A method for automatically deriving attack paths in a network.

Abstract

To provide a method for automatic derivation of attack paths in a network.SOLUTION: A method for automatic derivation of attack paths in a network, comprises: defining a network topology as an enhanced network topology based on packets exchanged within the network 10; identifying vulnerabilities in the topology as a vulnerability information artifact 20; constructing a network atomic attack database based on the topology and the vulnerabilities 30; receiving information on the network topology, information on the vulnerabilities, and the atomic attack database as an input and replacing its model with a pre-defined formal model 40; executing a pre-defined SMT-based model checker for the pre-defined formal model for searching for counterexamples 50; and deriving the attack paths from the counterexamples 60.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to the field of network security policies. In particular, the present invention relates to a method for automatically deriving attack paths in a network.

Background Art

[0002] Even managed networks are vulnerable to attacks resulting from security issues with various complex services. That is, a service that is secure when provided alone may provide an attacker with a vulnerability to exploitation when provided simultaneously.

[0003] Many current tools address vulnerabilities in the context of a single host. Nevertheless, it is important to address vulnerabilities resulting from the configuration of various hosts in a network. Secure cyber-physical systems (CPS) and Internet of Things (IoT) systems require an identification of how interdependencies among existing atomic vulnerabilities can be exploited by adversaries to simultaneously mount attacks that can gain unauthorized access to the system.

[0004] Network attack path analysis is an important method for analyzing the security situation of a computer network, which can automatically analyze the correlation between network vulnerabilities and potential threats resulting from the vulnerabilities. Normally, a correlation analysis of vulnerabilities and related information is performed. Features are conceptualized to construct atomic attacks and corresponding atomic attack databases.

[0005] A network attack model is composed of network connections and host configurations. By matching with atomic attacks in an attack database. A comparison algorithm is employed to search for potential attack paths that can lead to a specific attack target.

[0006] Creating an attack graph is an essential part of shaping a global view of network security, and an accurate attack graph plays a crucial role in system security. Manually constructing an attack graph consisting of over 100 nodes is cumbersome, error-prone, and impractical. Automation techniques for generating and analyzing attack graphs are known.

[0007] A well-known approach uses existing model-checking and architecture-descriptor tools to generate an attack graph that enumerates all possible sequences that atomic-level vulnerabilities may be exploited to gain unauthorized access to system security. The architecture-descriptor captures a formal representation of the networked system, its atomic vulnerabilities, their preceding and succeeding states, and the security properties in question. A model checker is employed to automatically identify attack sequences in the form of counterexamples. The model checker analyzes the counterexamples, encodes them for relaxation, and iterates until all attack sequences are revealed. Finally, a visualization tool may generate a graphical representation of the generated attack graph.

[0008] Therefore, it is necessary to ensure the accurate generation of attack paths and associated attack graphs. [Overview of the project] [Means for solving the problem]

[0009] The objective of the present invention is to provide a method for generating attack paths in the most accurate way possible using an SMT-based model checker.

[0010] In other words, the present invention describes a method for the automatic derivation of attack paths in a network.

[0011] A method for automatically deriving attack paths in a network is: Defining the network topology as an enhanced network topology based on the packets exchanged within the network, Identifying topology vulnerabilities as vulnerability information artifacts, Building an atomic attack database of networks based on topology and vulnerabilities, Replacing the reinforced network topology, the vulnerability information artifact, and the atomic attack database with a predefined formal model, To search for counterexamples, we run a predefined SMT-based model checker for a predefined formal model, This includes deriving attacking passes from counterexamples, Defining topology is A computer data processing unit connected to the network in an operational manner executes the network's deep packet inspection module to construct the network topology based on information derived from the deep packet inspection module, The computer data processing unit includes executing an active query module for the network to construct an enhanced network topology based on further information derived from packets by an active query for constructing an enhanced network topology, and adding further information to the network topology. Identifying vulnerabilities This includes a computer data processing unit running a vulnerability assessment module to identify vulnerability information artifacts for each node in the network based on the consistency between node information of the reinforced network topology and known vulnerabilities in a predefined vulnerability database, Building an atomic attack database The computer data processing unit includes, as a prerequisite, one or more atomic attacks on the network and the detection of an action that simultaneously captures the state of the system at a given moment, and this action is represented in terms of a set of features of that node.

