Penetration test attack tree generator

• US 9,894,090 B2
• Filed: 07/14/2015
• Issued: 02/13/2018
• Est. Priority Date: 07/14/2015
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP SE
• Inventors: Hebert, Cedric, Gomez, Laurent
• Primary Examiner(s): Armouche, Hadi S
• Assistant Examiner(s): Steinle, Andrew J
• Application Number:
  US14/799,176
• Publication Number:
  US 20170019421A1
• Time in Patent Office: 945 Days
• Field of Search: None
• CPC Class Codes: G06F 16/2246 Trees, e.g. B+trees
• CPC Class Codes: G06F 16/2379 Updates performed during online database operations; commit processing
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Implementations of the present disclosure include methods, systems, and computer-readable storage mediums for receiving goal data and start-up information, the goal data indicating a goal to be achieved during a penetration test, the start-up information indicating initial data for beginning the penetration test, receiving tool data from a register of tools, the tool data including one or more tools that can be used during the penetration test, and, for each tool, input data required to execute the tool and output data provided by the tool, processing the goal data, the start-up information and the tool data to automatically generate attack tree data, the attack tree data including a plurality of data sets and links between data sets, and providing the attack tree data to display a graphical representation of an attack tree on a display.

Claims

1. A computer-implemented method executed by one or more processors, the method comprising:

receiving, by the one or more processors, goal data and start-up information, the goal data indicating a goal to be achieved during a penetration test, the start-up information indicating initial data for beginning the penetration test and defining a target system;

receiving, by the one or more processors, tool data from a register of tools, the tool data comprising one or more tools, each of the one or more tools comprising computer-executable programs configured to perform a security related function that can be used during the penetration test, and, for each tool, input data required to execute the tool and output data provided by the tool, the goal comprising obtaining administrative privileges on the target system by using a plurality of attack chains;

processing, by the one or more processors, the goal data, the start-up information and the tool data to automatically generate an attack tree comprising attack tree data, the attack tree data comprising the goal as a root node and a plurality of data sets and links between data sets and being configured to address the plurality of attack chains;

pruning the attack tree, by the one or more processors, by determining that a data set of the attack tree data cannot be bound to one or more elements of the start-up data, indicating that information that is required to achieve the goal during the penetration test cannot be obtained, and in response, deleting the data set from the attack tree data; and

providing, by the one or more processors, the attack tree data to display a graphical representation of the attack tree on a display and a report on the data set that was deleted from the attack tree data comprising a determination whether the start-up data was not correctly input at the outset.

2. The method of claim 1, wherein processing the goal data, the start-up information and the tool data to automatically generate attack tree data comprises:

reading a data element from a pool of data elements;

comparing the data element to one or more output data of at least one tool in the register of tools; and

selectively instantiating data based on the comparing.

3. The method of claim 2, wherein comparing the data element to one or more output data of at least one tool in the register of tools is executed in response to determining that the data element is not included in the start-up information.

4. The method of claim 2, wherein selectively instantiating data based on the comparing comprises determining that the data element matches an output data of a tool, and in response, populating one or more parameters of the tool with respective template elements to provide an executable command, the respective template elements being subsequently instantiated.

5. The method of claim 4, wherein selectively instantiating data based on the comparing further comprises adding one or more input data of the tool to the pool of data elements.

6. The method of claim 1, wherein the attack tree comprises a combination of two or more attack vectors for attacking the target system.

7. The method of claim 1, wherein at least one plurality of attack chains comprises a pivoting technique that comprises attacking one machine through one or more other machines.

