Multi-step attack modelling and simulation (MsAMS) framework based on mobile ambients

Abstract

Attackers take advantage of any security breach to penetrate an organisation perimeter and exploit hosts as stepping stones to reach valuable assets, deeper in the network. The exploitation of hosts is possible not only when vulnerabilities in commercial off-the-shelf (COTS) software components are present, but also, for example, when an attacker acquires a credential on one host which allows exploiting further hosts on the network. Finding attacks involving the latter case requires the ability to represent dynamic models. In fact, more dynamic aspects are present in the network domain such as attackers accumulate resources (i.e. credentials) along an attack, and users and assets may move from one environment to another, although always constrained by the ruling of the network. In this paper we address these dynamic issues by presenting MsAMS (Multi-step Attack Modelling and Simulation), an implemented framework, based on Mobile Ambients, to discover attacks in networks. The idea of ambients fits naturally into this domain and has the advantage of providing flexibility for modelling. Additionally, the concept of mobility allows the simulation of attackers exploiting opportunities derived either from the exploitation of vulnerable and non-vulnerable hosts, through the acquisition of credentials. It also allows expressing security policies embedded in the rules of the ambients.

A Mobile Ambients-Based Approach for Network Attack Modelling and Simulation

“…In our tests it converged in less than 60 cycles for a test with 8000 nodes. In a previous implementation [28] we used a full matrix multiplication and fixed k, obtaining running times of O(n 3 ) when using more than 8000 nodes. Currently, we have an implementation in Haskell using a sparse matrix multiplication and a matrix akin to the Google matrix [27].…”

“…In this paper, we extend [23] in many ways. We review the modelling of the running example, introduce a new example, and provide more details on how we achieve requirements R 1 , R 2 and R 3 , such as, how we capture network locality and connectivity (Section VI), how virtual links are processed (Section VIII), and how we use ranking algorithms (Section IX).…”

Integrating attacker behavior in IT security analysis: a discrete-event simulation approach

“…A framework for the modeling and simulation of network attacks was subsequently developed in [10]. This contribution is unique in that it views the network as an ''ambient'' that contains other ''ambients'' and simulates an attacker who finds an attack path not through preconditions and postconditions, but by using an ''access-to-effect'' paradigm.…”

A risk management process for consumers

“…Currently the lack of security is not visible, but once others take notice, consumers will make sure that it is in order. It can also be argued that consumers will spend certainly less time than enterprises: they do not own large IT infrastructures comprising hundreds of servers, where the likelihood must be estimated that attackers will move from node to node in a long multistep attack [4]. For consumers, a cloud computing service can simply be considered as a black box.…”

“…In fact, users will be able to use more products and more securely, not being held back by worries about their security. 4 http://www.isaca.org/cobit/…”