Attack Graph Modeling With Hidden Markov Chains for Evasive Paths
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for generating attack graphs in information security lack the ability to accurately predict sequences of techniques that are likely to evade detection and prevention by security tools, thereby failing to effectively identify and address vulnerabilities in computer networks.
Innovation Solution
A method utilizing a hidden Markov model to generate attack graphs based on historical data, calculating sequences of techniques with the highest probability of undetected and unpunished execution, and emulating these sequences on target networks to expose vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional attack graph methods are used, then attack paths can be visualized, but the ability to predict sequences of techniques likely to evade detection is insufficient
Solution Approach 1:
The patent transforms the attack graph generation process by changing the parameters from deterministic path enumeration to probabilistic sequence prediction using Hidden Markov Models. The HMM parameters (transition probabilities between techniques, emission probabilities of detection/prevention) are learned from historical attack data, enabling the system to predict attack sequences with varying likelihoods of evading security controls, thereby resolving the contradiction between visualization capability and prediction accuracy.
2Adaptability or versatility
If comprehensive attack paths are enumerated, then all possible vulnerabilities are identified, but the complexity of analysis increases significantly
Solution Approach 1:
The patent extracts the most probable attack sequences from the complete attack graph by using the HMM to rank sequences based on their likelihood of occurring and evading detection. Instead of analyzing all possible attack paths equally, the system extracts and focuses on the top-k most probable sequences, significantly reducing analysis complexity while maintaining comprehensive vulnerability coverage by still considering multiple high-probability paths.
3Measurement precision
If historical attack data is utilized, then prediction accuracy improves, but the requirement for data processing and model training increases
Solution Approach 1:
The patent performs preliminary actions by pre-processing historical attack data to extract technique sequences and outcomes, then training the HMM model in advance to establish transition and emission probability distributions. This preliminary modeling allows the system to quickly generate predictions for new attack graphs without re-processing raw historical data each time, reducing the time loss for subsequent analysis while maintaining high prediction accuracy based on learned patterns.
Data Source
AI summary
A method includes: generating a transition probability matrix defining a set of transition probabilities for a set of techniques, each transition probability representing a probability of transitioning from a technique i to a technique j; defining a set of emission probability vectors corresponding to the set of techniques, each emission probability vector representing a probability of detecting a technique i and a probability of preventing a technique i; defining an initial technique vector representing an initial probability distribution of techniques; generating a hidden Markov model correlating a target sequence of observations with a hidden state sequence of techniques based on the transition probability matrix, the set of emission probability vectors, and the initial technique vector; and calculating a sequence of techniques, based on the hidden Markov model, exhibiting greatest probability to yield, for each technique in the sequence of techniques, absence of detection or prevention of the technique.