AU2018101260A4 - Automated Security Testing System and Method - Google Patents

Abstract

Systems and methods for network security testing of target computer networks using AI neural networks. A command and control server controls a number of geographically separated processors running a number of neural networks. A central data hive is accessible to all the processors. The processors are organizable into logical hemisphere groupings for specific tasks and/or projects. For security testing, hemisphere groupings are created for the project. Based on data for the target system on the data hive, attacks are formulated by a hemisphere grouping and these potential attacks are tested against known characteristics of the target network. Validated potential attacks and, in some cases, random attacks, are executed and data generated by the executed attacks are stored in the data hive for use in formulating and executing other further attacks. Potential attacks may involve mining social media networks for data on users of the target system. -27 -

Description

TECHNICAL FIELD [0001] The present invention relates to network security. More specifically, the present invention relates to systems and methods for automatically testing the security of at least one target network using artificial intelligence.

BACKGROUND [0002] The increasing ubiquity of computer networks in daily life has only heightened the importance of good network security. The hacking of corporate intranets of the past few years and the theft of not just corporate assets but also of customer information (including credit card data and personal information) shows that network security is no longer just a government matter but one for businesses as well.

[0003] In addition to periodic audits of corporate network security measures, companies sometimes hire tiger teams that try to hack the company network. These so-called white hat hackers attempt to penetrate corporate networks and, once the networks have been penetrated, the companies are made aware of the vulnerabilities of their cyber-assets. Penetration tests used against target computer networks are, admittedly, old. However, the most effective penetration tests have, so far, been spearheaded by human hackers. Penetration tests on networks can be automated but only after these tests have been formulated and designed by the human hackers.

Tests based on open ports and available services on the target networks can be automated but the determination of the need for such tests have, as yet, not been automated. As well, tests on networks by way of the vulnerable human element have also not been automated. Login determination, password guessing, and even determining who the users may be are still within the domain of the human hacker. As such, the speed at which such penetration tests can progress is hindered by how fast (or how slow) the human hacker can gather the information necessary about

- 1 2018101260 29 Aug 2018 potential target system users, gather the information about the target system, and how fast the hacker can formulate new potential passwords for such users. In addition, the process is limited by how fast the hacker can test the potential passwords against the target system.

[0004] Current systems are also susceptible to inconsistencies when it comes to the testing procedures. Human operator based testing is prone to failings that plague most human-implemented methods: inconsistency and speed. Human-based security tests tend to be inconsistent as the quality of the testing can be dependent on which tester is on duty. Some testers are more conscientious than others and there is a large risk that some tests may be inconsistently applied. Not only are some tests at the risk of not being applied, how those tests are applied is also subject to human failings.

Also, even if the tests are applied properly, there is no guarantee that the human tester will apply the tests multiple times — human testers can tend to apply a test once and not re-test. Thus, multiple iterations of the same test are less likely to be implemented with human testers. As well, the speed of the tests can be an issue. A human tester is subject to human speeds and the speed of human thought. Thus, multiple tests may take days if not weeks to implement. Finally, there is the cost of testing. Each human tester will need to be paid and, depending on the systems being tested and how rigorous the testing is, this can be quite expensive, especially for higher level human penetration testing specialists.

[0005] Given all of the above drawbacks for current penetration tests, there is therefore a need for newer, more automated systems that can perform penetration tests faster and more efficiently than current systems.

SUMMARY [0006] The present invention provides systems and methods for network security testing of target computer networks. A command and control server controls a number of geographically separated processors with each processor running a number of neural networks. A central data storage or data hive is accessible to all the processors. The -22018101260 29 Aug 2018 neural networks are organizable into logical hemisphere groupings for specific tasks and/or projects. For security testing, hemisphere groupings are created for the project. Based on data for the target system on the data hive, potential attacks are formulated by a hemisphere grouping and these potential attacks are tested against known characteristics of the target network or target system. Validated potential attacks and, in some cases, random attacks are executed against the target network and data generated by the executed attacks are stored in the data hive for use in formulating and executing other further attacks. Potential attacks may involve mining social media networks for data on potential users of the target system for data useful in automated formulation of potential passwords for such users. Each processor may run a number of neural networks and, within a processor, the neural networks being run may be trained differently from one another.

[0007] In one aspect, the present invention provides a system for use in security testing at least one target computer system, the system comprising:

- a command and control server for controlling and managing said system;

- a central data storage for said system;

- a plurality of processors, at least one of said plurality of processors executing computer readable instructions that implements a plurality of neural networks, said plurality of neural networks being organizable into hemisphere groups, each hemisphere group being tasked with at least one specific task, each of said plurality of processors being enabled to send and receive data to and from said central data storage and each of said plurality of processors being enabled for data communication with at least one other processor and with said command and control server;

wherein

- any data collected by processes executed by said plurality of processors regarding said at least one target computer system is stored in said central data storage.