[0012] In a further embodiment, the predefined formal model is a circuit formal model.

[0013] In a further embodiment, the SMT-based model checker is a circuit-based SMT-based model checker.

[0014] In a further embodiment, the circuit-based SMT model checker defines the circuit by a global clock that divides the execution into separate time steps.

[0015] In a further embodiment, the circuit is An initial input, which is a port into which data from an external input can flow into the circuit, Initial output as a port that can output data from the circuit, A latch as a basic memory element capable of holding data, Gates as stateless combination elements that execute basic logic functions, Comparators as stateless comparators, Includes constants as numbers, which are boolean or symbolic constants that output the same value at all time steps.

[0016] In a further embodiment, the initial input is of boolean or integer type.

[0017] In a further embodiment, the initial output is of boolean or integer type.

[0018] In a further embodiment, the latch is of boolean or integer type.

[0019] In a further embodiment, the latch stores a first value representing the value held when the circuit was started at the first time step.

[0020] In a further embodiment, the latch is updated with a new value for each subsequent time step.

[0021] In a further embodiment, the basic logic functions of the gates are AND, OR, NOT.

[0022] In a further embodiment, the gates take boolean-type data and return boolean-type data.

[0023] In a further embodiment, the stateless arithmetic comparator is ≦, <, =, >, ≧.

[0024] In a further embodiment, the stateless arithmetic comparator takes integer-type data and returns boolean-type data.

[0025] In a further embodiment, at each time step, the initial input value of the initial input at the current time step is read, the initial input value of the current time step and the latch value in the latch of the current time step are processed by the gate, the latch value in the subsequent time step is generated by the comparator, the initial output value of the initial output at the current time step is generated by the comparator.

[0026] In a further embodiment, a latch is created for each node and each feature of each node, and the value of the latch at each time step defines the state of the system for each time step.

[0027] The above and further features and advantages of the present invention will become apparent from the disclosure of the preferred embodiments illustrated in the accompanying drawings in a non-limiting manner.

Brief Description of the Drawings

[0028] [Figure 1] This shows a block diagram based on one embodiment of the present invention. [Figure 2] This diagram shows a circuit modeling a network, according to one embodiment of the present invention. [Modes for carrying out the invention]

[0029] This invention relates to a method for the automatic derivation of attack paths in a network.

[0030] The method according to the present invention discovers useful applications for industrial automation systems, particularly in all types of physical infrastructure and networked automation systems, such as industrial processes for manufacturing industries, industrial processes for power generation, infrastructure for the distribution of fluids (water, oil, and gas), infrastructure for the production and / or transmission of electricity, and infrastructure for transportation management. Furthermore, it discovers useful applications in all technological environments, including information technology (IT), operational technology (OT), or the Internet of Things (IoT).

[0031] In this invention, the term "network protocol" means a system of rules between entities on a network that describe how the bytes constituting the exchanged messages should be structured so that the entities can understand each other. Notable examples of network protocols include TCP / IP, Modbus, and BACnet.

[0032] In this invention, the term "packet" means a finite sequence of bytes representing a message exchanged between entities on a network. Each protocol defines a specific structure for packets to be transmitted or received.

[0033] In this invention, the term "node" means a device in a network that can receive and / or transmit data over a connection based on cable or wireless signals. A node is defined by a unique identifier, which may be, for example, a MAC address or an IP address.

[0034] In this invention, the term "edge" refers to direct communication between nodes n1 and n2 in a network via protocol p, which can be represented as (n_1, p, n_2). Several edges can exist between the two nodes, each utilizing a different communication protocol.

