Network Attack Path Derivation Using SMT-Based Model Checking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for generating and analyzing network attack graphs are tedious, error-prone, and impractical for large networks, failing to accurately identify attack paths and related vulnerabilities in cyber-physical systems and IoT environments.
Innovation Solution
A method utilizing a SMT-based model checker to derive attack paths by defining network topology through deep packet inspection and active queries, identifying vulnerabilities, building an atomic attack database, and translating into a circuit-like formal model for automated analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual attack graph construction is used, then accuracy can be maintained, but the process becomes tedious and impractical for large networks
Solution Approach 1:
The patent replaces manual mechanical construction of attack graphs with an automated computational system. The SMT-based model checker automatically generates attack graphs by formally verifying security properties and enumerating attack sequences, eliminating the need for manual graph construction while maintaining accuracy through formal methods.
Solution Approach 2:
The system performs self-service by automatically analyzing network topology, identifying vulnerabilities, and generating attack paths without human intervention. The formal verification process autonomously explores the state space and derives attack sequences, making the system self-sufficient for large-scale network analysis.
2Extent of automation
If existing model-checking tools are used to generate attack graphs, then automation is achieved, but the complexity of the process increases
Solution Approach 1:
The patent segments the complex model-checking process into distinct modular components: network topology definition, vulnerability identification, atomic attack database construction, formal model translation, and counterexample derivation. This segmentation reduces overall complexity by allowing each component to be developed and verified independently.
Solution Approach 2:
The patent introduces an intermediary formal model layer that bridges the gap between network vulnerability data and attack path results. This intermediate representation simplifies the translation process and makes the model-checking procedure more manageable by providing a structured intermediate stage for analysis.
3Reliability
If comprehensive vulnerability analysis is performed across the network, then security coverage is improved, but the computational resources required increase
Solution Approach 1:
The patent performs preliminary actions by pre-defining the network topology, pre-identifying vulnerabilities, and pre-construction of atomic attack databases before executing the formal verification. This preprocessing reduces the computational burden during the actual model-checking phase by organizing data in advance.
Solution Approach 2:
The patent changes parameters by representing network states and vulnerabilities in a formal logical framework with discrete variables and constraints. This parameter transformation converts complex security analysis into a structured satisfiability problem that can be efficiently solved by SMT solvers with optimized resource usage.
Data Source
Figure 1
Figure 2
AI summary
The present invention relates to a method for automatic derivation of attack paths in a network comprising defining the topology of the network as an enriched network topology, identifying the vulnerabilities of the topology as vulnerabilities information artifacts, building the atomic attack database of the network based on the topology and the vulnerabilities, translating the enriched network topology, the vulnerabilities information artifacts and the atomic attack database into a predefined formal model, executing a predefined SMT-based model checker for the predefined formal model to seek counterexamples and deriving the attack paths from the counterexamples, wherein the defining the topology comprises running, by a computerized data processing unit operatively connected to the network, a module of deep packet inspection of the network to build a network topology based on the information derived from the deep packet inspection module, running, by the computerized data processing unit, a module of active queries of the network to add further information to the network topology based on the information derived from the active queries to build the enriched network topology, wherein the identifying the vulnerabilities comprises running, by the computerized data processing unit, a vulnerability assessment module to identify the vulnerabilities information artifacts of each node of the network based on the matching between nodes information of the enriched network topology and known vulnerabilities of a predefined vulnerabilities database and wherein the building the atomic attack database comprises finding, by the computerized data processing unit, one or more atomic attacks for the network as preconditions and actions to capture the state of the system at a given moment in time, wherein the actions are expressed in terms of a set of features of said nodes.