaborated to try to form a general discussion of the security prevention structure. In the end, we propose that all of these technology and strategies should be organically combined and enterprises should pay more attention to network security rather than expanding production uncontrolled.

NICE: Network Intrusion Detection and Countermeasure Selection in Virtual Network Systems

Cloud security is one of most important issues that has attracted a lot of research and development effort in past few years. Particularly, attackers can explore vulnerabilities of a cloud system and compromise virtual machines to deploy further large-scale Distributed Denial-of-Service (DDoS). DDoS attacks usually involve early stage actions such as multistep exploitation, low-frequency vulnerability scanning, and compromising identified vulnerable virtual machines as zombies, and finally DDoS attacks through the compromised zombies. Within the cloud system, especially the Infrastructure-as-a-Service (IaaS) clouds, the detection of zombie exploration attacks is extremely difficult. This is because cloud users may install vulnerable applications on their virtual machines. To prevent vulnerable virtual machines from being compromised in the cloud, we propose a multiphase distributed vulnerability detection, measurement, and countermeasure selection mechanism called NICE, which is built on attack graph-based analytical models and reconfigurable virtual network-based countermeasures. The proposed framework leverages OpenFlow network programming APIs to build a monitor and control plane over distributed programmable virtual switches to significantly improve attack detection and mitigate attack consequences. The system and security evaluations demonstrate the efficiency and effectiveness of the proposed solution.

Web from preprocessor for crawling

Usually organizations deploy web applications into the production environment with vulnerabilities. To avoid it, organizations need to run a web application vulnerability assessment. The most prevalent kind of vulnerability assessment is when the tester uses a vulnerability scanner. This assessment can be divided into two phases: crawling and testing. The purpose of the first phase is to gather all the access points of the application. In the second phase the tester sends some malformed values to the application, and then analyze the response looking for known vulnerability patterns. The crawling phase is critical because if the tester cannot reach the applications content, he or she couldn't test that content to find vulnerabilities. One of the main challenges of crawling web applications are to fill out web forms with correct values. To face this challenge, web vulnerability scanners used to include a generic list of field value pairs. These scanners also let the tester to add new pairs. This paper presents a novel method for searching candidate web form field values. The challenge is to map more applications content than using the field value pairs included by default. Our method will try to get form fields values executing the client side code and looking for candidate values in an external data source.We have test the proposed method and the experiments show that it can improve the crawling phase of dynamic vulnerability assessment.

CloudProxy: A NAPT Proxy for Vulnerability Scanners based on Cloud Computing

Security-as-a-service (SaaS) is an outsourcing model for security management in cloud computing. Vulnerability scanners based on cloud computing is becoming one of the killer applications in SaaS due to the pay-per-use manner and powerful scanning capability. When performing vulnerability scanning through network, the scanner needs to establish a large number of TCP connections with the target host. To deal with the problem of IPv4 address shortening and to protect the hosts within the organization, the target hosts are almost always deployed behind a NAPT(Network Address and Port Translation) device, TCP packets sent by the scanner outside the network isolated by the NAPT device will be blocked, thus unable to complete the vulnerability scanning task when the scanners are deployed in the cloud. While there exists NAPT traversal methods, they support TCP poorly and therefore is not ready for the vulnerability scanning scenario where a large number of TCP connections needs to be established. In this paper we proposed a NAPT proxy named CloudProxy for adopting vulnerability scanners in cloud computing by combining the TURN extension protocol and the Socks5 protocol. We integrated function of Socks5 into the TURN client, so that the destination port of all scanning packets will be aggregated before passing through the TURN server, lessen the burden of the TURN server. The experimental results show that CloudProxy can relay packets for the vulnerability scanner based on cloud computing in a transparent way and its scalability is sufficient for practical use.

Beat security auditors at their own game

Are you sick of hiring external auditors who come onto your turf, pick apart your network and leave you with a laundry list of security issues to rectify? It would be great to know exactly what issues they're likely to find, handle them ahead of time, and sit back and relax as the auditor struggles to find a violation. The good news is that, with a little knowledge, effort and preparation, you can do just that – and using free tools to boot. If you manage a computer network, or are responsible for its security, chances are you're subject to some regulatory compliance. That means, at some point, you or an outside auditor will need to scan your network. Part of this job involves automated vulnerability scanning. Corey Nachreiner of WatchGuard Technologies walks you through how to use the popular BackTrack Linux distribution and two common tools, OpenVAS and Nessus, to perform such scans. It won't turn you into a fully fledged penetration tester, but it will allow you to discover some of the worst problems and fix them before your next audit.

