Method for automatic derivation of attack paths in a network

Abstract

This invention discloses an automatic method for deriving attack paths in a network, comprising: defining the network topology as a rich network topology; identifying vulnerabilities in the topology as vulnerability information artifacts; establishing an atomic attack database for the network based on the topology and the vulnerabilities; converting the rich network topology, the vulnerability information artifacts, and the atomic attack database into a predefined formal model; performing a predefined model checker based on satisfiability model theory on the predefined formal model to find counterexamples; and deriving the attack path from the counterexamples. Therefore, through the method of this invention, attack paths can be generated in the most accurate way.

Description

Technical Field

[0001] This invention relates to the field of network security principles. In particular, this invention relates to a method for automatically deriving attack paths in a network. Prior Technology

[0002] Even well-managed networks are vulnerable to attack due to the security implications of providing various combined services. In other words, a service may be secure when offered individually, but when offered simultaneously, it provides attackers with exploitable vulnerabilities.

[0003] Many current tools address vulnerabilities in individual hosts. However, addressing vulnerabilities stemming from the configurations of various hosts across a network is crucial. Cyber-physical systems (CPS) and Internet of Things (IoT) systems require identifying how adversaries can exploit the interdependencies between existing atomic vulnerabilities to combine attacks that could compromise the system.

[0004] Network attack path analysis is an important method for analyzing the security status of computer networks. It can automatically analyze the correlation between network vulnerabilities and the potential threats they pose.

[0005] Typically, vulnerabilities and related information are correlated and analyzed to extract attributes and construct atomic attacks and corresponding atomic attack databases. Network attack models consist of network connections and host configurations. By matching atomic attacks in the attack database, comparative algorithms are used to uncover potential attack paths that could lead to specific attack targets.

[0006] A component of comprehensive network security view modeling is the construction of attack graphs, where accurate attack graphs play a crucial role in system security. For attack graphs involving more than one hundred nodes, manually constructing them is tedious, error-prone, and impractical. Automated techniques for generating and analyzing attack graphs are known.

[0007] A well-known approach is to use existing model checking and structural description tools to generate attack graphs, which enumerate all possible sets of sequences where atomic vulnerabilities can be exploited to compromise system security. The structural description tool captures the formal representation of the network system, its atomic vulnerabilities, their preconditions and postconditions, and the security properties of interest. A model checker is used to automatically identify attack sequences in the form of counterexamples. The model checker parses the counterexamples, encodes them to relax specifications, and performs iterative operations until all attack sequences are revealed. Finally, a visualization tool can generate a graphical representation of the attack graph.

[0008] Therefore, it is necessary to ensure the generation of accurate attack paths and related attack graphs. Summary of the Invention

[0009] The purpose of this invention is to provide a method for generating attack paths in the most accurate way using a model checker based on satisfiability model theory (SMT-based).

[0010] Therefore, according to the present invention, a method for automatically deriving attack paths in a network is described.

[0011] An automatic method for deriving attack paths in a network, comprising: - The topology of the network is defined as a rich network topology based on packet switching in the network; - Identify vulnerabilities in the topology as vulnerability information artifacts; - Establish an atomic attack database for the network based on the aforementioned topology and vulnerabilities; - Convert the rich network topology, the vulnerability information artifact, and the atomic attack database into a predefined formal model; - Perform a predefined model checker based on satisfiability model theory on the predefined formal model to find counterexamples; and - Derive the attack path from the counterexample; The definition of the network topology includes: - A deep packet inspection module of the network is operated by a computerized data processing unit operably connected to the network to establish a network topology based on information extracted from the packets by the deep packet inspection module; - An active query module of the network is run by a computerized data processing unit to build the rich network topology based on further information exported from the packets by active querying to construct the rich network topology, and to add the further information to the network topology; The vulnerabilities identified in the topology include: - A vulnerability assessment module is run by the computerized data processing unit to identify the vulnerability information artifact for each node in the network based on matching the rich node information of the network topology with known vulnerabilities in a predefined vulnerability database; and The establishment of the atomic attack database for the network (30) includes: - The computerized data processing unit detects one or more atomic attacks against the network as prerequisites and actions, and captures the state of the system at a given moment, wherein the actions are represented by a set of characteristics of the node.