[0035] In this invention, the term "network topology graph" means an abstraction of a network structure, which can be represented as a labeled graph G(N,E,P), where N is a set of nodes, E is a set of edges, and P is a set of protocols such that each edge is a tuple of (n_1,p,n_2) when n_1,n_2∈N, n_1≠n_2, and p∈P.

[0036] In this invention, the term “atomic attack” refers to an attack involving two nodes in a network. An atomic attack is described in detail as prerequisites and behavior. Prerequisites are a list of conditions that must be held in order to trigger the attack. For example, “The target node has vulnerability xyz.” Behavior is the effect of the attack, for example, “The attacker gains root privileges on the target node.”

[0037] In this invention, the term "attack path" means a path in the network topology graph that starts at a source node n_1 considered to be the attacker, passes through edges e_1, e_2, ..., e_m (which can also be denoted as e_1, e_2, ..., e_m), and ends at a target node n_(m+1) considered to be the victim. Each edge represents the execution of an atomic attack. Furthermore, each node in the path other than n_1 is considered to be running software that is vulnerable to attacks such as buffer overflows.

[0038] In this invention, the term "deep packet inspection" or "DPI" refers to a technique that consists of listening to network traffic and examining captured packets to derive network properties. For example, source information and the destinations of a sufficient number of packets can be used to construct a network topology graph.

[0039] In the present invention, the term “active query” or “AQ” means a method of deriving network information by sending coordinated data to a network device in order to cause it to respond with requested configuration information, such as the OS version running on the device.

[0040] In this invention, the term "vulnerability" means a weakness in a hardware component or software used on a device that could potentially be exploited by an attacker to gain unauthorized access to the system, steal confidential information, or obtain administrator privileges on the device. A list of known vulnerabilities can be obtained through publicly available online resources, such as those provided by the organization Mitre in JSON, XML, or other machine-readable formats.

[0041] In the present invention, the term "vulnerability assessment" means a software or hardware module that receives a list of software installed on a machine as input and outputs a set of vulnerabilities affecting the software based on a vulnerability database.

[0042] In this invention, the term “formal model” is equivalent to a set of techniques for approaching a solution to a problem by recalculating it into a formal language, such as a set of mathematical or logical expressions. These expressions can be solved by automated tools, and the solutions can be reduced to a solution to the original problem. One of the most well-known techniques is model checking, which replaces a problem with an automaton of finite states. Model checking is well employed in industrial settings for hardware and software safety assessments by model checkers.

[0043] The method for automatically deriving attack paths in a network according to the present invention will be described with reference to Figure 1, which shows a block diagram according to one embodiment of the present invention, and Figure 2, which shows a circuit modeling the network according to a related embodiment of the present invention.

[0044] This method involves defining the network topology as an enhanced network topology based on the packets exchanged within that network, as illustrated in block 10.

[0045] In particular, defining the network topology involves enabling computer data processing units connected to the network to execute a network deep packet inspection module and a network active query module, as illustrated in the subblock of block 10 in Figure 1.

[0046] The Deep Packet Inspection (DPI) module constructs the network topology based on the information derived by the Deep Packet Inspection module.

[0047] Therefore, the network topology can be automatically compiled from the network using a machine connected to the same network and performing DPI on the traffic running through the network. For example, the network topology can be reconstructed as follows: for each packet, create a node for the source, a node for the destination, and an edge connecting the two nodes, marked by a recognized protocol. Thus, it becomes possible to identify devices on the network in an accurate manner and construct a corresponding network topology graph. This information can be easily exported in a machine-readable format. DPI can also be used to infer information about the operating system and software running on a particular device.

[0048] The Active Query (AQ) module constructs an enhanced network topology by using Active Queries to build an enhanced network topology based on further information derived from packets, adding further information to the network topology as already defined with Deep Packet Inspection.

[0049] The fact that the DPI and AQ modules operate for a sufficient period of time allows for the production of a highly detailed knowledge base based on the network being inspected.

