Method for improving the security of a networked system by adjusting the configuration parameters of the system components
One embodiment provides a method for facilitating security in a system of networked components. During operation, the system constructs a configuration graph that stores a first set of relationships between configuration parameters within a component and a second set of relationships between configuration parameters across different components. A relationship corresponds to a constraint and is indicated by one or more of: a range for a configuration parameter; and a conjunction or a disjunction of logical relationships between two or more configuration parameters. The system generates a set of candidate configuration parameter values that satisfy the constraints of the relationships in the configuration graph. The system selects, from the set of candidate configuration parameter values, a first set of configuration parameter values that optimizes a security objective function.
1. A computer-implemented method for facilitating security in a system of networked components, the method comprising:
constructing a configuration graph that stores a first set of relationships between configuration parameters within a component and a second set of relationships between configuration parameters across different components,
wherein a relationship corresponds to a constraint and is indicated by one or more of:
a range for a configuration parameter; and
a conjunction or a disjunction of logical relationships between two or more configuration parameters,
wherein the configuration graph includes a plurality of nodes, including a first class of nodes and a second class of nodes,
wherein a node in the first class indicates a value for a configuration parameter for a first component, and
wherein a node in the second class indicates a relationship between configuration parameters, including the within-component configuration parameters of the first set of relationships and the across-component configuration parameters of the second set of relationships;
generating a set of candidate configuration parameter values that satisfy the constraints of the relationships in the configuration graph; and
selecting, from the set of candidate configuration parameter values, a first set of configuration parameter values that optimizes a security objective function.
2. The method of claim 1 , wherein the security objective function comprises reducing a size of an attack surface of the system of networked components.
3. The method of claim 1 , wherein the security objective function comprises reducing an amount of damage caused by a sequence of attacks that exploit vulnerabilities in the components,
wherein the vulnerabilities are induced by a respective set of candidate configuration parameter values.
4. The method of claim 1 , wherein generating the set of candidate configuration parameter values is based on one or more of:
a Satisfiability (SAT) Solver; and
a Satisfiability Modulo Theory (SMT) Solver.
5. The method of claim 1 , further comprising:
constructing a dependency graph that stores a third set of relationships which indicate functional dependencies and interactions between the components of the system,
wherein the third set of relationships imposes constraints on the first set of within-component relationships and the second set of across-component relationships of the configuration graph.
6. The method of claim 5 , further comprising:
constructing a vulnerability graph that stores dependencies between vulnerabilities associated with the components,
wherein the vulnerabilities are exploited based on the first set of within-component relationships and the second set of across-component relationships of the configuration graph,
wherein satisfying the relationship between the configuration parameters in the node in the second class of nodes in the configuration graph results in satisfying a precondition for a vulnerability in the vulnerability graph, and
wherein each set of candidate configuration parameter values induces constructing a specific vulnerability graph.
7. The method of claim 6 , wherein the vulnerability graph and the dependency graph are generated based on one or more of:
a manual generation involving a user; and
an automatic generation based on software tools which scan the components during operation.
8. The method of claim 6 , further comprising:
solving an optimization problem by using the configuration graph together with the dependency graph and the vulnerability graph; and
removing or disabling, in a first order, unused dependencies associated with the third set of relationships in the dependency graph.
9. The method of claim 1 , further comprising:
receiving, from a computing device associated with a user, a request to obtain an optimal set of configuration parameter values for the components, wherein the request includes user-configured data,
wherein constructing the configuration graph, generating the set of candidate configuration parameter values, and selecting the first set of configuration parameters are in response to receiving the request;
returning, to the computing device associated with the user, the selected first set of configuration parameter values; and
displaying, on a display of the computing device associated with the user, one of more of:
a visual representation of a multi-layer graph using the first set of configuration parameter values, wherein the multi-layer graph comprises the configuration graph, a dependency graph, and a vulnerability graph;
the selected first set of configuration parameter values;
a visualization of the selected first set of configuration parameter values;
a graphical user interface which allows the user to adjust or change any of the selected first set of configuration parameter values; and
an explanation of the selected first set of configuration parameter values, including a textual reason for why the selected first set of configuration parameter values solves an optimization problem created by the request.
