Title: “Advances in Automated Attack Planning”
Presenters: Carlos Sarraute and Alejandro David Weil
Date: Nov. 12-13, 2008
Abstract:
We will present the state of our research in automating multi-step attacks to computer networks (in particular in the context of automating penetration tests). The interest in automated attacks is mainly given by the time and resources required to realize a penetration test and the high level of expertise of people doing it. Moreover, the automation would make it possible to switch between different attack strategies with little effort. Also, being able to reproduce attacks and contrast their results offers an additional value, for example to have a metric of network security.
More precisely, the problem that we consider is: given a set of goals (e.g.: to obtain sensitive in data such as credit card information from any machine in a given network), and an initial incomplete knowledge of the network, continuously determine the best course of actions for an attacker in order to obtain the goals, execute the actions and feedback the plan with their results.
Previous works on this topic are generally based on the construction and analysis of Attack Graphs. Important limitations of these proposals are the lack of scalability, and the static representation of the problem. We propose a transformation of the previous attack graph model. Our approach integrates the planner with the attack framework (used by the attacker or penetration tester), resulting in a dynamic graph with real time feedback of the information obtained by executing the actions, and focus on an efficient implementation on computers with concurrent but finite resources, that can be used on real-world networks. This has been implemented in a tool called RPT (Rapid Penetration Test). Its outstanding characteristics are parallelization, dynamic graph construction and the incorporation of expert knowledge in the form of strategies.
Classical planners used to solve Attack Graphs construct a course of action to reach the goal, without taking into account the possibility of executing simultaneous actions, building a serial plan which is far from optimal. We will show heuristics to schedule actions in time and take advantage of parallelization.
Also, current Attack Graph techniques are based on fixed initial scenarios, and result in the construction of enormous graphs (according to the desired level of detail) that must be regenerated as new information is discovered during the execution of a plan. Our approach creates a dynamic graph, where new information is incorporated online and goals are modified and created as a result of the actions. Another important characteristic of the RPT approach relies in its flexibility to incorporate the knowledge of penetration testing experts. Faced with uncertainty about the network, RPT will apply expert chosen methodologies (depending on the particular situation) to do network discovery and information gathering, before planning further attack steps. On the other side, recollected information is reused to optimize the election of subsequent tasks. For example, an expert crafted methodology will use a discovered SMNP service on a host to accurately find the OS version, instead of using a more general OS detection heuristics.
The flexible architecture of this tool makes it easy to model different types of attacks, to offer a suitable strategy according to the scenario, and to reuse attack plans or combine different attack plans. We also present another direction of research that expands currently published Attack Graphs techniques. The proposed network attacks model is based on Actions and Assets. This model adds a multidimensional cost to the attacker's actions, and refines the level of detail of the actions (from the attacker's point of view). The cost includes the probability of success, execution time and generated noise. The objective of the planning system becomes to find an optimal course of action in order to obtain specified goals. Although this problem is
NP-complete, near-optimal solutions can be found efficiently using state-of-the-art planning tools from the field of Artificial Intelligence. We will demo the tools for both approaches, and conclude with future steps for this research.
