Software tool and method for analyzing network security vulnerabilities

Abstract

A system and method for analyzing potential cyber-security threats in an engineered system combines a functional simulation of the system with a cyber-attack information layer. And the network attack information layer informs simulation of the influence of potential network attacks on equipment and links in the system. Iterative AI-based sequential decision optimization identifies a sequence of attacker steps for implementing a network attack that has the greatest impact on key performance metrics related to the operation of the system. The network attack information layer includes information related to topologies and devices in the system from the perspective of the computer network and information about the workload required to implement possible attacks affecting each device or communication link in the system. The sequential decision optimization may run iteratively between simulation and network attack information layers to find a sequence of most effective attacker actions.

Description

Technical Field

[0001] The present application relates to network security. In particular, the present application relates to analyzing network security vulnerabilities in engineered systems. Background Art

[0002] There are many tools and methods for cybersecurity analysis of engineered systems. However, an important characteristic of all such tools and methods is that they consider the system exclusively from the perspective of computer networks, without direct integration with the system functionality / operational behavior of operational technology (OT) systems. This omission is important because adversarial attacks often target the disruption of OT system operations. Summary of the invention

[0003] The present disclosure provides a software tool that can identify the most critical cybersecurity vulnerabilities associated with engineered systems. It is particularly useful for analyzing scenarios where the hostile goal is to disrupt the operation of such systems. The tool integrates a layer of cybersecurity related information into an existing simulation model that represents the operation / functionality of the system of interest. The computer network devices and connections represented in the present invention can be associated with corresponding components in the simulation and their behavior after a cyber attack. A key aspect of the tool is the application of a tree search method for sequential decision optimization, thereby generating the most effective attack vector that affects the key performance indicators (KPIs) of interest for a defined attacker profile.

[0004] A system and method for analyzing cybersecurity vulnerabilities in an engineered system combines a functional simulation of the system with a cyberattack information layer. The cyberattack information layer informs the simulation about the impact of potential cyberattacks on devices and links in the system. An iterative AI-based sequential decision optimization identifies a sequence of attacker steps for implementing a cyberattack that has the greatest impact on key performance indicators related to the operation of the system. The cyberattack information layer includes information related to the topology and devices in the system from the perspective of a computer network, and includes information about the effort required to implement a possible attack that affects each device or communication link in the system. The sequential decision optimization can iteratively run between the simulation and the cyberattack information layer to find the most effective sequence of attacker actions. BRIEF DESCRIPTION OF THE DRAWINGS

[0005] The foregoing and other aspects of the present invention will be best understood from the following detailed description when read in conjunction with the accompanying drawings. For the purpose of illustrating the invention, there are shown in the accompanying drawings presently preferred embodiments, however, it should be understood that the invention is not limited to the specific tools disclosed. The drawings include the following illustrations:

[0006] Figure 1is an illustration of an architecture for analyzing cybersecurity vulnerabilities according to aspects of embodiments of the present disclosure. A functional simulation / digital twin of the engineered system 110 being analyzed can be created based on standard engineering design tools or programming languages ​​such as Matlab / Simulink or Python. As a standard functional simulation of the system, the simulation model can usually be obtained from previous development associated with other types of analysis. DETAILED DESCRIPTION

[0007] The network attack information layer 120 contains information about the topology and devices associated with the system from the perspective of the computer network. This can include information about possible attacks that can be performed to affect each device or communication link. Information 125 is exchanged between the network attack information layer 120 and the functional simulation model 110, and in addition, information related to the corresponding metrics of the associated work required to implement each attack is also exchanged.

[0008] The sequential decision optimization framework 130 iteratively operates between the functional model 110 and the cyber attack information layer 120 to produce a sequence of attacker steps for causing the greatest disruption to system operation. Disruption can be measured and optimized based on configurable KPIs associated with system operation. This can be achieved using artificial intelligence (AI) based techniques, or other optimization techniques can be used.

[0009] The network attack information layer 120 contains information about the system topology. According to an embodiment, the topology information is encoded using the NetJSON format and includes a list of computer network devices in the system and their corresponding interconnections. Once the system simulation 110 and the network attack information 120 are available, optimization 130 can be employed to obtain the most effective attack path. A Monte Carlo Tree Search (MCTS) based approach can be employed for this purpose. The optimization goals are defined based on system KPIs, which can be evaluated using the simulation model. For each device and network link, information about possible attacker actions is also included. As shown in reference Figure 2 As described, the information is structured into layers.

