Attack Simulation for a Realistic Evaluation and Comparison of Network Security Techniques

Bajic, Alexander; Becker, Georg T.

doi:10.1007/978-3-030-03638-6_15

Cited by 2 publications

(4 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This paper builds upon the 2018 NordSec conference paper [8] which showed the general feasibility of attack simulation and its ability to generate meaningful insights. However, it also showed how susceptible results are to minute details of the benchmark network.…”

Section: Main Contributionmentioning

confidence: 99%

“…For our case study we assume a mid-sized corporate network consisting of nine subnets. These allow for a considerably more complex network hierarchy than the three subnets used in previous investigations [8], let alone scenarios that consist of merely three hypervisors and five unspecific VMs [24]. While this generally requires more lateral movement for the attacker to compromise all valuable resources, it also provides more occasions for defenses to unfold their potential and learn about their effects.…”

Section: Case Studymentioning

confidence: 99%

“…Seemingly unimportant details of the underlying network model may have a significant impact on simulation development. This was highlighted in previous work where the starting location of VMs drastically impacted the defense performance, rais-ing strong doubts on the usefulness of analyzing defenses in only few benchmark networks [8]. Therefore, we do not perform attack and defense simulation on a single modeled network, but on a large number of diverse benchmark networks that are carefully composed in an automated fashion based on a scenario definition and a "benchmark fuzzing" approach.…”

Section: Introductionmentioning

confidence: 99%

“…This allows for quantitative analysis and comparison which was previously not possible and increases the chances of detecting corner cases. To put findings into perspective, the same defenses as in prior research [8] are investigated. These comprise IP address randomization [11,20,26,28,33] (short: IP shuffling), state-preserving VM migration [1,5,24] which we denote as live migration, stateresetting VM migration [3,18] denoted as cold migration, as well as sole VM resetting.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Automated benchmark network diversification for realistic attack simulation with application to moving target defense

Bajic

Becker²

2021

Int. J. Inf. Secur.

Self Cite

View full text Add to dashboard Cite

With numbers of exploitable vulnerabilities and attacks on networks constantly increasing, it is important to employ defensive techniques to protect one’s systems. A wide range of defenses are available and new paradigms such as Moving Target Defense (MTD) rise in popularity. But to make informed decisions on which defenses to implement, it is necessary to evaluate their effectiveness first. In many cases, the full impact these techniques have on security is not well understood yet. In this paper we propose network defense evaluation based on detailed attack simulation. Using a flexible modeling language, networks, attacks, and defenses are described in high detail, yielding a fine-grained scenario definition. Based on this, an automated instantiator generates a wide range of realistic benchmark networks. These serve to perform simulations, allowing to evaluate the security impact of different defenses, both quantitatively and qualitatively. A case study based on a mid-sized corporate network scenario and different Moving Target Defenses illustrates the usefulness of this approach. Results show that virtual machine migration, a frequently suggested MTD technique, more often degrades than improves security. Hence, we argue that evaluation based on realistic attack simulation is a qualified approach to examine and verify claims of newly proposed defense techniques.

show abstract

Section: Main Contributionmentioning

confidence: 99%

Section: Case Studymentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%