[0050] Furthermore, the method includes identifying vulnerabilities in the topology as vulnerability information artifacts, as illustrated in block 20.

[0051] In particular, identifying vulnerabilities involves a computer data processing unit running a vulnerability assessment module to identify vulnerability information artifacts for each node in the network based on the consistency between node information of the reinforced network topology and known vulnerabilities in a predefined vulnerability database.

[0052] In particular, identifying vulnerabilities involves a computer data processing unit running a vulnerability assessment module to identify vulnerability information artifacts for each node in the network based on the consistency between node information of the reinforced network topology and known vulnerabilities in a predefined vulnerability database.

[0053] As illustrated by the dashed arrow connecting block 10 to block 20, identifying vulnerabilities involves matching them with software information available on network nodes obtained by the AQ module, which includes DPI and vulnerability databases, and adding known vulnerabilities associated with the running software to each node in the network graph. This process produces vulnerability information artifacts.

[0054] Furthermore, the method includes building an atomic attack database of the network based on topology and vulnerabilities, as illustrated in block 30.

[0055] In particular, constructing an atomic attack database involves a computer data processing unit discovering one or more atomic attacks against a network as preconditions and actions that capture the system state simultaneously at a given moment, with the actions represented in units of a set of node features.

[0056] As illustrated by the dotted arrow connecting block 10 to block 30, constructing the atomic attack database uses information about the software available on the network nodes, acquired by the AQ module along with the DPI and vulnerability databases, to simultaneously capture the system state at a given moment.

[0057] Therefore, the atomic attack database is a list of actions that are successively represented as atomic attacks described in the premise and a set of node features that need to capture the state of the system simultaneously at a given moment, which will be better understood by the examples that follow.

[0058] Consider the following characteristics: Permissions: This is the level of permission a user had regarding a node. This can be assumed to have values ​​such as {none,user,admin}. Health: This is the health status of the node. It can be assumed to have values ​​of { ok, leak}. CVE-2016-3266: This checks whether a vulnerability exists on the node. It can be assumed to have a value of { true, false}. This vulnerability allows a local user to gain administrator privileges on the target node. CVE-2020-3847: This checks whether a vulnerability exists on the node. It can take the value { true, false}. This vulnerability allows a remote user to leak memory from the target node. Given a node x and a feature k, the notation x[k] is used to refer to the current state of the node, and the notation x'[k] is used to refer to the next state of the node. This feature can be used to explain two atomic attacks, assuming that x and y are connected within the network, as follows: The first attack can be formalized as follows: CVE-2020-3847 memory leak Source machine: x Target machine: y Prerequisites: (x[permissions]=user)∧ (y[health]=ok)∧ (y[CVE_2020_3847]=true) Post-conditions: y^' [health]=leak The second attack can be formalized as follows: CVE-2016-3266 Privilege Gain The source machine and target machine must be identical: x Prerequisites: (x[permissions]=user)∧ (x[CVE_2016_3266]=true) Post-conditions: x^' [permissions] = admin We assume that the database is compiled by security experts and that the contents within the database are available in a machine-readable format such as JSON, XML, or CSV.

[0059] Furthermore, this method includes replacing the reinforced network topology, that is, replacing the vulnerability information artifacts and atomic attack database with predefined formal models, as illustrated in block 40. As illustrated by the solid arrows converging from blocks 10, 20, and 30 to block 40, the translation module receives network topology information, vulnerability information, and atomic attack database as input and replaces their models with predefined formal models.

[0060] In one embodiment, the predefined formal model is a circuit-based formal model.

[0061] Furthermore, the method includes running a predefined SMT-based model checker for a predefined formal model to search for counterexamples, as illustrated in block 50. Running the predefined SMT-based model checker is done for the predefined formal model, as illustrated by the solid arrow from block 40 to block 50.

