A Scalable Approach to Attack Graph Generation By Ou, Boyer, - - PowerPoint PPT Presentation

a scalable approach to attack graph generation
SMART_READER_LITE
LIVE PREVIEW

A Scalable Approach to Attack Graph Generation By Ou, Boyer, - - PowerPoint PPT Presentation

Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA A Scalable Approach to Attack Graph Generation By Ou, Boyer,


slide-1
SLIDE 1

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Systems and Internet Infrastructure Security

Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA

1

A Scalable Approach to Attack Graph Generation

By Ou, Boyer, McQueen

Presented By: Philip Koshy

slide-2
SLIDE 2

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

(De)motivating Example

2

An attacker exists somewhere on the internet.

slide-3
SLIDE 3

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

(De)motivating Example

3

The attacker wants access to the Project Plan.

slide-4
SLIDE 4

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

(De)motivating Example

4

Two firewalls in his/her way.

slide-5
SLIDE 5

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

(De)motivating Example

5

The web server is the

  • nly server that is

publicly accessible. This is the first target.

slide-6
SLIDE 6

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

(De)motivating Example

6

The attacker successfully executes a remote exploit on the web server. He/she now has local access to the web server.

slide-7
SLIDE 7

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

(De)motivating Example

7

After gaining access, the attacker notices that the web server can communicate with the file server using NFS. They have just identified their next target!

slide-8
SLIDE 8

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

(De)motivating Example

8

The attacker notices that NFS on the file server is misconfigured. The attacker places a modified binary (trojan horse) on the file server.

slide-9
SLIDE 9

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

(De)motivating Example

9

The unsuspecting user on the workstation runs the trojan horse, which secretly exfiltrates the project plan to the attacker.

slide-10
SLIDE 10

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Things to note

10

  • The attack was multi-stage.

The attack had a distinct procedure that moved in ordered stages.

  • The attack was multi-host.

The attacker broke into/circumvented several systems.

  • This is becoming more common and more

dangerous (e.g., Stuxnet)

slide-11
SLIDE 11

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Main Idea

11

  • Configuration errors cause security issues
  • Attackers take the path of least resistance to

reach their goal

  • The security of an entire network may boil down

to configuration errors on a single node (i.e., the weakest link)

slide-12
SLIDE 12

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Main Idea

12

  • The complexity of manually defending against

configuration errors is non-trivial.

  • Automated tools are necessary.
  • The goal would be to answer two questions:

Is our network vulnerable to currently known attacks? If so, how? We should have a clearly identified “path.”

slide-13
SLIDE 13

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Main Idea

13

  • The paper briefly discusses existing tools and

indicates their limitations. They often have incomprehensible output Require non-standardized, ad-hoc inputs No formal foundation

  • Most important issues is scalability.

Existing tools could not handle networks with more than 20 nodes!

slide-14
SLIDE 14

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Main Idea

14

slide-15
SLIDE 15

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Human readable output

15

slide-16
SLIDE 16

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Closest competitor

16

  • The closest competitor (Sheyner et al.) has a

formal foundation, but is impractical.

  • Using Sheyner’s approach, a network of only 10

hosts with 5 vulnerabilities per host took 15 minutes to analyze and generated 10 million edges.

  • The major problem: Many duplicate paths of

the graph are traversed!

  • Solution: Memoization!
slide-17
SLIDE 17

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

How to proceed?

17

  • To answer these questions

We need to examine our configuration data Define current vulnerabilities Derive all potential attack graph through our network by combining our configurations with vulnerabilities.

slide-18
SLIDE 18

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Architecture

18

Specific information about your network configuration. General information about recent vulnerabilities

slide-19
SLIDE 19

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Side note

19

  • General information about vulnerabilities is

available in a computer digestible format (XML) through the MITRE corporation.

  • Example vulnerability description:
  • val:org.mitre.oval:def:12860

“Heap-based buffer overflow in the Web Audio implementation in Google Chrome before 15.0.874.102”

slide-20
SLIDE 20

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Side note

20

slide-21
SLIDE 21

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Architecture

21

Perhaps something like OVAL e.g., Firewall config e.g., Anti-virus config, patch history

slide-22
SLIDE 22

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Architecture

22

Convert this information into

  • Datalog. This is a manual step.
slide-23
SLIDE 23

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Background: Datalog

23

Atoms are of the form: p( X1, X2,…, Xn ) Predicate Variables, Predicates or Constants

  • Variables are capitalized
  • Predicates and Constants are lower case
slide-24
SLIDE 24

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Background: Datalog

24

Datalog Rules: H :- B1, B2, …, Bn

  • H is an atom and B1 through Bn are literals (atoms).
  • The symbol :- can be read as “if”
  • More precisely stated: “The head is true if the body is

true.”

  • A Datalog program is a collection of rules
slide-25
SLIDE 25

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Architecture

25

MulVAL evaluates interaction rules on input facts. MulVAL can automatically identify/derive security vulnerabilities, assuming it has been provided the correct inputs in Datalog format.

slide-26
SLIDE 26

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Interaction rule

26

  • If an attacker can execute code on a host
  • The host had a listening network service AND
  • The program had a vulnerability AND
  • The attacker had public access to the service.
slide-27
SLIDE 27

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Architecture

27

MulVAL was modified to perform a “trace” when doing a DFS of the graph in addition to providing a simple “yes” or “no” to a vulnerability query.

slide-28
SLIDE 28

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Modifying interaction rules

28

Before After

slide-29
SLIDE 29

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Architecture

29

Key Contribution

slide-30
SLIDE 30

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Logical Attack Graph

30

Derived Fact Primitive Fact Derivation Node

slide-31
SLIDE 31

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Constructing the graph

31

slide-32
SLIDE 32

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Constructing the graph

32

  • Every TraceStep term becomes a derivation

node in the attack graph.

  • The Fact field in the trace step becomes the

node’s parent

  • The Conjunct field becomes its children.
  • Iteratively repeat until we’ve exhausted our

interaction rules.

slide-33
SLIDE 33

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Performance Results

33

Performance results compared with the closest competitor