Method, product, and system for analyzing a computer network to identify attack paths using a software representation that embodies network configuration and policy data for security management
Disclosed is an approach for analyzing a computer network to identify attack paths using a software representation that embodies network configuration and policy data for security management. The software representation comprises a state machine where different states can be reached using respective transitions or properties which are possible as determined based on the network configuration and network policy data. The states correspond to respective entities on the network which may comprise resources that are identifiable for protection in the software representation using crash statements. The software representation can then be stimulated using software analysis tools such as fuzzers to identify sequences of state-to-state transitions that could be used to compromise a protected resource on the computer network.
1. A method comprising:
identifying a software representation of a computing network, wherein the software representation was generated based on network configuration data and network policy data for the computer network;
analyzing the software representation to identify possible attack paths in the computer network by:
identifying one or more entities to protect from malicious activity;
inserting one or more crash statements into the software representation at one or more locations corresponding to the one or more entities to protect from malicious activity; and
executing the software representation using a fuzzer to generate inputs for the software representation having the one or more crash statements, wherein possible attack paths are represented by sequences of function calls identified in corresponding crash reports and crash reports are generated in response to an input from the fuzzer, the fuzzer is one of a plurality of fuzzer instances that generate inputs for one or more instances of the software representation, the plurality of fuzzer instances execute in parallel, the fuzzer executes using at least one of a random, mutation, concolic, or symbolic execution process, a second fuzzer of the plurality of fuzzer instances executes using at least one of a random, mutation, concolic, or symbolic execution process different from the fuzzer.
2. The method of claim 1 , wherein the network configuration data specifies access rights allocated to respective groups and the network policy data specifies comprises a set of access rights for group members to access network resources.
3. The method of claim 1 , wherein an attack path comprises at least a sequence of state changes that may be used to reach a target state from a starting state, wherein the target state corresponds to an entity to be protected.
4. The method of claim 1 , wherein the one or more entities comprise at least one file server, active directory, token service, or other authentication service.
5. The method of claim 1 , wherein execution of at least one crash statement is dependent on satisfaction of a condition.
6. The method of claim 1 , further comprising compiling the software representation into an executable form after inserting the one or more crash statements.
7. The method of claim 1 , wherein the plurality of fuzzer instances are distributed across a plurality of computing devices.
8. The method of claim 1 , further comprising determining, based on one or more metrics, whether a termination condition has been met for the execution of the software representation using the fuzzer.
9. A non-transitory computer readable medium having stored thereon a set of instructions, the set of instructions, when executed by a processor, causing a set of acts comprising:
identifying a software representation of a computing network, wherein the software representation was generated based on network configuration data and network policy data for the computer network;
analyzing the software representation to identify possible attack paths in the computer network by:
identifying one or more entities to protect from malicious activity;
inserting one or more crash statements into the software representation at one or more locations corresponding to the one or more entities to protect from malicious activity; and
executing the software representation using a fuzzer to generate inputs for the software representation having the one or more crash statements, wherein possible attack paths are represented by sequences of function calls identified in corresponding crash reports and crash reports are generated in response to an input from the fuzzer, the fuzzer is one of a plurality of fuzzer instances that generate inputs for one or more instances of the software representation, the plurality of fuzzer instances execute in parallel, the fuzzer executes using at least one of a random, mutation, concolic, or symbolic execution process, a second fuzzer of the plurality of fuzzer instances executes using at least one of a random, mutation, concolic, or symbolic execution process different from the fuzzer.
10. The computer readable medium of claim 9 , wherein the network configuration data specifies access rights allocated to respective groups and the network policy data specifies comprises a set of access rights for group members to access network resources.
11. The computer readable medium of claim 9 , wherein an attack path comprises at least a sequence of state changes that may be used to reach a target state from a starting state, wherein the target state corresponds to an entity to be protected.
12. The computer readable medium of claim 9 , wherein the one or more entities comprise at least one file server, active directory, token service, or other authentication service.
13. The computer readable medium of claim 9 , wherein execution of at least one crash statement is dependent on satisfaction of a condition.
14. The computer readable medium of claim 9 , wherein the set of acts further comprise compiling the software representation into an executable form after inserting the one or more crash statements.
15. The computer readable medium of claim 9 , wherein the plurality of fuzzer instances are distributed across a plurality of computing devices.
16. The computer readable medium of claim 9 , wherein the set of acts further comprise comprising determining, based on one or more metrics, whether a termination condition has been met for the execution of the software representation using the fuzzer based on one or more metrics.
17. A computing system comprising:
a memory storing a set of instructions; and
a processor to execute the set of instructions to perform a set of acts comprising:
identifying a software representation of a computing network, wherein the software representation was generated based on network configuration data and network policy data for the computer network;
analyzing the software representation to identify possible attack paths in the computer network by:
identifying one or more entities to protect from malicious activity;
inserting one or more crash statements into the software representation at one or more locations corresponding to the one or more entities to protect from malicious activity; and
executing the software representation using a fuzzer to generate inputs for the software representation having the one or more crash statements, wherein possible attack paths are represented by sequences of function calls identified in corresponding crash reports and crash reports are generated in response to an input from the fuzzer, the fuzzer is one of a plurality of fuzzer instances that generate inputs for one or more instances of the software representation, the plurality of fuzzer instances execute in parallel, the fuzzer executes using at least one of a random, mutation, concolic, or symbolic execution process, a second fuzzer of the plurality of fuzzer instances executes using at least one of a random, mutation, concolic, or symbolic execution process different from the fuzzer.
18. The computing system of claim 17 , wherein the network configuration data specifies access rights allocated to respective groups and the network policy data specifies comprises a set of access rights for group members to access network resources.
19. The computing system of claim 17 , wherein an attack path comprises at least a sequence of state changes that may be used to reach a target state from a starting state, wherein the target state corresponds to an entity to be protected.
20. The computing system of claim 17 , wherein the one or more entities comprise at least one file server, active directory, token service, or other authentication service.
21. The computing system of claim 17 , wherein execution of at least one crash statement is dependent on satisfaction of a condition.
22. The computing system of claim 17 , wherein the set of acts further comprise compiling the software representation into an executable form after inserting the one or more crash statements.
23. The computing system of claim 17 , wherein the plurality of fuzzer instances arc distributed across a plurality of computing devices.
24. The computing system of claim 17 , wherein the set of acts further comprise comprising determining, based on one or more metrics, whether a termination condition has been met for the execution of the software representation using the fuzzer based on one or more metrics.