Introduction Attack Graphs Model Creation Analysis of Attack - - PowerPoint PPT Presentation

▶
introduction attack graphs
SMART_READER_LITE
LIVE PREVIEW

Introduction Attack Graphs Model Creation Analysis of Attack - - PowerPoint PPT Presentation

Nov 13, 2023 173 likes •687 views

EVA Evolutionary Vulnerability Analyzer A Framework for Network Analysis and Risk Assessment Dr. Melissa Danforth Department of Computer Science California State University, Bakersfield Introduction Attack Graphs Model Creation

slide-1
SLIDE 1
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

EVA

Evolutionary Vulnerability Analyzer

A Framework for Network Analysis and Risk Assessment

slide-2
SLIDE 2
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Introduction
  • Attack Graphs

– Model – Creation

  • Analysis of Attack Graphs

– Evolutionary Method – Modes of Analysis

  • Experimental Results
slide-3
SLIDE 3
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Problem: Vulnerability scanners limited

– Only evaluates individual machines – Cannot show how vulnerabilities relate

  • Example: “Foothold” situation

– Attacker compromises machine A – Machine A has private communication channel

with machine B

– Attacker uses machine A to attack machine B

slide-4
SLIDE 4
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Solution: Attack graphs

– Visual representation of exploits paths

slide-5
SLIDE 5
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Benefits of analyzing attack graphs

– Find a set of hardening measures – Perform “what if” evaluations – Assist with network design – Guide forensics evaluation – Detect multi-stage attacks from IDS alerts

slide-6
SLIDE 6
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

Attack Graphs

Model

slide-7
SLIDE 7
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Nodes of the graph

– Initial nodes represent the present state of the

network

– Interior and terminal nodes represent states the

attacker has achieved

  • Edges of the graph

– Attacks executed by attacker – Represented visually as a diamond “node”

slide-8
SLIDE 8
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Exploit path is sequence from initial nodes to a

terminal node

  • Discovers exploit paths through attack template

“requires/provides” syntax

– Templates have preconditions (requirements)

and postconditions (consequences)

– Postcondition of one attack may be a

precondition for another attack

– Path is sequence of such relationships

slide-9
SLIDE 9
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

SSH Attack Template

  • Preconditions

– Target has SSH vuln – Priv source >= user – Priv target < root – Source can connect

to target on port 22

  • Postcondition

– Attacker has priv

root on target

IIS Attack Template

  • Preconditions

– Target has IIS vuln – Priv source >= user – Priv target < root – Source can connect

to target on port 80

  • Postcondition

– Attacker has priv

root on target

slide-10
SLIDE 10
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Abstract exploit

templates eliminate most redundancy

  • Currently models

– Privilege escalation – Password guessing – Information leaks – Altering firewall and

router rules

R2R Attack Template

  • Preconditions

– Target has R2R vuln – Priv source >= user – Priv target < root – Source can connect

to target on port r2r

  • Postcondition

– Attacker has priv

root on target

slide-11
SLIDE 11
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

Attack Graphs

Generation

slide-12
SLIDE 12
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Input data

– List of vulnerabilities present on all machines – Model of firewall and router rules

  • Attacker model

– Assumes a single attacker for each graph – Initial privileges attacker has on all machines – Additional “attacker” machines – Can model insider and outsider scenarios

slide-13
SLIDE 13
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Preprocessing

– Convert all vulnerabilities and port numbers to

abstract model

– Cluster identical machines

  • Must have same vulnerabilities AND connectivity
  • Less work for the generator
  • Generation

– Use expert system to discover all possible

exploit paths

slide-14
SLIDE 14
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Outputs graph as data file and visualized graph
slide-15
SLIDE 15
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Visual complexity can rise quickly

Attack graph for network with 15 hosts:

slide-16
SLIDE 16
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

Analysis of Attack Graphs

Evolutionary Method

slide-17
SLIDE 17
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Goal: Prevent attacker from achieving certain

resources (“goal nodes”) in graph

  • Evolutionary Method

– Computationally infeasible to brute force – Start with random solutions

  • Solution varies with analysis mode

– Use genetic algorithm to refine solutions

  • Guided search of solution space

– Flexible and allows multiple solutions

slide-18
SLIDE 18
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Example: Find a set of patches

