System and method to perform automated red teaming in an organizational network

1. A system for performing automated red teaming in an organizational network, the system comprising:

a hardware processor; and

a memory coupled to the processor, wherein the memory comprises a set of program instructions in the form of a plurality of subsystems, configured to be executed by the processor, wherein the plurality of subsystems comprises:

a secure data gathering subsystem configured to obtain an input data and an exit criterion for an organization from one or more data sources via a network, wherein the input data comprises an attack graph and the exit criterion comprises a set of rules;

an attack surface determination subsystem configured to automatically determine one or more attack surface associated with the organization based on the obtained input data and the exit criterion, wherein the one or more attack surfaces comprises least secure points in the organizational network;

an attack frontier identifier subsystem configured to identify one or more attack frontiers for each of the determined one or more attack surfaces, wherein the one or more attack frontiers comprises a set of security attacks to be launched at the determined one or more attack surface;

a prioritization subsystem configured to prioritize each of the identified one or more attack frontiers using one or more pre-defined prioritization strategies;

an emulation subsystem configured to simulate the identified one or more attack frontiers at the determined one or more attack surfaces based on the prioritization;

an attack path determination subsystem configured to determine one or more attack paths associated with at least one of the one or more attack surface based on results of simulation;

a learning subsystem configured to continuously learn attack patterns associated with the determined one or more attack paths based on the results of execution using a plurality of learning techniques; and

an artificial intelligence-based security model generation subsystem configured to generate an artificial intelligence-based security model representing vulnerability of the one or more attack surfaces based on the learnt attack patterns, wherein the artificial intelligence-based security model comprises attack paths correlated with the attack patterns and a risk assessment value associated with each of the one or more attack surface.

2. The system as claimed in claim 1 , wherein in automatically determining the one or more attack surface associated with the organization based on the obtained input data and the exit criterion, the attack surface determination subsystem is configured to:

determine list of connected network assets present in an organizational network based on the obtained input data and the exit criterion, wherein the organizational network comprises one or more attack surfaces existing internally or externally of the network assets;

determine one or more network parameters associated with the one or more attack surfaces based on the determined list of connected network assets;

determine whether the one or more network parameters matches with a corresponding pre-stored one or more network parameters; and

determine the one or more attack surfaces susceptible to security attacks if the one or more network parameters fail to match with the corresponding pre-stored one or more network parameters.

3. The system as claimed in claim 1 , wherein in identifying one or more attack frontiers for each of the determined one or more attack surfaces, the attack frontier identifier subsystem is configured to:

determine type of the one or more attack surfaces based on the obtained input data and the exit criterion;

determine one or more behavioral parameters associated with the one or more attack surfaces based on the obtained input data and the exit criterion and the determined type of the one or more attack surfaces, wherein the one or more behavioral parameters comprises current state, historical events, and current configuration of the one or more attack surfaces;

analyze time series data associated with the one or more attack surfaces;

correlate the determined one or more behavioral parameters and the analyzed time series data with a corresponding pre-stored behavioral parameters and the pre-stored time series data; and

identify the one or more attack frontiers applicable to each of the determined one or more attack surfaces based on the correlation and the type of one or more attack surfaces.

4. The system as claimed in claim 1 , wherein in prioritizing each of the identified one or more attack frontiers using one or more pre-defined prioritization strategies, the prioritization subsystem is configured to:

determine one or more historical successful attack paths associated with the one or more attack surfaces;

validate the one or more historical successful attack paths based on a set of predefined rules;

determine a priority assignment policy for prioritizing each of the identified one or more attack frontiers based on successful validation; and

prioritize each of the identified one or more attack frontiers based on the determined priority assignment policy.

5. The system as claimed in claim 1 , wherein in simulating the identified one or more attack frontiers at the determined one or more attack surfaces based on the prioritization, the emulation subsystem is configured to:

determine one or more tasks to be performed at the one or more attack surfaces by mapping, in the order of priority, the identified one or more attack frontiers with corresponding pre stored tasks;

generate one or more virtual instances of the determined one or more tasks to be performed at the one or more attack surfaces; and

simulate the identified one or more attack frontiers at the determined one or more attack surfaces by executing the generated one or more virtual instances of the determined one or more tasks in a virtual simulation network, wherein the virtual simulation network mimics the physical organization network and wherein the virtual simulation network comprises virtual network assets and virtual attack surfaces emulating the physical network assets and the physical attack surfaces respectively.

6. The system as claimed in claim 1 , wherein in determining one or more attack paths associated with at least one of the one or more attack surface based on results of simulation, the attack path determination subsystem is configured to:

determine locations of the one or more attack surfaces susceptible to security attacks based on the results of simulation;

determine possible communication channels through which the one or more attack surfaces are susceptible to the security attacks; and

determine possible one or more attack paths associated with at least one of the one or more attack surface based on the determined possible communication channels and the locations of the one or more attack surfaces, wherein the one or more attack paths comprises a location of the communication channel connecting the one or more attack surfaces.

7. The system as claimed in claim 1 , wherein in generating the artificial intelligence-based security model representing vulnerability of the one or more attack surfaces based on the learnt attack patterns, the artificial intelligence-based security model generation subsystem is configured to:

validate the learnt attack patterns based on one or more pre-stored validation rules;

determine whether configuration associated with the one or more digital surfaces require a change based on the validation;

update the configuration associated with the one or more digital surfaces based on the determination;

correlate the determined attack paths, and the validated attack patterns with the updated configuration associated the one or more digital surfaces;

assign a risk assessment value for each of the one or more attack surface based on the correlation; and

generate the artificial intelligence-based security model representing vulnerability of the one or more attack surfaces based on the assigned risk assessment value, wherein the artificial intelligence-based security model comprises the correlation and the risk assessment value associated with each of the one or more attack surface.