-3 2018101260 29 Aug 2018 [0008] In another aspect, the present invention provides a method for organizing computer resources for testing a security of a target network, the target network being a computer network, the method comprising:

a) receiving data and characteristics for said target network and storing said data and characteristics in a central data storage data hive;

b) determining a state of said target network based on said data and characteristics stored in said data hive;

c) formulating a plurality of potential attacks using neural networks, said potential attacks being against said target network based on said state;

d) for each one of said plurality of potential attacks, determining if a module exists for said one of said plurality of potential attacks based on said state, said one of said plurality of potential attacks being a module-validated potential attack if said module exists for said one of said plurality of potential attacks, and said one of said plurality of potential attacks being invalid if no said module exists for said one of said plurality of potential attacks;

e) when at least one of said plurality of potential attacks is a module-validated potential attack, determining if conditions for said module-validated potential attack are present based on said data and characteristics in said data hive, said modulevalidated potential attack being an executable attack if said conditions are present and said module-validated potential attack being invalid if said conditions are absent;

f) when each of said plurality of potential attacks is invalid, executing a probability function that determines if a random module is selected for use in executing a random attack against said target computer system;

g) provisioning resources for each executable attack determined in step e) and for each random attack selected in step f); and

-42018101260 29 Aug 2018

h) executing said each executable attack and each said random attack, data being generated by each said executable attack and each said random attack being saved in said data hive.

BRIEF DESCRIPTION OF THE DRAWINGS [0009] The embodiments of the present invention will now be described by reference to the following figures, in which identical reference numerals in different figures indicate identical elements and in which:

FIGURE 1 is a block diagram of a system according to one aspect of the present invention;

FIGURE 2 is flow diagram detailing the steps for a login-based attack;

FIGURE 3 illustrates the steps in a social engineering-based attack;

FIGURE 4 is a flow diagram showing the steps in vulnerability testing; and

FIGURE 5 is a flow diagram showing the steps in web application vulnerability testing.

DETAILED DESCRIPTION [0010] Referring to Figure 1, illustrated is one aspect of the invention. In this aspect, a system 10 according to the invention includes a command and control server 20, a central data storage 30 (also referred to as a data hive), a number of hemisphere groups 40A, 40B, 40C, and multiple execution units 50A, 50B, 50C. As can be seen the control server 20 is in communication with all the hemisphere groups 40A, 40B, 40C as well as with the data hive 30 and the execution units 50A, 50B, 50C. All the hemispheres and all the execution units are in communication with the data hive to ensure that data can be sent to/from the data hive. It should be clear that each of the

-52018101260 29 Aug 2018 hemispheres 40A, 40B, 40C contains one or more neural networks. The neural networks are executed on processors such that one processor may implement one or more neural networks.

[0011] In operation, each hemisphere group is dedicated to one type of attack or one type of network vulnerability that can be exploited. (Note that all hemisphere groups are not required to be simultaneously active: hemisphere group activation may be based on what a client wants in terms of testing. Some clients may want all possible types of attacks to be tested while other clients may only want certain types of attacks to be tested.) Each target system has an associated “hive state”, a binary string based on the data in the hive storage that represents the overall state of the system. Each hemisphere group has access to this hive state, and uses it to generate a predictive score related to the type of attack to which that hemisphere group is dedicated. Each predictive score indicates whether that type of attack is likely to be successful against the target system. These predictive scores undergo a validation process. Attacks corresponding to any valid predictive scores are passed to an execution unit for execution. (If no predictive scores are valid, a probability function is used to determine whether a random attack should be selected for execution. This probability function will be described in more detail below.) The execution unit tasked with a specific attack (or tasked with a component of such an attack) can then execute the attack or component by calling on other available resources. A module score is generated by the execution of the attack component or the attack itself, and any data generated is then passed on to the data hive. The module score is a multibit binary number and can form part of a section of the hive state, and reflects the state of a portion of the target system corresponding to that module after the attack or attack component has been executed. The module score is compared to a corresponding section of the hive state, and if there are differences, the original hive state and data from the attack module are stored in the hive storage.

[0012] An updated hive state is then produced. In some implementations, the module scores, when concatenated, form an updated hive state. Such concatenation may occur in in a standardized order. In other implementations, individual module scores

-62018101260 29 Aug 2018 can be substituted for corresponding sections of the hive state. For instance, if many individual module scores differ from corresponding sections of the original hive state, concatenating them all into a new hive state may be preferred. However, any individual module score that indicates a change in the hive state can be substituted into the hive state, rather than re-concatenating many scores.

[0013] An updated hive state may indicate that new possible attacks or attack vectors are now available. This updated hive state is thus processed by the hemisphere groups, and the entire process then repeats such that, through multiple iterations, various multiple attacks are executed against the target system.

[0014] It should be clear that, while the hemisphere groups have neural networks within them, execution units may, depending on the attack or attack component being executed, form or use other neural networks. These other neural networks may be used for specific tasks such as natural language processing or image classification or processing.