[0010] For devices, information related to each device: The following layers are provided, Exposure - refers to initial access to the device (e.g., remote login through an open port). The next layer is Exploitability or the ability to gain access to the internals of the device (e.g., privilege escalation) in order to achieve terminal effects or gain access to other parts of the network. The final layer for devices is terminal effects. Terminal effects are related to achieving hostile actions that affect the operation of the system, including but not limited to changing the operating mode of the device.

[0011] For network links, two layers include exposure: gaining access to a network link, such as port mirroring. The second layer is terminal effects, which are similar to device terminal effects and represent implementation-hostile actions that affect system operation. For example, terminal effects on a network link can include false data injection and other actions.

[0012] refer to Figure 2 , hierarchical device descriptions can be described using the NetJSON format 211. Network links can be implemented in the same way and are described in the following sections for brevity. Figure 2 Not shown.

[0013] An attack scenario can be defined as a sequence of adversarial actions. The software tool tracks the state of each device and network link and their transitions after each adversarial action. Figure 3 The diagram illustrates the state transitions associated with a particular device or network link. Each possible action is also associated with the associated work involved in performing that action. Figure 3 , which is encoded as cost and duration. Here, “cost” refers to an abstract measure of effort that only has relative meaning when comparing possible attacker actions to each other. In this example, information about the device is represented in NetJSON format, including exposure, exploitability, and terminal effects layers.

[0014] For example, different attacker profiles can be considered by defining an attacker budget, which represents an upper limit on the total work that an attacker can perform during the entire attack. In addition, the attacker profile can account for the skill level of the potential attacker, such as an unskilled hacker or "script kiddie", a skilled hacker, a security researcher or penetration tester, a normal or privileged malicious user, or a state-sponsored attack or malicious company.

[0015] refer to Figure 3 , device X may include an entry point into the system through device X 301. If the state of device X is accessible 303, an action of an exploit targeting device X may occur 304. This updates the state of device X to exploited 305. Once device X is exploited, the possibility of other exploits that may gain access to other devices 307 may arise. Other attacks accessible through exploit A due to the exploitation of device X may also be activated 309. The execution of exploit A may cause a partial list of devices connected to device X to become visible 311.

[0016] Similarly, there may be scenarios 330 where device X is not involved in a given scenario. Exploitation 331 of another device connected to device X may cause device X to become visible 323, making device X a focus of potential attack. In a similar manner, network link L may be in an accessible state 321, which enables an entry point through link L. For the purposes of this discussion, link L may be connected to device X 320. Via link L, access may be made to cause device X to become visible 323. In addition, attacks 326 may be launched against other devices logically connected via link L. In addition, other devices connected to link L or attacks associated with link L may also become visible 322. Actions represented by dollar signs indicate that a portion of the attacker's budget must be used to perform the action. Changes in the state of some devices and links may be represented by clocks representing a time factor that must be considered as part of the overall attack.

[0017] Figure 4 An embodiment of another related aspect to be considered regarding attacker actions targeting network communications is illustrated, which is the distinction between network (physical) links and logical links. Network links are entities represented in the model that constitutes the network topology. Logical links, as defined herein, represent pairs of devices that are producers or consumers of communication information. Router 440 distributes communications between device 1 410, device 2 420, and device 3 430. Network links, such as the connection 445 between device 2 and the router, are indicated by solid line segments 445, 446, 447 in the figure. However, since router 440 is not a producer or consumer of information, router 440 is ignored when considering logical links 415, 425, as shown by dashed line segments. Logical links exist between device 1 and device 2 415, and between device 2 and device 3 425. Attacks performed by attackers are performed in network links 445, 446, 447, and characteristics such as cost depend on the network links. However, the consequences of the attack depend on the affected logical links 415, 425. Each network link may be associated with zero, one or more logical links.

[0018] The result of the simulation is a sequence of actions that can be performed by the attacker to maximize the impact on the defined system KPIs, thereby limiting the work to within the defined budget.

[0019] Figure 5A more specific example of the whole process is provided. According to one embodiment, the power system network includes three photovoltaic (PV) distributed energy resources (DER) 510, 520, 530 based on the IEEE 3-bus system. The system includes resistors R1 to R6 and nodes A, B, C. Assuming that a simulation model of the system is available, the model can be based on a tool such as OpenDSS.