– Initial solutions are random subset of patches – Applies patches to graph and sees how well the

patches disconnect the goal nodes

– Assign a fitness metric – Select solutions with best fitness – “Breed” them to create next generation – Repeat

slide-19
SLIDE 19
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Assessing fitness is most CPU intensive task
  • Must apply each hardening measure and

cascade its effects throughout the graph

  • Over 60% of the single-threaded application

CPU time was spent in this function

  • Switched this task to multi-threaded function

– Each has its own copy of the attack graph – Memory is cheap, time is not (usually)

slide-20
SLIDE 20
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

slide-21
SLIDE 21
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

slide-22
SLIDE 22
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

slide-23
SLIDE 23
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

slide-24
SLIDE 24
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

slide-25
SLIDE 25
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

slide-26
SLIDE 26
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

slide-27
SLIDE 27
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

slide-28
SLIDE 28
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Fitness metric measures benefit of solution and

cost of solution

– Affected by mode of analysis and policy

  • Policy model allows defaults specified by mode

to be overridden

– Can override both costs and benefits for specific

cases or general cases

– Can have a different policy for different modes

  • f analysis
slide-29
SLIDE 29
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

Analysis of Attack Graphs

Modes of Analysis

slide-30
SLIDE 30
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Find set of hardening measures

– Prevent attacker from reaching resources by

patching machines, applying new firewall or router rules and/or placing IDS sensors

– Can also be run in “patch only” mode – Solution is a proposed set of measures – Fitness metric based on cost for measures in

set and how well they disconnect the attacker from the goal nodes

slide-31
SLIDE 31
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Strategic Planning

– Assess unknown risks by asking “what if” – Affects the generation of the attack graph – Alter the vulnerability list or firewall/router rules

to reflect the scenario

– Generate an attack graph for the scenario – Analyze resulting graph using any other mode

slide-32
SLIDE 32
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Network Design – Simple mode

– Administrator designs several different sets of

firewall and/or router rules for the network

– Attack graph is generated for each design – Risk metric is calculated based on how well

connected the goal nodes are to the graph

– Design with lowest risk metric is selected

  • Simple mode is not very interesting

– Just a variation on strategic planning

slide-33
SLIDE 33
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Network Design – Evolutionary Mode

– Administrator gives a single prototype design – Evolutionary analysis seeks improvements – Solutions alter firewall/router rules or place IDS

sensors

– Fitness metric based on how well goal nodes

are disconnected or watched

– Outputs several designs that minimize both risk

and cost

slide-34
SLIDE 34
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Forensic Evaluation and IDS Alerts

– Match forensic evidence and/or IDS alerts to

nodes in graph

– Detect exploit paths in use by attacker – Forensic evaluation – Guides analyst by

highlighting other resources the attacker may have compromised

– IDS alerts – Integrate with intrusion response or

activate additional monitoring

slide-35
SLIDE 35
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

Experimental Results

CSU Bakersfield Computer Science Department Instructional Laboratory Network

slide-36
SLIDE 36
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

slide-37
SLIDE 37
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Base Configuration Scenario

– Attacker is an outsider

  • Strategic Planning Scenarios

– Student visits a malicious website with a

vulnerable version of Firefox

– A malicious student attacks the network from

  • ne of the instructional lab machines

– An instructor brings in a compromised laptop

and plugs it into the LAN

slide-38
SLIDE 38
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Base Configuration Original Graph
slide-39
SLIDE 39
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Base Configuration Patched Graph
slide-40
SLIDE 40
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Vulnerable Browser Original Graph
slide-41
SLIDE 41
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Vulnerable Browser Patched Graph
slide-42
SLIDE 42
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Malicious Student Original Graph
slide-43
SLIDE 43
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Malicious Student Patched Graph
slide-44
SLIDE 44
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Rogue Laptop Original Graph
slide-45
SLIDE 45
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Rogue Laptop Patched Graph
slide-46
SLIDE 46
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Rogue Laptop Redesigned Network Graph
slide-47
SLIDE 47
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Scalability Testing

– Generated networks with 5 to 2500 machines – Largest network took 1.5 hours to analyze on a

quad-core Xeon 2.33GHz system

– Smallest network took approximately 1 second – Larger networks have more complex attack

graphs, so they take longer to analyze even with clustering and abstract exploit templates

slide-48
SLIDE 48
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

Future Work

slide-49
SLIDE 49
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

  • Automate remaining “by hand” processes

– Importing firewall and router rules – Translating Nessus plugin IDs to abstract exploit

class names

  • Allow multiple attacks in attacker model
  • Implement IDS correlation mode
  • Improve visualization of the graphs
  • Create a cohessive GUI to tie all parts together
slide-50
SLIDE 50
  • Dr. Melissa Danforth

Department of Computer Science California State University, Bakersfield

Questions?

Students on this project: Jonathan Berling Fred McHale John Millikin Nick Toothman