10. A computer system for facilitating security in a system of networked components, the system comprising:
a processor; and
a storage device storing instructions that when executed by the processor cause the processor to perform a method, the method comprising:
constructing a configuration graph that stores a first set of relationships between configuration parameters within a component and a second set of relationships between configuration parameters across different components,
wherein a relationship corresponds to a constraint and is indicated by one or more of:
a range for a configuration parameter; and
a conjunction or a disjunction of logical relationships between two or more configuration parameters,
wherein the configuration graph includes a plurality of nodes, including a first class of nodes and a second class of nodes,
wherein a node in the first class indicates a value for a configuration parameter for a first component, and
wherein a node in the second class indicates a relationship between configuration parameters, including the within-component configuration parameters of the first set of relationships and the across-component configuration parameters of the second set of relationships;
generating a set of candidate configuration parameter values that satisfy the constraints of the relationships in the configuration graph; and
selecting, from the set of candidate configuration parameter values, a first set of configuration parameter values that optimizes a security objective function.
11. The computer system of claim 10 , wherein the security objective function comprises reducing a size of an attack surface of the system of networked components.
12. The computer system of claim 10 , wherein the security objective function comprises reducing an amount of damage caused by a sequence of attacks that exploit vulnerabilities in the components,
wherein the vulnerabilities are induced by a respective set of candidate configuration parameter values.
13. The computer system of claim 10 , wherein generating the set of candidate configuration parameter values is based on one or more of:
a Satisfiability (SAT) Solver; and
a Satisfiability Modulo Theory (SMT) Solver.
14. The computer system of claim 10 , wherein the method further comprises:
constructing a dependency graph that stores a third set of relationships which indicate functional dependencies and interactions between the components of the system,
wherein the third set of relationships imposes constraints on the first set of within-component relationships and the second set of across-component relationships of the configuration graph.
15. The computer system of claim 14 , wherein the method further comprises:
constructing a vulnerability graph that stores dependencies between vulnerabilities associated with the components,
wherein the vulnerabilities are exploited based on the first set of within-component relationships and the second set of across-component relationships of the configuration graph,
wherein satisfying the relationship between the configuration parameters in the node in the second class of nodes in the configuration graph results in satisfying a precondition for a vulnerability in the vulnerability graph, and
wherein each set of candidate configuration parameter values induces constructing a specific vulnerability graph.
16. The computer system of claim 15 , wherein the vulnerability graph and the dependency graph are generated based on one or more of:
a manual generation involving a user; and
an automatic generation based on software tools which scan the components during operation.
17. The computer system of claim 15 , wherein the method further comprises:
solving an optimization problem by using the configuration graph together with the dependency graph and the vulnerability graph; and
removing or disabling, in a first order, unused dependencies associated with the third set of relationships in the dependency graph.
18. The computer system of claim 10 , wherein the method further comprises:
receiving, from a computing device associated with a user, a request to obtain an optimal set of configuration parameter values for the components, wherein the request includes user-configured data,
wherein constructing the configuration graph, generating the set of candidate configuration parameter values, and selecting the first set of configuration parameters are in response to receiving the request;
returning, to the computing device associated with the user, the selected first set of configuration parameter values; and
displaying, on a display of the computing device associated with the user, one of more of:
a visual representation of a multi-layer graph using the first set of configuration parameter values, wherein the multi-layer graph comprises the configuration graph, a dependency graph, and a vulnerability graph;
the selected first set of configuration parameter values;
a visualization of the selected first set of configuration parameter values;
a graphical user interface which allows the user to adjust or change any of the selected first set of configuration parameter values; and
an explanation of the selected first set of configuration parameter values, including a textual reason for why the selected first set of configuration parameter values solves an optimization problem created by the request.