[0020] Figure 6 The next step is illustrated, the creation of a network attack information layer including devices and network links, possible attacker actions, associated costs / times, and encoding of this information in NetJSON format. Figure 6 An embodiment of a computer network topology 600 and its association with power system devices is shown. Figure 6 , a visualization of a computer network topology 600 encoded in NetJSON Figure 5 The physical elements shown in the system 500 are shown in FIG. 6 . Arrows 610, 620, 630 indicate the correspondence between the computer network 600 and the devices in the power system 500. Once this information is available, an MCTS-based optimization can be performed based on defined KPIs that can be evaluated by the power system model, such as voltage unbalance (VUF), and subject to the constraints of the available attacker budget. From the perspective of a cyber attack, Figure 3 The flow chart is used during optimization to update the status of each device and network link.

[0021] Figure 7 The most effective attack path that affects the KPI of interest according to an embodiment of the present disclosure is visualized. The AI-based optimization evaluates the attacker's Figure 6 Action selection for node 600. Numbered nodes 701, 703, 704, 706, 707 and links 702, 705 indicate the order in which network devices or links are accessed and exploited by an adversary, as provided by numbered blocks 1 to 7. For each step in which the attacker performs an end-effect action, an example of the cumulative impact (%) on the KPI is shown. The result is the identification of the most critical vulnerabilities defined by the OT system KPIs and the likelihood of exploitation. For example, the KPI of interest may be voltage imbalance. In an embodiment, subsequent analysis may consist of defining a potential defense strategy that limits KPI disruption to 2%.

[0022] In summary, the disclosed embodiments provide direct integration of system functionality into cybersecurity analysis that does not exist in any existing tools. This integration is beneficial when analyzing and resolving vulnerabilities that could disrupt system operations. It allows for more precise estimation and quantification of the potential impact of a worst-case cyberattack in terms of standard operational KPIs that system operators are well aware of.

[0023] Figure 8 An exemplary computing environment 800 is illustrated within which embodiments of the present invention may be implemented. Computers and computing environments, such as computer system 810 and computing environment 800, are known to those skilled in the art and are therefore briefly described herein.

[0024] like Figure 8 As shown, computer system 810 may include a communication mechanism such as a system bus 821 or other communication mechanism for transferring information within computer system 810. Computer system 810 also includes one or more processors 820 coupled to system bus 821 for processing information.

[0025] The processor 820 may include one or more central processing units (CPUs), graphics processing units (GPUs), or any other processors known in the art. More generally, a processor as used in the present invention is a device for executing machine-readable instructions stored on a computer-readable medium for performing tasks, and may include any one of hardware and firmware or a combination of hardware and firmware. The processor may also include a memory that stores executable machine-readable instructions for performing tasks. The processor takes action based on information by manipulating, analyzing, modifying, converting, or transmitting information for use by an executable program or information device and / or by routing the information to an output device. For example, a processor may use or include the capabilities of a computer, a controller, or a microprocessor, and may be adjusted using executable instructions to perform special functions that cannot be performed by a general-purpose computer. The processor may be coupled (electrically coupled and / or as including an executable component) to any other processor to enable interaction and / or communication therebetween. A user interface processor or generator is a known element that includes an electronic circuit or software or a combination of both for generating a display image or a portion thereof. The user interface includes one or more display images, thereby enabling a user to interact with a processor or other device.

[0026] Continue to refer Figure 8, the computer system 810 may also include a system memory 930 coupled to the system bus 821 for storing information and instructions to be executed by the processor 820. The system memory 830 may include computer-readable storage media in the form of volatile and / or non-volatile memory, such as read-only memory (ROM) 831 and / or random access memory (RAM) 832. RAM 832 may include (one or more) other dynamic storage devices (e.g., dynamic RAM, static RAM, and synchronous DRAM). ROM 831 may include (one or more) other static storage devices (e.g., programmable ROM, erasable PROM, and electrically erasable PROM). In addition, the system memory 830 may be used to store temporary variables or other intermediate information during the execution of instructions by the processor 820. The basic input / output system 833 (BIOS) contains basic routines that help transfer information between elements within the computer system 810, such as at startup, and the basic routines may be stored in ROM 831. RAM 832 may contain data and / or program modules that are immediately accessible to and / or currently being operated on by processor 820. System memory 830 may additionally include, for example, an operating system 834, application programs 935, other program modules 836, and program data 837.

[0027] The computer system 810 also includes a disk controller 840 coupled to the system bus 821 to control one or more storage devices for storing information and instructions, such as a magnetic hard disk 841 and a removable media drive 842 (e.g., a floppy disk drive, a compact disk drive, a tape drive, and / or a solid-state drive). Storage devices may be added to the computer system 810 using an appropriate device interface, such as a small computer system interface (SCSI), integrated device electronics (IDE), a universal serial bus (USB), or FireWire.