[0012] In another embodiment, the predefined formal model is a circuit-like formal model.

[0013] In another embodiment, the model checker based on satisfiability modular theory is a similar circuit based on satisfiability modular theory.

[0014] In another embodiment, the model checker based on satisfiability model theory defines a circuit with a global clock that divides the execution into discrete time steps.

[0015] In another embodiment, the circuit includes: - Main input, which is the port through which data from external input can flow into the circuit; - Main output, serving as a port from which the data can flow out of the circuit; - A latch, serving as a basic storage device element capable of storing the data; - A gate, serving as a stateless combinational element that implements basic logic functions; - Comparator, as a stateless arithmetic comparator; - A constant, which is a numeric, Boolean, or symbolic constant that outputs the same value at each said time step.

[0016] In another embodiment, the main input is a Boolean type or an integer type.

[0017] In another embodiment, the main output is a Boolean type or an integer type.

[0018] In another embodiment, the latch is of type Boolean or integer.

[0019] In another embodiment, the latch stores a first value representing the value it holds when the circuit is started at a first time step.

[0020] In another embodiment, the latch is updated to a new value at each subsequent time step.

[0021] In another embodiment, the basic logical function of the gate is AND gate, OR gate, and reverse gate.

[0022] In another embodiment, the gate acquires the data of type Boolean and returns the data of type Boolean.

[0023] In another embodiment, the stateless arithmetic comparator is a ≤ comparator, < comparator, = comparator, > comparator, or ≥ comparator.

[0024] In another embodiment, the stateless arithmetic comparator obtains the data of integer type and returns the data of Boolean type.

[0025] In another embodiment, the main input value of the main input at the current time step is read at each time step; wherein the main input value at the current time step and the latch value of the latch at the current time step are processed by the gate; wherein the latch value at subsequent time steps is generated by the comparator; wherein the main output value of the main output at the current time step is generated by the comparator.

[0026] In another embodiment, a latch is created for each of the nodes and for each of the features of each node; wherein the latch value in each time step defines the state of the system in each time step. Simple Explanation of the Diagram

[0027] These and further features and advantages of the invention will become apparent from the disclosure of preferred embodiments, which are illustrated by non-limiting examples in the accompanying drawings, wherein: Figure 1 shows a block diagram according to an embodiment of the present invention; Figure 2 illustrates a circuit modeling network according to an embodiment of the present invention. Implementation

[0028] This invention relates to a method for automatically deriving attack paths in a network.

[0029] The method according to the invention finds useful applications in any kind of physical infrastructure or automated system connected in a network, particularly in industrial automation systems, such as industrial processes for manufacturing, industrial processes for power generation, infrastructure for fluid (water, oil, and natural gas) distribution, infrastructure for power generation and / or transmission, and infrastructure for transportation management. Furthermore, useful applications can be found in all technological environments, including information technology (IT), operation technology (OT), and the Internet of Things (IoT).

[0030] In this invention, the term "network protocol" refers to a system of rules governing interactions between entities on a network, describing how the bytes that make up the messages to be exchanged should be constructed so that the entities can understand each other. Notable examples of network protocols include the TCP / IP protocol, the Modbus protocol, and the BACnet protocol.

[0031] In this invention, the term "packet" refers to a finite sequence of bytes representing a message exchanged between entities on a network. Each protocol defines a specific structure for packets to be sent and received.

[0032] In this invention, the term "node" refers to a device in a network capable of receiving and / or sending data via a connection based on a cable or radio signal. A node is identified by a unique identifier, such as a MAC address or IP address.