Service vulnerability scanning based on service-oriented architecture in Web service environments

Web services are becoming the critical components of business application, but they are often invoked with critical software and application bugs that can be explored by malicious users. Because the existing centralized vulnerability scanning systems often face performance bottleneck because of huge amount of tasks, a novel service vulnerability scanning scheme is high desirable. In this paper, we propose a service vulnerability scanning scheme based on service-oriented architecture (SoA) in Web service environments. The scanning scheme contains three components, i.e., domain-oriented distributed architecture, service providing mode based on SoA and hierarchical strategy scheduling model. The hierarchical strategy scheduling model is the key of the scanning scheme, which is used to solve the problems of distributed scheduling management in vulnerability scanning process for Web service environments. We conduct a centralized scanner to compare our scheme with other schemes by the implement of prototype system. Experimental results show that our proposed scheme outperforms other schemes with respect to time cost, accuracy and load.

An Efficient Method for Scheduling Massive Vulnerability Scanning Plug-ins

More and more security vulnerabilities were found in network softwares nowadays, making network security assessment one of the most important tasks for IT administrators. Vulnerability scanner is the key application for fulfilling such tasks. However, large numbers of vulnerabilities result in even larger number of vulnerability plug-ins including common plug-ins and specific plug-ins, which may involve complex dependencies. Therefore, how to schedule such large number of plug-ins in an efficient manner is a key problem for improving the performance of vulnerability scanners. We analyze the current algorithms and find that they doesn't take the dependencies into consideration or doesn't handle it properly, which would waste a considerable CPU time for scanning. This paper proposes an efficient plug-in scheduling algorithm based on DAG graph. We formalize plug-in scheduling as a tree-like topological sorting problem using DAG theory, in which multi-thread is treated as task lines and all plug-ins are deployed on the task lines. Each task line is occupied by the plug-ins for a period of executing time and waiting time. By constructing the DAG graph of all plug-ins and computing their ``height'' value, sorting the plug-ins and aligning them to a linked list for scheduling, we solve the plug-in dependency problem properly, therefore eliminate the possibilities that non-ready plug-ins being scheduled to execute. We carry out experiments to validate the effectiveness of our algorithm.

A dynamic approach to generate behavior patterns of Virus and Worms for Intrusion Detection System

In today’s society people become more and more dependent on computer systems. It is therefore vital that such systems are up and running at all times. One factor that has the power to destroy the availability is computer network attacks (CNA). (CNA are defined as methods aimed at destroying, altering or obstructing information in computers, computer networks or the networks themselves). Unfortunately, the Internet show an increasing trend regarding the usage of malicious activities such as intrusion attempts, denial-of-service attacks, phishing, spamming and worms. Some automated attacks can compromise a large number of computers in a short period of time. To try to minimize this threat, it would be nice to have a security system which has the ability to detect new attacks and react on them. This work focuses on seeing how good IDS rules that can be generated automatically based on data logged by a simple honypot. The result will be based on data collected by a network intrusion detection system named SNORT, a low-interaction honeypot named honeyd and a vulnerability scanner named Nessus. Keywords: Intrusion Detection, Honey pots, Longest common Substring, Worms, Confusion matrix

Resilient Dynamic Data Driven Application Systems (rDDDAS)

