SYSTEM AND METHOD FOR EXTENDING AUTOMATED PENETRATION TESTING TO DEVELOP AN INTELLIGENT AND COST EFFICIENT SECURITY STRATEGY

• US 20110035803A1
• Filed: 08/05/2010
• Published: 02/10/2011
• Est. Priority Date: 08/05/2009
• Status: Active Grant

• Current Assignee: Ecrime Management Strategies, Inc.
• Original Assignee: Core Security Technologies (HelpSystems, LLC)
• Inventors: Sarraute Yamada, Carlos Emilio, Lucangeli Obes, Jorge, Richarte, Gerardo Gabriel
• Granted Patent: US 8,490,196 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A system and method for extending automated penetration testing of a target network is provided. The method comprises: computing a scenario, comprises the steps of: translating a workspace having at least one target computer in the target network, to a planning definition language, translating penetration modules available in a penetration testing framework to a planning definition language, and defining a goal in the target network and translating the goal into a planning definition language; building a knowledge database with information regarding the target network, properties of hosts in the network, parameters and running history of modules in the penetration testing framework; and running an attack plan solver module, comprising: running an attack planner using the scenario as input, to produce at least one attack plan that achieves the goal, and executing actions defined in the at least one attack plan against the target network from the penetration testing framework.

Claims

1. A method for extending automated penetration testing of a target network comprising, the steps of:

a. computing a scenario, wherein the step of computing the scenario comprises the steps of

i. translating a workspace having at least one target computer in the target network, to a planning definition language;

ii. translating penetration modules available in a penetration testing framework to a planning definition language; and

iii. defining a goal in the target network and translating the goal into a planning definition language;

b. building a knowledge database with information regarding the target network, properties of hosts in the network, parameters and running history of modules in the penetration testing framework; and

c. running an attack plan solver module, wherein the attack plan solver module performs the steps of;

i. running an attack planner using the scenario as input, to produce at least one attack plan that achieves the goal; and

ii. executing actions defined in the at least one attack plan against the target network from the penetration testing framework.

2. The method of claim 1 wherein, prior to running the attack plan solver module, a pre-planner processor module is run using the scenario as input to produce a new scenario, wherein the pre-planner processor module parses the scenario to remove actions that cannot be executed against the hosts described in the scenario.

3. The method of claim 1 wherein, prior to running the attack plan solver module, a pre-planner processor module is run using the scenario as input to produce a new scenario, wherein the pre-planner processor module parses the scenario to combine into a single asset all those assets that can be targeted by the same actions and pose the same preconditions for these actions.

4. The method of claim 1 wherein, prior to running the attack plan solver module, a pre-planner processor module is run using the scenario as input to produce a new scenario, wherein the pre-planner processor module parses the scenario to combine into a single action all those actions that can be used to compromise a previously specified asset.

5. The method of claim 1 wherein the attack planner is selected from the group consisting of a proactive planner, a reactive planner, and a custom planner.

6. The method of claim 1, where the attack planner solver module, after computing the attack plan, executes a post-planner processor module, wherein the post-planner processor module runs an iterative process comprising the steps of:

i. executing the first action in the plan;

ii. monitoring the result of the first action in the workspace to ascertain if the effect predicted by the attack plan was successful; and

iii. in case the action failed, modifying the scenario to produce a modified scenario, and calling the attack planner to re-calculate a modified plan with the modified scenario.

7. The method of claim 1 wherein an end user defines the goal to be achieved by the system.

8. The method of claim 1, wherein the actions defined in the attack plans by the attack plan solver module are run in parallel when the preconditions for these actions are satisfied and as limited by the penetration testing framework.

9. The method of claim 1, wherein the attack plan solver module updates the knowledge base after each action is executed.

10. The method of claim 1, wherein the planning definition language is a planning domain definition language.