Techniques for detecting exploitation of medical device vulnerabilities
A system and method for determining device attributes using a classifier hierarchy. The method includes: determining at least one exploitation condition for a medical device based on at least one first device attribute of the medical device and a plurality of second device attributes indicated in a vulnerabilities database, wherein the vulnerabilities database further indicates a plurality of known exploits for the plurality of second device attributes; analyzing behavior and configuration of the medical device to detect an exploitable vulnerability for the medical device, wherein the exploitable vulnerability is a behavior or configuration of the medical device which meets the at least one exploitation condition; and performing at least one mitigation action based on the exploitable vulnerability.
1. A method for detecting medical device exploitable vulnerabilities, comprising:
sequentially applying a plurality of sub-models of a hierarchy to a plurality of features extracted from device activity data, wherein the sequential application ends with applying a last sub-model of the plurality of sub-models, wherein each sub-model includes a plurality of classifiers, wherein each sub-model outputs a class when applied to at least a portion of the plurality of features, wherein each class is a classifier output representing a device attribute, wherein applying the plurality of sub-models further comprises iteratively determining a next sub-model to apply based on the class output by a most recently applied sub-model and the hierarchy;
determining one of at least one first device attribute of a medical device based on the class output by the last sub-model;
determining at least one exploitation condition for a medical device based on the at least one first device attribute of the medical device and a plurality of second device attributes indicated in a vulnerabilities database, wherein the vulnerabilities database further indicates a plurality of known exploits for the plurality of second device attributes;
analyzing behavior and configuration of the medical device to detect an exploitable vulnerability for the medical device, wherein the exploitable vulnerability is a behavior or configuration of the medical device which meets the at least one exploitation condition; and
performing at least one mitigation action based on the exploitable vulnerability.
2. The method of claim 1 , wherein the at least one first device attribute includes use of an unencrypted communications protocol, wherein the behavior of the medical device includes a connection to the Internet, wherein the plurality of known exploits includes connecting to the Internet while using the unencrypted communications protocol.
3. The method of claim 2 , wherein the at least one mitigation action includes disconnecting the medical device from the Internet.
4. The method of claim 1 , wherein the medical device is any of a medical imaging device, a diagnostic device, life support equipment, a pump, a defibrillator, and a pacemaker.
5. The method of claim 1 , wherein the at least one exploitation condition includes at least one of: a point of connection, a behavior, and a configuration parameter.
6. The method of claim 5 , wherein the at least one exploitation condition includes a point of connection, wherein the point of connection is any of: a port, a router, a network, and a switch.
7. The method of claim 1 , further comprising:
querying a vulnerability scanner based on the analyzed behavior and configuration of the medical device, wherein the currently exploitable vulnerability is detected based further on a response of the vulnerability scanner to the query.
8. The method of claim 1 , wherein each classifier is trained to output a class and a confidence score, wherein the class output by each sub-model is determined based on the class and the confidence score output by each classifier of the sub-model.
9. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:
sequentially applying a plurality of sub-models of a hierarchy to a plurality of features extracted from device activity data, wherein the sequential application ends with applying a last sub-model of the plurality of sub-models, wherein each sub-model includes a plurality of classifiers, wherein each sub-model outputs a class when applied to at least a portion of the plurality of features, wherein each class is a classifier output representing a device attribute, wherein applying the plurality of sub-models further comprises iteratively determining a next sub-model to apply based on the class output by a most recently applied sub-model and the hierarchy;
determining one of at least one first device attribute of a medical device based on the class output by the last sub-model;
determining at least one exploitation condition for a medical device based on the at least one first device attribute of the medical device and a plurality of second device attributes indicated in a vulnerabilities database, wherein the vulnerabilities database further indicates a plurality of known exploits for the plurality of second device attributes;
analyzing behavior and configuration of the medical device to detect an exploitable vulnerability for the medical device, wherein the exploitable vulnerability is a behavior or configuration of the medical device which meets the at least one exploitation condition; and
performing at least one mitigation action based on the exploitable vulnerability.
10. A system for determining device attributes using a classifier hierarchy, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
sequentially apply a plurality of sub-models of a hierarchy to a plurality of features extracted from device activity data, wherein the sequential application ends with applying a last sub-model of the plurality of sub-models, wherein each sub-model includes a plurality of classifiers, wherein each sub-model outputs a class when applied to at least a portion of the plurality of features, wherein each class is a classifier output representing a device attribute, wherein applying the plurality of sub-models further comprises iteratively determining a next sub-model to apply based on the class output by a most recently applied sub-model and the hierarchy;
determine one of at least one first device attribute of a medical device based on the class output by the last sub-model;
determine at least one exploitation condition for a medical device based on the at least one first device attribute of the medical device and a plurality of second device attributes indicated in a vulnerabilities database, wherein the vulnerabilities database further indicates a plurality of known exploits for the plurality of second device attributes;
analyze behavior and configuration of the medical device to detect an exploitable vulnerability for the medical device, wherein the exploitable vulnerability is a behavior or configuration of the medical device which meets the at least one exploitation condition; and
perform at least one mitigation action based on the exploitable vulnerability.
11. The system of claim 10 , wherein the at least one first device attribute includes use of an unencrypted communications protocol, wherein the behavior of the medical device includes a connection to the Internet, wherein the plurality of known exploits includes connecting to the Internet while using the unencrypted communications protocol.
12. The system of claim 11 , wherein the at least one mitigation action includes disconnecting the medical device from the Internet.
13. The method of claim 10 , wherein the medical device is any of a medical imaging device, a diagnostic device, life support equipment, a pump, a defibrillator, and a pacemaker.
14. The system of claim 10 , wherein the at least one exploitation condition includes at least one of: a point of connection, a behavior, and a configuration parameter.
15. The system of claim 14 , wherein the at least one exploitation condition includes a point of connection, wherein the point of connection is any of: a port, a router, a network, and a switch.
16. The system of claim 10 , wherein the system is further configured to:
query a vulnerability scanner based on the analyzed behavior and configuration of the medical device, wherein the currently exploitable vulnerability is detected based further on a response of the vulnerability scanner to the query.
17. The system of claim 10 , wherein each classifier is trained to output a class and a confidence score, wherein the class output by each sub-model is determined based on the class and the confidence score output by each classifier of the sub-model.