There is a growing interest in Cloud Computing for delivering computing as a utility. Security in Cloud Computing is a challenging research problem because it involves many interdependent tasks including vulnerability scanning, application layer firewalls, configuration management, alert monitoring and analysis, source code analysis, and user identity management. It is widely accepted that we cannot build software and computing systems that are free from vulnerabilities and cannot be penetrated or attacked. Consequently, there is a strong interest in resilience approach because of its potential to address the cybersecurity challenges. Our is based on using the Dynamic Data Driven Application System (DDDAS) and Moving Target Defence (MTD) strategies to develop resilient DDDAS. The Resilient Applications utilize the following capabilities: Software Behaviour Encryption (SBE), Replication, Diversity, Automated Checkpointing and Recovery. Software Behaviour Encryption employs spatiotemporal behaviour encryption and a moving target defence to make active software components change their implementations and their resources randomly and consequently evade attackers. Diversity and random execution is achieved by “hot” shuffling multiple functionally- equivalent, behaviourally-different software versions at runtime (This encryption of the execution environment will make it extremely difficult for an attack to disrupt the normal operations of a cloud application. Also, the dynamic change in the execution environment will hide the software flaws that would otherwise be exploited by a cyberattacker. Checkpointing is used to save the current state of the task to a reliable storage and thus enabling rollback recovery if it is required to tolerate cyberattacks and mitigate their impacts. We use the Compiler for Portable Checkpointing (CPPC), a tool for automatically inserting portable checkpoints into the code.We also evaluate the performance and overhead of running three applications in our rDDDAS environment. Our experimental results show that the rDDDAS environment can be used to develop resilient cloud applications are resilient against attacks with around 7% in execution time overhead.

Secure Intrusion Detection and Attack Measure Selection in Virtual Network Systems

Cloud security is one of most important issues that has attracted a lot of research and development effort in past few years. Particularly, attackers can explore vulnerabilities of a cloud system and compromise virtual machines to deploy further large-scale Distributed Denial-of-Service (DDoS). DDoS attacks usually involve early stage actions such as multi-step exploitation, low frequency vulnerability scanning, and compromising identified vulnerable virtual machines as zombies, and finally DDoS attacks through the compromised zombies. Within the cloud system, especially the Infrastructure-as a-Service (IaaS) clouds, the detection of zombie exploration attacks is extremely difficult. This is because cloud users may install vulnerable applications on their virtual machines. To prevent vulnerable virtual machines from being compromised in the cloud, we propose a multi phase distributed vulnerability detection, measurement, and countermeasure selection mechanism called NICE, which is built on attack graph based analytical models and reconfigurable virtual network-based countermeasures. The proposed framework leverages Open Flow network programming APIs to build a monitor and control plane over distributed programmable virtual switches in order to significantly improve attack detection and mitigate attack consequences. The system and security evaluations demonstrate the efficiency and effectiveness of the proposed solution.

Uma Ferramenta Livre e ExtensÍVel Para Detecção de Vulnerabilidades em Sistemas Web

The increasing number of intrusions and data thefts on online systems is one of the triggers of the gro wing concern about security inside organizations. Nowadays, dynamic and extensible detection tools are required and critical to detect and diagnose vulnerabilities in Web systems. In this paper we present the development and evaluation of a vulnerability scanner for online systems. Unlike most existing tools, it is free and open source, available at SourceFo rge, and has a modular and extensible arch itecture. The achieved results show that the proposed tool, called Un iscan, is able to better detect and diagnose vulnerabilit ies such as LFI, RFI and RCE.

Performance of automated network vulnerability scanning at remediating security issues

This paper evaluates how large portion of an enterprises network security holes that would be remediated if one would follow the remediation guidelines provided by seven automated network vulnerability scanners. Remediation performance was assessed for both authenticated and unauthenticated scans. The overall findings suggest that a vulnerability scanner is a usable security assessment tool, given that credentials are available for the systems in the network. However, there are issues with the method: manual effort is needed to reach complete accuracy and the remediation guidelines are oftentimes very cumbersome to study. Results also show that a scanner more accurate in terms of remediating vulnerabilities generally also is better at detecting vulnerabilities, but is in turn also more prone to false alarms. This is independent of whether the scanner is provided system credentials or not.