[0062] In one embodiment, the SMT-based model checker is a circuit-based SMT-based model checker. Furthermore, the circuit-based SMT-based model checker defines the circuit by a global clock that divides execution into separate time steps. Preferably, this includes: — An initial input, which is a port into which data from an external input can flow into the circuit. — An initial output, which is a port that can output data from the circuit. —A latch as a basic memory element capable of holding data. —Gates as stateless combination elements that execute basic logic functions. —A comparator as a stateless comparator. —A constant as a number, which is either a boolean or a symbolic constant, that outputs the same value at every time step.

[0063] The input language is sometimes defined as the Intrepid model checker. In particular, the Intrepid input language, like other circuit model checkers, allows for the depiction of circuits by a global clock that divides execution into separate time steps. The circuit consists of: —Initial Input (PI): A port through which external input data can flow into the circuit. It can take the form of a boolean or an integer. —Initial Output (PO): A port from which data can flow out of the circuit. It can take the form of a boolean or an integer. ―Latch: A basic memory element capable of holding data. It can hold boolean or integer values. Furthermore, it stores the initial value (first value) that represents the value held when the circuit was first activated (time step 0). The latch is updated with a new value at each subsequent time step. ―Gates: Stateless combination elements that execute basic logic functions such as AND, OR, and NOT. They take boolean data and return boolean data. Comparator: A stateless comparator that handles operators like ≤, <, =, >, ≥. It takes integer data and returns boolean data. Constant: A number of boolean or symbolic constants that output the same number at every time step.

[0064] The circuit operates as follows: At each time step, the initial input value of the current time step's initial input (PI) is read. These initial input values ​​for the current time step, along with the latch value of the current time step's latch, are processed by a gate. The latch value for the subsequent time step is generated by a comparator, and the initial output (PO) value of the current time step's initial output is generated by a comparator. A latch is created for each node and each node's feature. Furthermore, the latch value for each time step defines the system state for each time step.

[0065] To perform a substitution, a collection of the states of all target systems is required. These states can be gathered from an atomic attack database: they are all sets of features F mentioned in all atomic attacks. Then, for each node n and each feature k, a latch n[k] is created, totaling |N| × |F| latches. The sets of values ​​stored in these latches at time t represent the state of the network at time t. Each latch is initialized to the state of the network immediately before the first atomic attack begins. An implicit assumption is made that one atomic attack correctly executes one step within the substitution. An atomic attack can occur at each time step. Each atomic attack is identified by an integer ID. During the substitution, a chosen attack (chosen_attack) of PI is created: this input simulates the selection of a non-deterministic attack that occurs at a given time step. The next state logic for each latch is then computed by the circuit uniformity of "case statements" that depend on the chosen attack and the preconditions of each attack.

[0066] Consider the following example. Assume the network consists of two nodes x and y connected by an edge, and consider the setup in Example 1. The circuit that models the next state function of latch y[health] is reported by Figure 2 (in the figure, the next state function x[authority], y[CVE_2020_3847], and the rest of the circuit are not shown).

[0067] The circuit substitutions described above can be implemented in Intrepid via its own Python API. The API exposes functions for creating inputs, latches, gates, constants, and comparators, and for setting the initial and subsequent state functions of latches.

[0068] The next thing needed to run the model checker is properties. Properties are conditions that must apply to all network states. For example, properties never(y[permissions]=admin) This indicates that an attacker can never gain administrator privileges on node y within the network. In circuit substitution, properties may be represented with small subcircuits, which are sets within a model checker whose output is always a fixed value.

[0069] Furthermore, the method includes deriving an attacking pass from a counterexample, as illustrated in block 60.

[0070] Running the model checker can be very time-consuming, but it will eventually terminate by declaring that the property always exists within the system, or by providing a counterexample that is a set of states leading from the initial state to a compromise of the property. In this example, the compromise of the property corresponds to, for example, discovering an attack path that allowed administrator privileges to be gained on the target machine.

[0071] A counterexample from Intrepid is that it lists the values ​​of each latch and input at every time step, which makes it possible to reconstruct each atomic attack for each step.