8. A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

receiving goal data and start-up information, the goal data indicating a goal to be achieved during a penetration test, the start-up information indicating initial data for beginning the penetration test and defining a target system, the goal comprising obtaining administrative privileges on the target system by using a plurality of attack chains;

receiving tool data from a register of tools, the tool data comprising one or more tools, each of the one or more tools comprising computer-executable programs configured to perform a security related function that can be used during the penetration test, and, for each tool, input data required to execute the tool and output data provided by the tool;

processing the goal data, the start-up information and the tool data to automatically generate an attack tree comprising attack tree data, the attack tree data comprising the goal as a root node and a plurality of data sets and links between data sets and being configured to address the plurality of attack chains;

pruning the attack tree, by the one or more processors, by determining that a data set of the attack tree data cannot be bound to one or more elements of the start-up data, indicating that information that is required to achieve the goal during the penetration test cannot be obtained, and in response, deleting the data set from the attack tree data; and

providing the attack tree data to display a graphical representation of the attack tree on a display and a report on the data set that was deleted from the attack tree data comprising a determination whether the start-up data was not correctly input at the outset.

9. The computer-readable storage medium of claim 8, wherein processing the goal data, the start-up information and the tool data to automatically generate attack tree data comprises:

reading a data element from a pool of data elements;

comparing the data element to one or more output data of at least one tool in the register of tools; and

selectively instantiating data based on the comparing.

10. The computer-readable storage medium of claim 9, wherein comparing the data element to one or more output data of at least one tool in the register of tools is executed in response to determining that the data element is not included in the start-up information.

11. The computer-readable storage medium of claim 9, wherein selectively instantiating data based on the comparing comprises determining that the data element matches an output data of a tool, and in response, populating one or more parameters of the tool with respective template elements to provide an executable command, the respective template elements being subsequently instantiated.

12. The computer-readable storage medium of claim 11, wherein selectively instantiating data based on the comparing further comprises adding one or more input data of the tool to the pool of data elements.

13. The computer-readable storage medium of claim 8, wherein the attack tree comprises a combination of two or more attack vectors for attacking the target system.

14. The computer-readable storage medium of claim 8, wherein at least one plurality of attack chains comprises a pivoting technique that comprises attacking one machine through one or more other machines.

15. A system, comprising:

a computing device; and

a computer-readable storage device coupled to the computing device and having instructions stored thereon which, when executed by the computing device, cause the computing device to perform operations comprising;

receiving goal data and start-up information, the goal data indicating a goal to be achieved during a penetration test, the start-up information indicating initial data for beginning the penetration test and defining a target system, the goal comprising obtaining administrative privileges on the target system by using a plurality of attack chains;

receiving tool data from a register of tools, the tool data comprising one or more tools, each of the one or more tools comprising computer-executable programs configured to perform a security related function that can be used during the penetration test, and, for each tool, input data required to execute the tool and output data provided by the tool;

processing the goal data, the start-up information and the tool data to automatically generate an attack tree comprising attack tree data, the attack tree data comprising the goal as a root node and a plurality of data sets and links between data sets and being configured to address the plurality of attack chains;

pruning the attack tree, by the one or more processors, by determining that a data set of the attack tree data cannot be bound to one or more elements of the start-up data, indicating that information that is required to achieve the goal during the penetration test cannot be obtained, and in response, deleting the data set from the attack tree data; and

providing the attack tree data to display a graphical representation of the attack tree on a display and a report on the data set that was deleted from the attack tree data comprising a determination whether the start-up data was not correctly input at the outset.

16. The system of claim 15, wherein processing the goal data, the start-up information and the tool data to automatically generate attack tree data comprises:

reading a data element from a pool of data elements;

comparing the data element to one or more output data of at least one tool in the register of tools; and

selectively instantiating data based on the comparing.

17. The system of claim 16, wherein comparing the data element to one or more output data of at least one tool in the register of tools is executed in response to determining that the data element is not included in the start-up information.

18. The system of claim 16, wherein selectively instantiating data based on the comparing comprises determining that the data element matches an output data of a tool, and in response, populating one or more parameters of the tool with respective template elements to provide an executable command, the respective template elements being subsequently instantiated.

19. The system of claim 18, wherein selectively instantiating data based on the comparing further comprises adding one or more input data of the tool to the pool of data elements.

20. The system of claim 15, wherein the attack tree comprises a combination of two or more attack vectors for attacking the target system.