AStructuralFrameworkforModelingMulti-StageNetworkAttacksDaley,Larson,DawkinsUniversityofTulsa2002IEEEAStructuralFrameworkforMod1OutlineIntroductionStratifiedNodeTopologyAttackNodeCorrelationContextSensitiveNodesExampleAttackScenariosApplicationsRelatedWorkConclusionsOutlineIntroduction2IntroductionAttacktreesrepresentgoal-orientedattackbehaviorsmultistagecasualrelationshipsbetweeneventsorstates“AND”,“OR”nodescanbeweightedtoreflectthelikelihoodofsuccessforaparticularattackIntroductionAttacktreesrepre3Introduction(cont.)DisadvantagedonotprovideacomprehensivemodelfortheanalysisofnetworkvulnerabilityExtendedattacktreeparadigmintroducefunctionalitytoallowforacomprehensiverepresentationofattackstratifiednodetopologyevent-level,state-level,top-levelnodesIntroduction(cont.)Disadvanta4StratifiedNodeTopology(SNT)StratifiedNodeTopology(SNT)5StratifiedNodeTopologyThreelayerspartitionattacktreebasedonfunctionalityandallowforamorepreciseportrayalofthemechanicsofanattack.Event-LeveldirectactivitiesofanattackernodescorresponddirectlytointrusiondetectionsystemalertsStratifiedNodeTopologyThree6StratifiedNodeTopology(cont.)State-Levelgeneralizedintermediateobjectivesinanattackconceptualsteps(abstractgoals)fairlyconstantex:“executearbitrarycode”,“modifyprotectedfile”Top-Levelultimateintentionsofanattackertop-levelnodesmayalsobestartingpointsforotherattacksStratifiedNodeTopology(cont7AttackNodeCorrelationrelationshipbetweennodesimplicitlinkallowindividualnodesinthetreetoimplyanothernodeex:performabufferoverflowexploittoexecutearbitrarycodeexplicitlinkwhenanattackprovidesacapabilitytoexecuteadditionalnodesbutdoesnotactuallyinvokeaninstanceofanewnodeex:obtainrootaccess,nexttocompromiseadditionalsystemsorstealinformationAttackNodeCorrelationrelatio8ContextSensitiveNodesAssignparametervaluestoattacknodeboundthesearchspaceofattacksreducethelikelihoodoffalsepositivesContextSensitiveNodesAssign9ExampleAttackScenariosExampleAttackScenarios10ExampleAttackScenarios(cont.)Thecomposablegoal-orientedbehavioroftheStratifiedNodeTopologylendstheabilitytodescribetheeventsthatenableanattack.ExampleAttackScenarios(cont11ApplicationsToexpressthismodel,twolanguageshavebeendesigned:AttackModelingLanguage(AML)expressrequirementsandresultsofattackrelationshipsbetweenattacksNetworkModelingLanguage(NML)AnanalyticalvulnerabilityengineutilizesNMLspecificationsinconjunctionwithAMLdefinitionstoconstructvulnerabilityattacktrees.ApplicationsToexpressthismo12RelatedWorkIDIOTprojectadaptationofColoredPetriNetsviewasingleattackasapatternofstatesratherthanlinkingmultipleattackstogetherthistoolwasnotmeantforattackcorrelationacrossanetworkRelatedWorkIDIOTproject13ConclusionsThemodelingframeworkclassifymultistagenetworkattacksina