A quantitative evaluation of vulnerability scanning

PurposeThe purpose of this paper is to evaluate if automated vulnerability scanning accurately identifies vulnerabilities in computer networks and if this accuracy is contingent on the platforms used.Design/methodology/approachBoth qualitative comparisons of functionality and quantitative comparisons of false positives and false negatives are made for seven different scanners. The quantitative assessment includes data from both authenticated and unauthenticated scans. Experiments were conducted on a computer network of 28 hosts with various operating systems, services and vulnerabilities. This network was set up by a team of security researchers and professionals.FindingsThe data collected in this study show that authenticated vulnerability scanning is usable. However, automated scanning is not able to accurately identify all vulnerabilities present in computer networks. Also, scans of hosts running Windows are more accurate than scans of hosts running Linux.Research limitations/implicationsThis paper focuses on the direct output of automated scans with respect to the vulnerabilities they identify. Areas such as how to interpret the results assessed by each scanner (e.g. regarding remediation guidelines) or aggregating information about individual vulnerabilities into risk measures are out of scope.Practical implicationsThis paper describes how well automated vulnerability scanners perform when it comes to identifying security issues in a network. The findings suggest that a vulnerability scanner is a useable tool to have in your security toolbox given that user credentials are available for the hosts in your network. Manual effort is however needed to complement automated scanning in order to get satisfactory accuracy regarding network security problems.Originality/valuePrevious studies have focused on the qualitative aspects on vulnerability assessment. This study presents a quantitative evaluation of seven of the most popular vulnerability scanners available on the market.

System Dynamics Based Insider Threats Modeling

Insider threat has been recognized as one of the most dangerous security threats and become a much more complex issue. Insider threat is resulted from the legitimate users abusing their privileges and cause tremendous damage or losses. Not always being friends, insiders can be main threats to the organization. Currently, there is no equivalent prevention solution for insider threat to an intrution prevention system or vulnerability scanner. From the survey of literature of insider threat studies, we conclude that the system dynamics (SD) is an effective tool to analyze the root causes of insider threat incidents and evaluate mitigation strategies from people, process, and technology perspectives. A generized case based SD model can be tailored and applied to analyze and evaluate specific insider threat incidents. We present a well known insider threat incident of Taiwan and tailor the generized case based SD model to analyze it. The simulation results indicate that the risk of insider threats can be reduced and the probability of detecting insider threats can be increased.

Insider Threat Analysis of Case Based System Dynamics

One of the most dangerous security threats today is insider threat, and it is such a much more complex issue. But till now, there is no equivalent to a vulnerability scanner for insider threat. We survey and discuss the history of research on insider threat analysis to know system dynamics is the best method to mitigate insider threat from people, process, and technology. In the paper, we present a famous case of insider threats in Taiwan using system dynamics to analyze the tailored model. We may reduce the risk and increase the probability of detecting insider threats from personnel of simulation model. The study concludes with suggestions for future research and implications for system dynamics who are interested in insider threat issue.

Detecting and Defeating SQL Injection Attacks

Abstract —The increasing dependence on web applications have made them a natural target for attackers. Among these attacks SQL Injection Attacks (SQLIA) are the most prevalent. In this paper we propose a SQL injection vulnerability scanner that is light-weight, fast and has a low false positive rate. These scanners prove as a practical tool to discover the vulnerabilities in a web application as well as to test the efficiency of counter attack mechanisms. In the latter part of our work we propose a security mechanism to counter SQL Injection Attacks. Our security methodology is based on the design of a filter for the HTTP request send by clients or users and look for attack signatures. The proposed filter is generic in the sense that it can be used with any web application. Finally we test our proposed security mechanism using the vulnerability scanner developed by us as well as other well known scanners. The proposed security mechanism is able to counter all the vulnerabilities that were previously reported before the deployment of our security framework.

Generating Effective Attacks for Efficient and Precise Penetration Testing against SQL Injection

An SQL injection attack is one of the most serious security threats to web applications. It allows an attacker to access the underlying database and execute arbitrary commands, which may lead to sensitive information disclosure. The primary way to prevent SQL injection attacks is to sanitize the user-supplied input. However, this is usually performed manually by developers and so is a laborious and error-prone task. Although security tools assist the developers in verifying the security of their web applications, they often generate a number of false positives/negatives. In this paper, we present our technique called Sania, which performs efficient and precise penetration testing by dynamically generating effective attacks through investigating SQL queries. Since Sania is designed to be used in the development phase of web applications, it can intercept SQL queries. By analyzing the SQL queries, Sania automatically generates precise attacks and assesses the security according to the context of the potentially vulnerable slots in the SQL queries. We evaluated our technique using real-world web applications and found that our solution is efficient. Sania generated more accurate attacks and less false positives than popular web application vulnerability scanners. We also found previously unknown vulnerabilities in a commercial product that was just about to be released and in open-source web applications.