[0033] In this invention, the term "edge" refers to a node in the network. and Through the agreement Direct communication, which can be, for example, labeled as There may be several edges between two nodes, and each communication protocol used has one edge.

[0034] In this invention, the term "network topology graph" is an abstraction of the network structure, which can be represented as a labeled graph G(N,E,P). Where N is a node group, E is an edge group, and P is a convention group such that each edge is a tuple. ,in , .

[0035] In this invention, the term "atomic attack" refers to an attack involving two nodes on a network. An atomic attack is described by preconditions and actions. Preconditions are a list of conditions that must be met to trigger the attack. An example is: "The target node has a vulnerability xyz." Actions are the effects of the attack, such as: "The attacker gains root privileges on the target node."

[0036] In this invention, the term "attack path" refers to a path in a network topology graph that traverses edges. From the source node From the start (assuming the attacker) to the target node The path ending (assuming the victim) can be, for example, marked as Each edge represents the execution of an atomic attack. Furthermore, it is assumed that the path contains, except for... Each node outside of this one runs vulnerable software, such as buffer overflow.

[0037] In this invention, the term "deep packet inspection" or "DPI" refers to a technique that involves listening to network traffic and examining captured packets to obtain network attributes. For example, information about the source and destination of a sufficient number of packets can be used to construct a network topology map.

[0038] In this invention, the term "active query" or "AQ" refers to a method of obtaining network knowledge, such as the operating system version on a device, by sending customized packets to a network device to force a response containing the required information.

[0039] In this invention, the term "vulnerability" refers to a weakness in the hardware or software components used by a device that an attacker could exploit to compromise the system, steal sensitive information, or gain administrative access to the device. Lists of known vulnerabilities can be obtained through publicly available online resources, such as those provided by the Mitre organization in JSON, XML, or other machine-readable formats.

[0040] In this invention, the term "vulnerability assessment" refers to a software or hardware module that receives a list of software installed on a machine as input and outputs a group of vulnerabilities affecting the software based on a vulnerability database.

[0041] In this invention, the term "formal model" refers to a set of techniques for solving a problem by re-expressing it in an equivalent but formal language, such as a set of mathematical or logical expressions. These expressions can then be solved using an automated tool, and the solution can be transformed back into a solution to the original problem. One of the most prominent techniques is model checking, where the problem is transformed into a finite state automaton. Model checking has been successfully used in industrial environments to determine the security of hardware and software through a model checker.

[0042] The following describes the automatic inference method for attack paths in a network according to the present invention with reference to Figure 1, which shows a block diagram according to an embodiment of the present invention, and Figure 2 shows a circuit modeling of the network according to an embodiment of the present invention.

[0043] The method includes defining the network topology as a rich network topology based on packets exchanged in the network, as shown in block 10.

[0044] Specifically, the network topology is defined as including a deep packet inspection module and an active query module of the network that are operated by a computerized data processing unit operably connected to the network, as shown in the sub-block of block 10 in Figure 1.

[0045] The deep packet inspection module establishes a network topology based on the information obtained from packets.

[0046] Therefore, the network topology can be automatically compiled from the network by machines connected to the same network, and deep packet inspection can be performed on the traffic passing through the network. For example, the network topology can be reconstructed as follows: for each packet, create a node for the source, create a node for the destination, and an edge with a tag identification protocol connecting the two nodes. Thus, devices on the network can be accurately identified, and the corresponding network topology graph can be constructed. This information can be easily exported in a machine-readable format. Deep packet inspection can also be used to infer information about the operating system and software running on a particular device.

[0047] The active query module constructs the rich network topology based on further information emanating from the packets through active queries, and adds the further information to the network topology as defined in the deep packet inspection.

[0048] Sufficiently long-running deep packet inspection and active query modules can generate a very detailed knowledge base of the network being inspected.

[0049] The method then includes identifying vulnerabilities in the topology as vulnerability information artifacts, as shown in block 20.