8. A method to perform automated red teaming in an organizational network, the method comprising:

obtaining, by a processor, an input data and an exit criterion for an organization from one or more data sources via a network, wherein the input data comprises an attack graph and the exit criterion comprises a set of rules;

automatically, by the processor, determining one or more attack surface associated with the organization based on the obtained input data and the exit criterion, wherein the one or more attack surfaces comprises least secure points in the organizational network;

identifying, by the processor, one or more attack frontiers for each of the determined one or more attack surfaces, wherein the one or more attack frontiers comprises a set of security attacks to be launched at the determined one or more attack surface;

prioritizing, by the processor, each of the identified one or more attack frontiers using one or more pre-defined prioritization strategies;

simulating, by the processor, the identified one or more attack frontiers at the determined one or more attack surfaces based on the prioritization;

determining, by the processor, one or more attack paths associated with at least one of the one or more attack surface based on results of simulation;

continuously learning, by the processor, attack patterns associated with the determined one or more attack paths based on the results of execution using a plurality of learning techniques; and

generating, by the processor, an artificial intelligence-based security model representing vulnerability of the one or more attack surfaces based on the learnt attack patterns, wherein the artificial intelligence-based security model comprises attack paths correlated with the attack patterns and a risk assessment value associated with each of the one or more attack surface.

9. The method as claimed in claim 8 , further comprising:

outputting the generated artificial intelligence-based model on a user interface of a user device.

10. The method as claimed in claim 8 , wherein automatically determining the one or more attack surface associated with the organization based on the obtained input data and the exit criterion comprises:

determining list of connected network assets present in an organizational network based on the obtained input data and the exit criterion, wherein the organizational network comprises one or more attack surfaces existing internally or externally of the network assets;

determining one or more network parameters associated with the one or more attack surfaces based on the determined list of connected network assets;

determining whether the one or more network parameters matches with a corresponding pre-stored one or more network parameters; and

determining the one or more attack surfaces susceptible to security attacks if the one or more network parameters fail to match with the corresponding pre-stored one or more network parameters.

11. The method as claimed in claim 8 , wherein identifying one or more attack frontiers for each of the determined one or more attack surfaces comprises:

determining type of the one or more attack surfaces based on the obtained input data and the exit criterion;

determining one or more behavioral parameters associated with the one or more attack surfaces based on the obtained input data and the exit criterion and the determined type of the one or more attack surfaces, wherein the one or more behavioral parameters comprises current state, historical events, and current configuration of the one or more attack surfaces;

analyzing time series data associated with the one or more attack surfaces;

correlating the determined one or more behavioral parameters and the analyzed time series data with a corresponding pre-stored behavioral parameters and the pre-stored time series data; and

identifying the one or more attack frontiers applicable to each of the determined one or more attack surfaces based on the correlation and the type of one or more attack surfaces.

12. The method as claimed in claim 8 , wherein prioritizing each of the identified one or more attack frontiers using one or more pre-defined prioritization strategies comprises:

determining one or more historical successful attack paths associated with the one or more attack surfaces;

validating the one or more historical successful attack paths based on a set of predefined rules;

determining a priority assignment policy for prioritizing each of the identified one or more attack frontiers based on successful validation; and

prioritizing each of the identified one or more attack frontiers based on the determined priority assignment policy.

13. The method as claimed in claim 8 , wherein simulating the identified one or more attack frontiers at the determined one or more attack surfaces based on the prioritization comprises:

determining one or more tasks to be performed at the one or more attack surfaces by mapping, in the order of priority, the identified one or more attack frontiers with corresponding pre stored tasks;

generating one or more virtual instances of the determined one or more tasks to be performed at the one or more attack surfaces; and

simulating the identified one or more attack frontiers at the determined one or more attack surfaces by executing the generated one or more virtual instances of the determined one or more tasks in a virtual simulation network, wherein the virtual simulation network mimics the physical organization network and wherein the virtual simulation network comprises virtual network assets and virtual attack surfaces emulating the physical network assets and the physical attack surfaces respectively.

14. The method as claimed in claim 8 , wherein determining one or more attack paths associated with at least one of the one or more attack surface based on results of simulation comprises:

determining locations of the one or more attack surfaces susceptible to security attacks based on the results of simulation;

determining possible communication channels through which the one or more attack surfaces are susceptible to the security attacks; and

determining possible one or more attack paths associated with at least one of the one or more attack surface based on the determined possible communication channels and the locations of the one or more attack surfaces, wherein the one or more attack paths comprises a location of the communication channel connecting the one or more attack surfaces.

15. The method as claimed in claim 8 , wherein generating the artificial intelligence-based security model representing vulnerability of the one or more attack surfaces based on the learnt attack patterns comprises:

validating the learnt attack patterns based on one or more pre-stored validation rules;

determining whether configuration associated with the one or more digital surfaces require a change based on the validation;

updating the configuration associated with the one or more digital surfaces based on the determination;

correlating the determined attack paths, and the validated attack patterns with the updated configuration associated the one or more attack surfaces;

assigning a risk assessment value for each of the one or more attack surface based on the correlation; and

generating the artificial intelligence-based security model representing vulnerability of the one or more attack surfaces based on the assigned risk assessment value, wherein the artificial intelligence-based security model comprises the correlation and the risk assessment value associated with each of the one or more attack surface.