Method, product, and system for analyzing attack paths in computer network generated using a software representation that embodies network configuration and policy data for security management
Disclosed is an approach for analyzing attack paths in computer network generated using a software representation that embodies network configuration and policy data for security management. In some embodiments, the approach includes a process to analyze attack paths in a computer network to determine which attack paths might be most productively covered using a corresponding detection signature. In some embodiments, the attack paths are identified using a software representation that embodies network configuration and policy data. The software representation comprises a state machine where different states can be reached using respective transitions or properties. The states correspond to respective entities on the network which may comprise resources that are identifiable for protection in the software representation using crash statements. The software representation can then be stimulated using software analysis tools such to identify sequences of state-to-state transitions that could be used to compromise a protected resource on the computer network.
1 . A method comprising:
selecting possible attack paths in a computer network for processing, wherein the possible attack paths comprise sequences of state-to-state transitions, the possible attack paths in the computer network were identified by analyzing a software representation of the computer network and causing crash statements in the software representation to be executed, wherein execution of a crash statement in the software representation indicates that a state corresponding to a protected resource has been reached, and the software representation of the computer network was generated based on network configuration data and network policy data; and
processing the possible attack paths by:
identifying a plurality of candidate triggers from the sequences of state-to-state transitions in the possible attack paths, wherein the plurality of candidate triggers comprise at least subsets of respective sequences of state-to-state transitions, and the plurality of candidate triggers include sequences of state-to-state transitions having different numbers of state-to-state transitions;
ranking respective candidate triggers of the plurality of candidate triggers; and
selecting at least some of the respective candidate triggers based on their respective ranks.
2 . The method of claim 1 , wherein the network configuration data specifies access rights allocated to respective groups, the network policy data specifies comprises a set of access rights for group members to access network resources, and the state corresponding to the protected resource comprises a state that represents a potential attacker acquiring privileges to access the protected resource.
3 . The method of claim 1 , further comprising removing candidate triggers having a candidate trigger length less than a minimum threshold from the plurality of candidate triggers.
4 . The method of claim 1 , further comprising removing candidate triggers that are not associated with a corresponding detection signature template from the plurality of candidate triggers.
5 . The method of claim 1 , wherein ranking respective candidate triggers is based on at least a number of protected entities reachable from a last state of the candidate trigger.
6 . The method of claim 1 , wherein at least a threshold number of candidate triggers are selected for each corresponding protected entity.
7 . The method of claim 1 , wherein selection of the respective candidate triggers is performed on a protected entity by protected entity basis.
8 . The method of claim 1 , further comprising generating one or more detection signatures based on the at least some of the respective candidate triggers.
9 . A non-transitory computer readable medium having stored thereon a set of instructions, the set of instructions, when executed by a processor, causing a set of acts comprising:
selecting possible attack paths in a computer network for processing, wherein the possible attack paths comprise sequences of state-to-state transitions, the possible attack paths in the computer network were identified by analyzing a software representation of the computer network and causing crash statements in the software representation to be executed, wherein execution of a crash statement in the software representation indicates that a state corresponding to a protected resource has been reached, and the software representation of the computer network was generated based on network configuration data and network policy data; and
processing the possible attack paths by:
identifying a plurality of candidate triggers from the sequences of state-to-state transitions in the possible attack paths, wherein the plurality of candidate triggers comprise at least subsets of respective sequences of state-to-state transitions, and the plurality of candidate triggers include sequences of state-to-state transitions having different numbers of state-to- state transitions;
ranking respective candidate triggers of the plurality of candidate triggers; and
selecting at least some of the respective candidate triggers based on their respective ranks.
10 . The computer readable medium of claim 9 , wherein the network configuration data specifies access rights allocated to respective groups, the network policy data specifies comprises a set of access rights for group members to access network resources, and the state corresponding to the protected resource comprises a state that represents a potential attacker acquiring privileges to access the protected resource.
11 . The computer readable medium of claim 9 , wherein the set of acts further comprise removing candidate triggers having a candidate trigger length less than a minimum threshold from the plurality of candidate triggers.
12 . The computer readable medium of claim 9 , wherein the set of acts further comprise removing candidate triggers that are not associated with a corresponding detection signature template from the plurality of candidate triggers.
13 . The computer readable medium of claim 9 , wherein ranking respective candidate triggers is based on at least a number of protected entities reachable from a last state of the candidate trigger.
14 . The computer readable medium of claim 9 , wherein at least a threshold number of candidate triggers are selected for each corresponding protected entity.
15 . The computer readable medium of claim 9 , wherein selection of the respective candidate triggers is performed on a protected entity by protected entity basis.
16 . The computer readable medium of claim 9 , wherein the set of acts further comprise generating one or more detection signatures based on the at least some of the respective candidate triggers.
17 . A computing system comprising:
a memory storing a set of instructions; and
a processor to execute the set of instructions to perform a set of acts comprising:
selecting possible attack paths in a computer network for processing, wherein the possible attack paths comprise sequences of state-to-state transitions, the possible attack paths in the computer network were identified by analyzing a software representation of the computer network and causing crash statements in the software representation to be executed, wherein execution of a crash statement in the software representation indicates that a state corresponding to a protected resource has been reached, and the software representation of the computer network was generated based on network configuration data and network policy data; and
processing the possible attack paths by:
identifying a plurality of candidate triggers from the sequences of state-to-state transitions in the possible attack paths, wherein the plurality of candidate triggers comprise at least subsets of respective sequences of state-to-state transitions, and the plurality of candidate triggers include sequences of state-to-state transitions having different numbers of state-to-state transitions;
ranking respective candidate triggers of the plurality of candidate triggers; and
selecting at least some of the respective candidate triggers based on their respective ranks.
18 . The computing system of claim 17 , wherein the network configuration data specifies access rights allocated to respective groups, the network policy data specifies comprises a set of access rights for group members to access network resources, and the state corresponding to the protected resource comprises a state that represents a potential attacker acquiring privileges to access the protected resource.
19 . The computing system of claim 17 , wherein the set of acts further comprise removing candidate triggers having a candidate trigger length less than a minimum threshold from the plurality of candidate triggers.
20 . The computing system of claim 17 , wherein the set of acts further comprise removing candidate triggers that are not associated with a corresponding detection signature template from the plurality of candidate triggers.
21 . The computing system of claim 17 , wherein ranking respective candidate triggers is based on at least a number of protected entities reachable from a last state of the candidate trigger.
22 . The computing system of claim 17 , wherein at least a threshold number of candidate triggers are selected for each corresponding protected entity.
23 . The computing system of claim 17 , wherein selection of the respective candidate triggers is performed on a protected entity by protected entity basis.
24 . The computing system of claim 17 , wherein the set of acts further comprise generating one or more detection signatures based on the at least some of the respective candidate triggers.