Method for testing the security posture of a system

• US 20110030059A1
• Filed: 07/30/2009
• Published: 02/03/2011
• Est. Priority Date: 07/30/2009
• Status: Abandoned Application

• Current Assignee: LGS Innovations LLC (CACI International Incorporated)
• Original Assignee: LGS Innovations LLC (CACI International Incorporated)
• Inventors: Greenwald, Lloyd G.
• Application Number:
  US12/462,148
• Publication Number:
  US 20110030059A1
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A method is provided for assessing the susceptibility of a NIDS to evasion. In an embodiment, the method involves intercepting packets that pass through a NIDS or other defensive device, reading, from the intercepted packets, message sequences that pertain to at least one protocol or network application, and constructing at least one stochastic sequential model of usage of the protocol from the protocol sequences.

Claims

1. A method, comprising:

intercepting packets that pass through a defensive device;

reading, from the intercepted packets, protocol sequences that pertain to at least one protocol or network application; and

constructing, using a computer, at least one stochastic sequential model of usage of the protocol or network application from the protocol sequences.

2. The method of claim 1, further comprising:

using the stochastic sequential usage model to provide one or more protocol sequences that will pass through the defensive device.

3. The method of claim 2, wherein the one or more protocol sequences are provided in response to a query that specifies probabilities for protocol sequences or portions thereof.

4. The method of claim 2, wherein the one or more protocol sequences are provided in response to a query that specifies sub-sequences of the protocol sequences.

5. The method of claim 2, further comprising transmitting packets through a defensive device into a network protected by the defensive device, wherein:

the stochastic sequential usage model is applicable to the defensive device that protects the network; and

the transmitted packets include at least part of one or more of the provided protocol sequences.

6. The method of claim 5, further comprising:

monitoring the protected network to detect whether the transmitted packets induce a security incident.

7. The method of claim 6, further comprising:

identifying one or more security incidents induced by the transmitted packets; and

modifying the defensive device protecting the network to recognize one or more sequences of the transmitted packets that have been identified as inducing security incidents.

8. The method of claim 5, further comprising:

selecting among the provided protocol sequences;

wherein the transmitted packets include at least part of one or more selected sequences; and

wherein the selecting step is dependent on responses sent by the protected network.