[0050] In particular, identifying the vulnerability involves running a vulnerability assessment module through the computerized data processing unit to identify vulnerability information artifacts for each node in the network based on matching the rich node information of the network topology with known vulnerabilities in a predefined vulnerability database.

[0051] In particular, the identification of the vulnerability includes running a vulnerability assessment module through the computerized data processing unit to identify vulnerability information artifacts of each node in the network based on the matching between the rich node information of the network topology and known vulnerabilities in a predefined vulnerability database.

[0052] As shown by the dashed arrow connecting blocks 10 and 20, the vulnerability identification process matches information about available software on network nodes obtained from deep packet inspection and active query modules with a vulnerability database to add known vulnerabilities related to the running software to each node in the network graph. A network graph containing known vulnerabilities related to the running software is generated. This process produces vulnerability information artifacts.

[0053] The method then includes establishing an atomic attack database for the network based on the topology and the vulnerabilities, as shown in block 30.

[0054] In particular, establishing the atomic attack database includes using the computerized data processing unit to find one or more atomic attacks for the network as prerequisites and actions to capture the state of the system in a timely manner at a given moment, wherein the actions are represented by a set of characteristics of the nodes.

[0055] As shown by the dashed arrow connecting blocks 10 and 30, the construction of the atomic attack database uses information about available software on network nodes obtained from deep packet inspection and an active query module with a vulnerability database to capture the state of the system at a given moment.

[0056] Therefore, the atomic attack database is a list of atomic attacks described by prerequisites and actions, which are represented by a set of characteristics of nodes. This is necessary to capture the system state in a timely manner at a given moment, as can be better understood through the following example.

[0057] Consider the following characteristics: - privilege: The level of permissions a user has for a node. It can take values ​​of {none, user, admin}. -health: The health status of the node. It can take the values ​​{ok,leak}. -CVE-2016-3266: The vulnerability exists on the node. It can take the values ​​{true,false}. This vulnerability allows a local user to gain administrator privileges on the target node. Given a node x and a feature k, we use the label x[k] to represent the current state of the node and x'[k] to represent the next state of the node. These features can be used to describe two atomic attacks, where we assume that x and y are connected in the network. The first attack can be formalized as follows: CVE-2020-3847 memory leak. -Source machine: x -Destination machine:y -Prerequisites: -Prerequisites: The second attack can be formalized as follows: CVE-2016-3266 privilege gain. -The source machine and the destination machine are the same:x -Prerequisites: -Prerequisites: We assume that the database has been compiled by security experts and that its content is provided in a machine-readable format, such as JSON, XML, or CSV.

[0058] The method then includes converting the rich network topology, the vulnerability information artifact, and the atomic attack database into a predefined formal model, as shown in block 40. As indicated by the solid arrows converging from blocks 10, 20, and 30 to block 40, the converter module receives network topology information, vulnerability information, and the atomic attack database as input and converts the model into a predefined formal model.

[0059] In one embodiment, the predefined formal model is a circuit-like formal model.

[0060] The method then includes performing a predefined model checker based on satisfiability modular theory (SMT) on a predefined formal model to find counterexamples, as shown in block 50. As indicated by the solid arrows from blocks 40 to 50, the execution of the predefined model checker based on satisfiability modular theory is done on the predefined formal pattern.

[0061] In one embodiment, the model checker based on satisfiability modular theory is a similar circuit-based model checker based on satisfiability modular theory. Furthermore, the similar circuit-based model checker based on satisfiability modular theory defines a circuit with a global clock that divides execution into discrete time steps. Preferably, it includes: - Main input, which is the port through which data from external input can flow into the circuit; - Main output, serving as a port from which the data can flow out of the circuit; - A latch, serving as a basic storage device element capable of storing the data; - A gate, serving as a stateless combinational element that implements basic logic functions; - Comparator, as a stateless arithmetic comparator; - A constant, which is a numeric, Boolean, or symbolic constant that outputs the same value at each said time step.