[0028] The computer system 810 may also include a display controller 865 coupled to the system bus 821 to control a display or monitor 866 (such as a cathode ray tube (CRT) or a liquid crystal display (LCD)) for displaying information to a computer user. The computer system includes an input interface 860 and one or more input devices, such as a keyboard 862 and a pointing device 861, for interacting with a computer user and providing information to the processor 820. The pointing device 861 may be, for example, a mouse, a light pen, a trackball, or a click stick for transmitting direction information and command selections to the processor 820 and for controlling cursor movement on the display 866. The display 866 may provide a touch screen interface that allows input to supplement or replace the direction information and command selections transmitted by the pointing device 861. In some embodiments, a user-wearable augmented reality device 867 may provide input / output functionality, allowing the user to interact with both the physical and virtual worlds. The augmented reality device 867 communicates with the display controller 865 and the user input interface 860, allowing the user to interact with virtual items generated in the augmented reality device 867 by the display controller 865. The user may also provide a gesture, which is detected by the augmented reality device 867 and transmitted as an input signal to the user input interface 860 .

[0029] The computer system 810 may perform some or all of the processing steps of an embodiment of the present invention in response to the processor 820 executing one or more sequences of one or more instructions contained in a memory such as a system memory 830. Such instructions may be read into the system memory 830 from another computer-readable medium such as a magnetic hard disk 841 or a removable media drive 842. The magnetic hard disk 841 may contain one or more data stores and data files used by embodiments of the present invention. The data store contents and data files may be encrypted to increase security. The processor 820 may also be employed in a multi-processing device to execute one or more sequences of instructions contained in the system memory 830. In alternative embodiments, hard-wired circuits may be used instead of or in combination with software instructions. Therefore, the embodiments are not limited to any particular combination of hardware circuits and software.

[0030] As described above, the computer system 810 may include at least one computer-readable medium or memory for storing instructions programmed according to embodiments of the present invention and for containing data structures, tables, records, or other data described herein. The term "computer-readable medium" as used in the present invention refers to any medium that participates in providing instructions to the processor 820 for execution. Computer-readable media can take many forms, including but not limited to non-temporary media, non-volatile media, volatile media, and transmission media. Non-limiting embodiments of non-volatile media include optical disks, solid-state drives, magnetic disks, and magneto-optical disks, such as magnetic hard disks 841 or removable media drives 842. Non-limiting embodiments of volatile media include dynamic memory, such as system memory 830. Non-limiting embodiments of transmission media include coaxial cables, copper wires, and optical fibers, including wires that constitute the system bus 821. Transmission media can also take the form of sound waves or light waves, such as sound waves or light waves generated during radio wave and infrared data communications.

[0031] The computing environment 800 may also include a computer system 810 that operates in a networked environment using logical connections to one or more remote computers, such as a remote computing device 880. The remote computing device 880 may be a personal computer (laptop or desktop), a mobile device, a server, a router, a network PC, a peer device, or other common network node, and typically includes many or all of the elements described above with respect to the computer system 810. When used in a networked environment, the computer system 810 may include a modem 872 for establishing communications over a network 871, such as the Internet. The modem 872 may be connected to the system bus 821 via a user network interface 870 or via another appropriate mechanism.

[0032] The network 871 can be any network or system generally known in the art, including the Internet, an intranet, a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a direct connection or a series of connections, a cellular telephone network, or any other network or medium that can facilitate communication between the computer system 810 and other computers (e.g., a remote computing device 980). The network 871 can be wired, wireless, or a combination thereof. The wired connection can be implemented using Ethernet, a universal serial bus (USB), RJ-6, or any other wired connection generally known in the art. The wireless connection can be implemented using Wi-Fi, WiMAX, and Bluetooth, infrared, cellular networks, satellites, or any other wireless connection methods generally known in the art. Additionally, several networks can work alone or communicate with each other to facilitate communication in the network 871.

[0033] An executable application as used in the present invention includes code or machine-readable instructions for adjusting a processor to implement predetermined functions (such as those of an operating system, a contextual data acquisition system, or other information processing system), for example, in response to user commands or inputs. An executable program is a section of code or machine-readable instructions, a subroutine, or other distinct code segment, or portion of an executable application that is used to perform one or more specific processes. These processes may include receiving input data and / or parameters, performing operations on received input data and / or performing functions in response to received input parameters, and providing resulting output data and / or parameters.

