Library-based Attack Tree Synthesis S ebastien L e Cong, Sophie - PowerPoint PPT Presentation

Formal setting Algorithm and demo Theoretical complexity Conclusion Library-based Attack Tree Synthesis S´ ebastien Lˆ e Cong, Sophie Pinchinat Francois Schwarzentruber Univ Rennes - France June 22, 2020 1 / 19

Formal setting Algorithm and demo Theoretical complexity Conclusion Attack reports are difficult to “parse” 2 / 19

Formal setting Algorithm and demo Theoretical complexity Conclusion Attack tree as recipe of attack task steal painting turn security off take painting enter museum disable camera 1 disable camera 2 enter door a enter door b leaf Primitive task OR node Execute one of the subtasks AND node Execute subtasks “concurrently” SAND node Execute subtasks sequentially 3 / 19

Formal setting Algorithm and demo Theoretical complexity Conclusion Our contribution: library-based attack tree synthesis An attack (e.g. log file) Synthesis An attack tree steal painting turn security off enter museum take painting disable camera 1 disable camera 2 enter door a enter door b A library 4 / 19

Formal setting Algorithm and demo Theoretical complexity Conclusion Outline Formal setting 1 Algorithm and demo 2 Theoretical complexity 3 Conclusion 4 5 / 19

Formal setting Algorithm and demo Theoretical complexity Conclusion Outline Formal setting 1 Algorithm and demo 2 Theoretical complexity 3 Conclusion 4 6 / 19

Formal setting Algorithm and demo Theoretical complexity Conclusion An attack formalized as a trace: 7 / 19

Formal setting Algorithm and demo Theoretical complexity Conclusion Library A catalog of known attack patterns steal painting turn security off take painting 1 enter museum turn security off disable camera 1 disable camera 2 2 turn security off goto the center blow up a bomb 3 disable camera 1 ¬ monitor 1 to frozen 1 4 8 / 19

Formal setting Algorithm and demo Theoretical complexity Conclusion Semantics of attack trees steal painting turn security off enter museum take painting disable camera 1 disable camera 2 enter door a enter door b attack tree explains trace t if leaf t achieves primitive task (direct notion) OR node at least one child tree explains t AND node t is a merge of traces explained by child trees SAND node t is a sequence of traces explained by child trees 9 / 19

Formal setting Algorithm and demo Theoretical complexity Conclusion Library-based attack tree synthesis A trace Synthesis An attack tree steal painting turn security off take painting enter museum disable camera 1 disable camera 2 enter door a enter door b A library Synthesis specifications : build an attack tree that explains the input trace 1 rests upon the input library 2 10 / 19

Formal setting Algorithm and demo Theoretical complexity Conclusion Outline Formal setting 1 Algorithm and demo 2 Theoretical complexity 3 Conclusion 4 11 / 19

Formal setting Algorithm and demo Theoretical complexity Conclusion Attack tree synthesis ∼ Parsing Algorithmic principles Trace ∼ Formal word Library attack patterns ∼ Grammar rules Attack tree ∼ Syntactic tree Bottom-up approach ∼ Cocke-Younger-Kasami parsing algorithm 12 / 19

Formal setting Algorithm and demo Theoretical complexity Conclusion Online tool http://attacktreesynthesis.irisa.fr/ 13 / 19

Formal setting Algorithm and demo Theoretical complexity Conclusion Outline Formal setting 1 Algorithm and demo 2 Theoretical complexity 3 Conclusion 4 14 / 19

Formal setting Algorithm and demo Theoretical complexity Conclusion Theoretical complexity Theorem The library-based attack tree synthesis is NP-complete. Still, polynomial in the length of the input trace! NP-membership: given algorithm NP-hardness: reduction from the Packed Interval Coverage, essentially due to AND operator. Theorem For bounded AND -arity libraries, synthesis is in P . 15 / 19

Formal setting Algorithm and demo Theoretical complexity Conclusion Outline Formal setting 1 Algorithm and demo 2 Theoretical complexity 3 Conclusion 4 16 / 19

Formal setting Algorithm and demo Theoretical complexity Conclusion Conclusion A formal library-based attack tree synthesis problem An algorithm and an online protoype tool A complete study of the theoretical complexity ⇒ Algorithm essentially optimal Bounded AND -arity in libraries is a realistic assumption 17 / 19

Formal setting Algorithm and demo Theoretical complexity Conclusion Perspectives Theoretical: More abstract attack patterns: first-order features in rules as in (Jhawar et al. 2018) and (Ivanova et al. 2015) Library-based attack tree synthesis for a set of traces Practical: Scalability of the tool, e.g. parsing optimisation techniques Bridge the gap with libraries in practice, e.g. MITRE-ATT&CK 18 / 19

Formal setting Algorithm and demo Theoretical complexity Conclusion Thank you for your attention! 19 / 19