[0062] The input language can be defined by the Intrepid model checker. Specifically, the Intrepid input language, and model checkers for various similar circuits, allow the use of a global clock to describe the circuit, which divides execution into discrete time steps. The circuit includes: - Main Input (PI): Data from external inputs can flow into the port of the circuit. They can be of Boolean type or integer type. - Main outputs (POs) are ports from which data can flow out of the circuit. They can be of Boolean or integer type. - Latches are basic storage devices that hold the data. They can be of Boolean or integer type. Furthermore, they store an initial value (the first value) representing the value they hold when the circuit is first started (time step 0). The latches are updated to a new value at each subsequent time step. - Gates are stateless combinational elements that implement basic logic functions, such as AND, OR, and NOT gates. They take data of type Boolean and return a Boolean value. - Comparators are stateless arithmetic comparators, such as ≤, <, =, >, and ≥ comparators. They take integer data and return a Boolean value. - Constants, numeric, Boolean, or symbolic constants, output the same value at each time step.

[0063] The circuit operates as follows: At each time step, the main input value of the current time step's main input (PI) is read. These main input values ​​at the current time step and the latch values ​​of the latches at the current time step are processed by the gate. The latch values ​​for subsequent time steps are generated by the comparator, and the main output value of the current time step's main output (PO) is also generated by the comparator. A latch is created for each node and for each feature of each node. Furthermore, the latch values ​​in each time step define the state of the system in each time step.

[0064] To perform the transition, all interesting states of the system need to be collected. These states can be collected from the atomic attack database: they are the set of all features F mentioned in each atomic attack. Then, for each node n, for each feature k, a latch n[k] is created, for a total of |N|×|F| latches. The settings stored in these latches at time t are the state of the network at time t. Each latch is initialized with the network state before the first atomic attack begins. The transition uses the implicit assumption that an atomic attack only requires one step. An atomic attack can occur at any time step. Each atomic attack is identified by an integer id. In the transition, a main input, choose_attack, is created: this input simulates the nondeterministic choice of an attack triggered at one time step. Then, based on choose_attack and the preconditions of each attack, the next state logic of each latch is computed in a "case-statement" circuit equivalent.

[0065] Consider the following example. Assume the network route consists of two nodes x and y connected by an edge, and consider the setup of Example 1. Then, the circuit that models the next state function of latch y[health] is the circuit shown in Figure 2 (the next state functions of x[privilege] and y[CVE_2020_3847] are shown in the figure, the rest of the circuit is not shown).

[0066] The transformation of similar circuits described above can be passed to Intrepid via its Python API. The API exposes functions for creating inputs, latches, gates, constants, comparators, and setting the initial and next state functions of latches.

[0067] Another thing required for the model checker to run is properties. Properties are conditions that must be true in every state of the network. For example, programming languages... This means that in the network, an attacker can never gain administrator privileges on node y. In the transformation of similar circuits, attributes can be represented by small sub-circuits whose outputs are always set to fixed values ​​in the model checker.

[0068] The method then includes exporting the attack path from the counterexample, as shown in block 60.

[0069] The execution of the model checker may take a long time, but it will eventually terminate by declaring that the attribute always exists in the system or by providing a counterexample (a set of states that cause the attribute to be violated from the initial state). In this case, the violation of the attribute corresponds to finding an attack path, such as gaining administrator privileges on the target machine.

[0070] One counterexample to Intrepid lists every latch and input for each time step, thus allowing for the reconstruction of every atom attack for each step.