[0034] A graphical user interface (GUI) as used in the present invention includes one or more display images generated by a display processor and implementing user interaction with a processor or other device and associated data acquisition and processing functions. The GUI also includes an executable program or executable application. The executable program or executable application adjusts the display processor to generate signals representing GUI display images. These signals are supplied to a display device, which displays images for viewing by a user. The processor, under the control of the executable program or executable application, manipulates the GUI display image in response to signals received from an input device. In this way, a user can use an input device to interact with the display image, thereby implementing user interaction with a processor or other device.

[0035] The functions and process steps of the present invention may be performed automatically or in whole or in part in response to user commands. Automatically performed activities (including steps) are performed in response to one or more executable instructions or device operations without the user directly initiating the activity.

[0036] The systems and processes of the accompanying drawings are not exclusive. Other systems, processes, and menus can be derived based on the principles of the present invention to achieve the same goals. Although the present invention has been described with reference to specific embodiments, it will be understood that the embodiments and variations shown and described herein are for illustrative purposes only. Modifications to the current design can be achieved by those skilled in the art without departing from the scope of the present invention. As described in the present invention, various systems, subsystems, agents, managers, and processes can be implemented using hardware components, software components, and / or combinations thereof. Any claim element herein shall not be interpreted according to the provisions of 35 USC 112, sixth paragraph, unless the element is explicitly stated using the phrase "for ... means".

Claims

1. A method for identifying and analyzing potential cybersecurity threats in an engineered system, comprising: storing information related to network security in a network security information layer; performing a functional simulation representative of the engineered system based at least in part on the information stored in the cybersecurity information layer; as well as Perform sequential decision optimization to identify the most effective cyber attack vectors with respect to key performance indicators (KPIs) of interest.

2. The method according to claim 1, wherein: The cybersecurity information layer includes topology and device information corresponding to the engineered system and information about potential cybersecurity attacks that can be performed to affect devices or communication links of the engineered system.

3. The method according to claim 2, wherein: The cybersecurity information layer also includes information regarding a measure of associated effort required to implement each of the potential cybersecurity attacks affecting a device or a communication link.

4. The method according to claim 1, wherein: The sequential decision optimization is achieved using artificial intelligence (AI) based techniques.

5. The method according to claim 3, wherein: One of the communication links is a logical link between the first device and the second device.

6. The method according to claim 3, wherein: One of the communication links is a physical network link between the first device and the second device.

7. The method according to claim 6, wherein: The physical network link connects the first device and a router.

8. The method according to claim 1, further comprising: The sequential decision optimization is iteratively performed to produce a sequence of attacker steps that causes maximum disruption to operation of the engineered system.

9. The method according to claim 8, further comprising: The sequential decision optimization is measured and optimized based on configurable key performance indicators (KPIs) associated with operation of the engineered system.

10. The method according to claim 1, further comprising: Information about the topology of the engineered system encoded in a netJSON format is stored in the network security information layer.

11. The method according to claim 10, wherein: Topology-hostile actions of devices in the engineered system are encoded into layers including an exposure layer, an exploitability layer, and a terminal effect layer.

12. The method according to claim 10, wherein: Topology-hostile behavior of communication links in the engineered system is encoded into layers including an exposure layer and a terminal effects layer.

13. The method according to claim 1, further comprising: During AI-based sequential decision optimization, the associated work required for each possible action taken by the attacker is considered.

14. The method according to claim 13, further comprising: During the AI-based sequential decision optimization, an attacker profile representing the skill level of the attacker is considered.

15. The method according to claim 1, wherein: AI-based sequential decision optimization is performed using Monte Carlo tree search.

16. A computer-based system for analyzing cybersecurity threats in an engineered system, comprising: A computer processor in communication with a non-transitory memory, the non-transitory memory storing computer instructions that, when executed by the computer processor, cause the computer processor to: performing a functional simulation of the engineered system; storing cyber attack information and performing said functional simulation of said engineered system in part on cyber security threat information; as well as Perform artificial intelligence (AI)-based sequential decision optimization to identify sequences of attacker actions.

17. The system of claim 16, further comprising computer instructions stored in the non-transitory memory, which, when executed by the computer processor, cause the computer processor to: A sequence of the attacker actions representing a most effective attack on the engineered system is identified based on a key performance indicator (KPI) of interest.

18. The system of claim 16, wherein: The network attack information includes information related to topology and devices in the engineered system from the perspective of a computer network.

19. The system of claim 16, wherein: AI-based sequential decision optimization is performed using Monte Carlo tree search.

20. The system of claim 16, further comprising computer instructions stored in the non-transitory memory, which when executed by the computer processor, cause the computer processor to: For each possible attack that affects a device or a communication link of the engineered system, a measure of the associated work required to implement each possible attack is calculated.

Images