SYSTEM AND METHOD FOR PROBABILISTIC ATTACK PLANNING

• US 20110061104A1
• Filed: 09/08/2010
• Published: 03/10/2011
• Est. Priority Date: 09/08/2009
• Status: Active Grant

• Current Assignee: Ecrime Management Strategies, Inc.
• Original Assignee: Core SDI, Inc.
• Inventors: Obes, Jorge Lucangeli, Sarraute Yamada, Carlos Emilio, Futoransky, Ariel, Richarte, Gerardo Gabriel
• Granted Patent: US 8,490,193 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 41/0823 characterised by the purposes of a change of settings, e.g. optimising configuration for enhancing reliability for optimising operational conditions of wireless networks H04W24/02
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 43/50 Testing arrangements
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A system and method for automated probabilistic planning of network attacks against infrastructures of computer networks and applications is provided. The embodiments automate the analysis and probabilistic planning of multi-step attacks to computer and application networks (in particular in the context of automating penetration tests), optimizing with respect to one of the following metrics: the probability of success of the actions, a numerical parameter that must be minimized (e.g., running time), or the number of logs generated by the control devices in the target network.

Claims

1. A method for designing a penetration test for a penetration testing framework, comprising the steps of:

defining a variable to be optimized;

defining a scenario, wherein the scenario further comprises,

a definition of a target network,

a list of penetration testing modules that are available, wherein each penetration testing modules has associated with it a probability of success, requirements, and an expected value for the variable to be optimized, and

a goal of the penetration test; and

producing a probabilistic plan, an estimated probability of success for the probabilistic plan, and an expected value for the variable.

2. The method of claim 1, wherein a probabilistic plan further comprises a directed acyclic graph having branches, wherein the acyclic graph is defined as:

having a single starting node, a first type of end node labelled success, a second type of end node labelled fail, and a penetration testing module node for each penetration testing module within the scenario, wherein the penetration testing module nodes are referred to as action nodes; and

for each action node, either, requirements associated with the action of the action node are satisfied according to the scenario description, or there is a second action node that precedes this action node and is associated with an action that checks if this requirement is satisfied.

3. The method of claim 1 wherein, the variable to be optimized is time, or a number of alerts generated in the target network.

4. The method of claim 1, further comprising the step of executing the probabilistic plan in the penetration testing framework.

5. A method for designing a probabilistic plan for attacking from a first host a second host, for a penetration testing framework, comprising the steps of:

defining a variable to be optimized;

defining a scenario, wherein the scenario further comprises, a description of the first host located within a target network, the second host located within the target network, and how the first host and second host are connected, a list of penetration testing modules that are available, wherein each penetration testing module has associated with it a probability of success, requirements, and an expected value for the variable to be optimized; and

producing a probabilistic plan that has as a goal to install an agent in the second host, an estimated probability of success for the probabilistic plan, and an expected value for the variable.

6. The method of claim 5, wherein the variable to be optimized is time, or a number of alerts generated in the target network.

7. The method of claim 5, further comprising the step of executing the probabilistic plan in the penetration testing framework.