[0071] 10: Steps 20: Steps 30: Steps 40: Steps 50: Steps 60: Steps

Claims

1. An automatic method for deriving attack paths in a network, comprising: defining (10) a rich network topology based on packet switching in the network; identifying (20) vulnerabilities in the topology as vulnerability information artifacts; establishing (30) an atomic attack database of the network based on the topology and the vulnerabilities; converting (40) the rich network topology, the vulnerability information artifacts, and the atomic attack database into a predefined formal model; and performing (50) a predefined model checker based on satisfiability model theory on the predefined formal model to find counterexamples. And the attack path is derived (60) from the counterexample; wherein, The network topology defined in (10) includes: running a deep packet inspection module of the network via a computerized data processing unit operably connected to the network to establish a network topology based on information exported from the packets by the deep packet inspection module; running an active query module of the network by the computerized data processing unit by sending multiple customized packets to the network to force a response containing required further information, to establish the rich network topology based on the required further information exported from the multiple customized packets by the active query module, and adding the required further information to the network topology; wherein identifying (20) vulnerabilities in the topology includes: running a vulnerability assessment module via the computerized data processing unit to identify the vulnerability information artifacts of each node of the network based on matching node information of the rich network topology with known vulnerabilities in a predefined vulnerability database; and wherein establishing (30) the atomic attack database of the network includes: The computerized data processing unit detects one or more atomic attacks against the network as prerequisites and actions, and captures the state of the system at a given moment, wherein the actions are represented by a set of characteristics of the node.

2. The method for automatically deriving attack paths in a network as described in request item 1, wherein: The predefined formal model is a circuit-like formal model.

3. The method for automatically deriving attack paths in a network as described in request item 1, wherein: The model checker based on satisfiability modular theory is a circuit-like model checker based on satisfiability modular theory.

4. The method for automatically deriving attack paths in a network as described in claim 3, wherein: The model checker based on satisfiability model theory defines a circuit with a global clock that divides the execution into discrete time steps.

5. The method for automatically deriving attack paths in a network as described in claim 4, wherein: The circuit includes: a main input, serving as a port through which data from external input can flow into the circuit; a main output, serving as a port through which the data can flow out of the circuit; a latch, serving as a basic storage device element for storing the data; a gate, serving as a stateless combinational element for implementing basic logic functions; a comparator, serving as a stateless arithmetic comparator; and a constant, serving as a digital, Boolean, or symbolic constant, outputting the same value at each time step.

6. The method for automatically deriving attack paths in a network as described in claim 5, wherein: The main input is of type Boolean or integer.

7. The method for automatically deriving attack paths in a network as described in claim 5, wherein: The main output is of type Boolean or integer.

8. The method for automatically deriving attack paths in a network as described in claim 5, wherein: The latch is of type Boolean or integer.

9. The method for automatically deriving attack paths in a network as described in claim 5, wherein: The latch stores a first value representing the value it holds when the circuit is started at the first time step.

10. The method for automatically deriving attack paths in a network as described in claim 9, wherein: The latch is updated to a new value at each subsequent time step.

11. The method for automatically deriving attack paths in a network as described in claim 5, wherein: The basic logical functions of the gate are AND gate, OR gate, and reverse gate.

12. The method for automatically deriving attack paths in a network as described in claim 5, wherein: The gate retrieves the data of type Boolean and returns the data of type Boolean.

13. The method for automatically deriving attack paths in a network as described in claim 5, wherein: The stateless arithmetic comparators are ≤ comparators, < comparators, = comparators, > comparators, and ≥ comparators.

14. The method for automatically deriving attack paths in a network as described in claim 5, wherein: The stateless arithmetic comparator takes the data as an integer and returns the data as a Boolean.

15. The method for automatically deriving attack paths in a network as described in claim 5, wherein: At each time step, the main input value of the main input at the current time step is read, wherein the main input value at the current time step and the latch value of the latch at the current time step are processed by the gate, wherein the latch value at subsequent time steps is generated by the comparator, and wherein the main output value of the main output at the current time step is generated by the comparator.

16. The method for automatically deriving attack paths in a network as described in claim 15, wherein: For each node and for each feature of each node, a latch is created, wherein the latch value at each time step defines the state of the system at each time step.

Images