Claims

1. A method for automatically deriving attack paths in a network, (10) The network topology is defined as an enhanced network topology based on the packets exchanged within the network, Identifying the vulnerability of the topology as a vulnerability information artifact (20), (30) Constructing an atomic attack database of the network based on the topology and the vulnerability, Replacing the aforementioned reinforced network topology, vulnerability information artifacts, and atomic attack database with a predefined formal model (40), To search for counterexamples, run a predefined SMT-based model checker for the predefined formal model (50), (60) Deriving the attack pass from the counterexample, Defining the topology (10) A computer data processing unit connected to the network in an operational manner executes the network's deep packet inspection module to construct the network topology based on information derived from the packets by the deep packet inspection module, The computer data processing unit executes the network's active query module to construct the enhanced network topology based on further information derived from the packets by active queries for constructing the enhanced network topology, and adds the further information to the network topology, Identifying the aforementioned vulnerability (20) The computer data processing unit includes running a vulnerability assessment module to identify the vulnerability information artifact for each node of the network based on the consistency between the node information of the reinforced network topology and known vulnerabilities in a predefined vulnerability database. Constructing the atomic attack database (30) A method for the automatic derivation of attack paths in a network, comprising, as a prerequisite, the computer data processing unit discovering one or more atomic attacks against the network and an operation to simultaneously capture the state of the system at a given moment, wherein the operation is expressed in terms of a set of node features.

2. The method for automatically deriving attack paths in a network according to claim 1, wherein the predefined formal model is a circuit formal model.

3. The method for automatically deriving an attack path in a network according to claim 1, wherein the SMT-based model checker is a circuit-based SMT-based model checker.

4. The method for automatically deriving an attack path in a network according to claim 3, wherein the circuit-based SMT model checker defines the circuit by a global clock that divides execution into separate time steps.

5. The aforementioned circuit, An initial input, which serves as a port into which data from an external input can flow into the circuit, The circuit has an initial output as a port from which it can output the data, A latch as a basic memory element capable of holding the aforementioned data, Gates as stateless combination elements that execute basic logic functions, Comparators as stateless comparators, A constant, which is a number of boolean or symbolic constants, that outputs the same value at all of the aforementioned time steps, A method for automatically deriving an attack path in a network according to claim 4.

6. The method for automatically deriving an attack path in a network according to claim 5, wherein the initial input is of boolean or integer type.

7. The method for automatically deriving an attack path in a network according to claim 5, wherein the initial output is of boolean or integer type.

8. The method for automatically deriving an attack path in a network according to claim 5, wherein the latch is of boolean or integer type.

9. A method for automatically deriving an attack path in a network according to claim 5, wherein the latch stores a first value representing the value held when the circuit is activated in the first time step.

10. The method for automatically deriving an attack path in a network according to claim 9, wherein the latch is updated with a new value at each subsequent time step.

11. The method for automatically deriving an attack path in a network according to claim 5, wherein the basic logic function of the gate is AND, OR, or NOT.

12. A method for automatically deriving an attack path in a network according to claim 5, wherein the gate takes the boolean data and returns the boolean data.

13. A method for automatically deriving an attack path in a network according to claim 5, wherein the stateless comparator is ≤, <, =, >, ≥.

14. The method for automatically deriving an attack path in a network according to claim 5, wherein the stateless comparator takes integer data and returns boolean data.

15. In each of the aforementioned time steps, the initial input value of the initial input for the current time step is read, The initial input value at the current time step and the latch value at the current time step are processed by the gate. The value of the latch in the subsequent time step is generated by the comparator. The initial output value of the initial output at the current time step is generated by the comparator. A method for automatically deriving an attack path in a network according to claim 5.

16. A latch is created for each of the nodes and each of the features of each node, and the value of the latch at each time step defines the state of the system for each of the time steps, the method for automatically deriving an attack path in a network according to claim 15.

Images