Incidents Elie Bursztein and Jean Goubault Larrecq

Transcription

1 A Logical Framework for Anticipation of Network Incidents and Jean Goubault Larrecq PhdStudent LSV ENS CACHAN CNRS INRIA DGA

2 Outline Introduction Network Evolution Attack Model Evolution Anticipation game key features Dependency relations Player interaction Time Model Logic Positional Logic Temporal Logic Conclusion Outline: Introduction > Model > Strategy > Conclusion 2

3 The Good Old Time Outline: Introduction > Model > Strategy > Conclusion 3

4 The Current Internet Opte project Outline: Introduction > Model > Strategy > Conclusion 4

5 Attack Sophistication vs. Intruder Knowledge Cert/ Carnegie Mellon University Outline: Introduction > Model > Strategy > Conclusion 5

6 Attack Step stones Large network may suffers multiples l vulnerabilities Patches and counter measures need to be prioritized A minor vulnerability can turn into a major hole when used as a step stone Attack graph allows to reason about attack sequences Outline: Introduction > Model > Strategy > Conclusion 6

7 Attack Graph Example Sandia Red Team White Board attack graph from DARPA CC20008 Information battle space preparation experiment Outline: Introduction > Model > Strategy > Conclusion 7

8 Model Evolution Attack graphs model checker (Ritchey and Ammann 2000) Anticipation Games Attack trees (Schneier 1999) Outline: Introduction > Model > Strategy > Conclusion 8

9 Attack graph Related Work Model checker based (Ritchey et. al S&P 00, Sheyner et. al S&P 02) Graph based (Ammann et. alccs 02,Ritchey et. al ACSAC 02, Noel et. al ACSAC 03, Wang et. al ESORICS 05,Wang et. al DBSEC 06) Timed Game ATL (Alur et al. 97) The Element of Surprise in Timed Games (De Alfaro et al. CONCUR 2003) TATL (Henzinger et al 2006 Formats) Outline: Introduction > Model > Strategy > Conclusion 9

10 Model Key Features Dependency Collateral effects Trust relations Interaction Administrator Intruder Time Action take time Outline: Introduction > Model > Strategy > Conclusion 10

11 Dependency User Database server Web server Client 1 Client 2 Client 3 Outline: Introduction > Model > Strategy > Conclusion 11

12 Network interaction Exploit vulnerabilities Abuse trust relations Patch Firewall Restore Outline: Introduction > Model > Strategy > Conclusion 12

13 Vulnerability cycle Cert/ Carnegie Mellon University Outline: Introduction > Model > Strategy > Conclusion 13

14 Network Information Fixed over the time Evolve over time Web server User Database Dtb server ρ(public) T T ρ(vuln) T T ρ(compr) ρ(needpub) T T Client 1 Client 2 Client 3 Outline: Introduction > Model > Strategy > Conclusion 14

15 Information Evolution ρ(public) T T Compr 4 ρ(public) T T ρ(vuln) T T ρ(vuln) T T ρ(compr) ρ(compr) T ρ(needpu ρ(needpu T T b) b) T T Outline: Introduction > Model > Strategy > Conclusion 15

16 A Incomplete Game Example Exploit web server Patch server Exploit server Patch web server Patch server Outline: Introduction > Model > Strategy > Conclusion 16

17 Time Each action requires a different amount of time Patching a service: Download, extract, apply, restart Exploit a service Firewalling a service In anticipation games as in TATL the fastest action win Player can be taken by surprise Outline: Introduction > Model > Strategy > Conclusion 17

18 The element of surprise Exploit 4 in 3 unit Network Firewall 4 in 1 unit Outline: Introduction > Model > Strategy > Conclusion 18

19 Type of attacks Anticipation games allows to model Denial of service Buffer overflow execution Permission abuse Cross scripting Information leak. Outline: Introduction > Model > Strategy > Conclusion 19

20 Rule Language Outline: Introduction > Model > Strategy > Conclusion 20

21 Semantic A successor node is compromised At least, one of the node the belongs to the equivalence is public Outline: Introduction > Model > Strategy > Conclusion 21

22 Rules example Outline: Introduction > Model > Strategy > Conclusion 22

23 A Play example User Database 6 Web server server Client 1 Client 2 Client 3 = Player Ati Action Rule Target Succ Admin Choose Execute Firewall Unfirewall Patch 5 4 Intruder Fail Choose Execute Compromise 0day Forward Backward Outline: Introduction > Model > Strategy > Conclusion 23

24 Properties Semantic Outline: Introduction > Model > Strategy > Conclusion 24

25 Semantic The player A have a strategy to satisfy the property In every future the node will be compromised Outline: Introduction > Model > Strategy > Conclusion 25

26 Property Illustration Outline: Introduction > Model > Strategy > Conclusion 26

27 Decidability TATL Formula model checking in Anticipation game is decidable and EXPTIME complete Outline: Introduction > Model > Strategy > Conclusion 27

28 One More Thing!

29 It Work! Model and Strategies are fully implemented in C The talk example cannot be analyzed by hand 4011 plays states tt Outline: Introduction > Model > Strategy > Conclusion 29

30 Analyzer Demo

31 Future Work CIA model Abstraction Non determinism Outline: Introduction > Model > Strategy > Conclusion 31

32 Conclusion Game and Time provide a richer model for intrusion i analysis Many directions to explore Outline: Introduction > Model > Strategy > Conclusion 32

33 Questions During this work no network service was injured or tortured. Outline: Introduction > Model > Strategy > Conclusion 33

34 Rule execution time Outline: Introduction > Model > Strategy > Conclusion 34