Attack Emulation Using Reconstructed Packets for Security Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer network security systems lack an effective method to emulate attacks accurately, making it difficult to verify the responsiveness of security technologies to real-world threats.
Innovation Solution
A method and system to emulate a malicious attack on a target network by reconstructing data packets from a previous attack, assigning behavior triggers, and initiating packet transmissions between assets within and outside the network, generating artifacts for security technologies to detect, prevent, or alert on analogous attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual correlation efforts are used to verify security technologies, then detection accuracy can be maintained, but productivity and time efficiency deteriorate
Solution Approach 1:
The patent creates copies of actual attack data packets and reconstructs them for use in emulation environments. Instead of manually analyzing each attack scenario, the system automatically generates and replays replicated attack traffic, enabling efficient verification of security technologies while maintaining detection accuracy through faithful reproduction of real attack characteristics
Solution Approach 2:
The system performs preliminary actions by pre-processing attack data, extracting relevant features, and preparing emulation scenarios in advance. Attack patterns are captured, analyzed, and converted into reusable emulation configurations before actual verification occurs, eliminating the need for manual correlation during the verification process itself
2Reliability
If attack emulation is performed with high fidelity to real attacks, then detection capability improves, but device complexity increases
Solution Approach 1:
The emulation system is segmented into distinct functional modules: data packet capture, attack pattern extraction, emulation configuration, traffic replay, and detection verification. Each module handles a specific aspect of the emulation process, reducing overall system complexity while maintaining high-fidelity attack reproduction through coordinated operation of specialized components
Solution Approach 2:
The patent introduces intermediary components that bridge the gap between raw attack data and emulation execution. Attack data is processed through intermediate representation formats that capture essential attack characteristics without requiring complete replication of complex attack infrastructure, simplifying the emulation system while preserving detection-relevant features
3Measurement precision
If comprehensive attack data is captured and analyzed, then emulation accuracy improves, but loss of time in data processing increases
Solution Approach 1:
The system extracts only the essential and relevant features from comprehensive attack data, rather than processing entire attack datasets. Key characteristics such as packet patterns, protocol anomalies, and attack signatures are extracted and stored in compact representations, achieving high emulation accuracy while minimizing data processing time by focusing on detection-critical information
Data Source
AI summary
One variation of a method includes: generating data packets by recombining packet fragments transmitted between machines during a prior malicious attack on a reference network; defining triggers for transmission of the data packets between pairs of assets connected to a target network; generating an executable file including the data packets and the triggers; initiating transmission of the data packets between the pairs of assets according to the triggers to emulate the malicious attack on the target network; serving a context file, specifying artifacts representing indicators of the malicious attack responsive to execution of behaviors corresponding to these triggers, to a security technology deployed on the target network; and, in response to absence of an event record related to the emulation in a log of the security technology, generating a prompt to reconfigure the security technology to respond to the malicious attack.