[0015] As noted above, the system is ideally tasked with automated security testing of a target system. To this end, based on the data stored on the data hive regarding the target system, the system generates, validates, and executes attacks, exploits, and penetration tests against the target system. Data generated during an attack or exploit is stored in the data hive. This data generated by tests, exploits, and attacks is then used to formulate, validate, and execute further actions aimed at determining any security vulnerabilities that the target system may have. Should the data within the data hive not be sufficient for specific attacks or tests, the one or more of the hemisphere groups (and the internal artificial intelligence neural networks within) may launch probes against the target system as an attack component to gather such data and/or seek data regarding the target system online. It should be clear that all or most aspects of the target system may be subject to the attacks and/or tests ftom the system, including any ports, services, and/or protocols that may be available or present in the target system. As well, users of the target system are also potential targets for exploitation. As such, much like human hackers and system testers, the system will seek out potential target system users and attempt to generate possible -72018101260 29 Aug 2018 user logins and passwords as well as email addresses, email logins, and email passwords for these users. Data which can be the bases for such generated potential logins and passwords may be mined from publicly available sources such as social media websites, social media networks, personal websites, Dark web sources, bulletin board postings, and other online sources. In addition to the above, the system may also launch phishing attacks to try and obtain login credentials from unsuspecting users of the target system.

[0016] It should be clear that the terms “target system”, “target computer system”, and “target network”, as used herein, are interchangeable and may encompass a corporate intranet, a corporate data network, one or more websites, a company's social media accounts, a corporate email system, and a company's IT infrastructure as a whole.

[0017] For clarity, an attack may be defined as an attempt to gain unauthorized access to or make unauthorized use of a computer or IT asset on the target system. Similarly, an exploit is a specific type of attack, one which takes advantage of a particular vulnerability of the target system.

[0018] The system operates by first receiving data regarding the target system. This may come from a client wishing to have his or her corporate website/corporate network/IT assets tested for vulnerabilities. This data may be as simple as the corporate website address, the corporate IP address, and any other data which may be made available to the system. The data and known characteristics about the target system are then stored in the data hive. The system then generates a hive state based on the known data and characteristics of the target system. Scoring may be performed based on inputting the known data and characteristics of the target system into multiple functions, each of which generates a binary value (z. e., a 1 or a 0).

As an example, a function might be encoded to answer a query such as is port A open? or “is service X exposed?” The result would, of course, be a binary 1 or 0.

Preferably, each function only encodes the presence or absence of a single data bit or a single data point in the data hive regarding the target system. The results of all the functions are then concatenated into a string of Is and 0s, whose binary value operates as the hive state, the state of the target system for that particular point in -8 2018101260 29 Aug 2018 time. In one implementation, the hive state is a 2048-bit binary number. In such an implementation, there would be 2²⁰⁴⁸ possible hive states, representing ~3.2*10⁶¹⁶ possible distinct states of the target system. Additionally, in some implementations, each hive state can be seen as a composition of binary substrings, each binary substring corresponding to a specific attack and/or execution module. In such implementations, the binary substrings that compose the hive state are preferably arranged in a standardized order (that is, the same bits of the hive state always correspond to the same specific attack and/or execution module). The hive state can also be seen as an indication of the state of the hive data for that particular target system indicating which features, data, and characteristics about the target system exist on the data hive.

[0019] Once the initial hive state is calculated, this is made available to the various active hemispheres tasked with a specific project (e.g., the penetration testing of a specific target system using a specific type of attack or specific groups of attacks). The various processors in the various hemispheres may be executing software that implements neural networks that, in one implementation, is specifically configured for the classification of input data. These neural networks may then take the hive state and, based on the bit values, combinations of bit values, and perhaps the overall hive state, produce predictive scores representing potential attacks and/or exploits for the system to try on the target system. This so-called prediction step predicts which attacks and/or exploits may succeed against the target system. The prediction step processes the hive state using the neural networks, to essentially determine which attacks/exploits may work on the target system. The prediction step also determines which attacks/exploits may be launched based on the available data. The neural networks determine which combinations of available assets (e.g., ports, services, protocols, data, emails, etc.) are suitable for a specific attack or exploit. By using neural networks, complex combinations and subcombinations of attacks and/or exploits, and even what-if scenarios, can be determined to be possible against a specific target system. It should be clear that a neural network, with the hive state as an input, need not result in a single possible attack or exploit. Depending on the result from the neural network, multiple predictions as to which attacks, exploits, and

-92018101260 29 Aug 2018 tests may work may result from the output of a single neural network. As a simplified example, a neural network may determine that, since ports A, B, and C are known to be open on the target system and since services X, Y, and Z are known to be available on the same target system, then attacks D, E, and F and exploits G, H, and I are all possible against that target system.

[0020] In one implementation, each prediction (i.e., a possible attack or exploit) from a neural network results in a list of values that are between 0 and 1. These values are then rounded to either a 1 or a 0 to result in a multi-bit binary number that comprises the predictive score. The predictive score therefore represents the prediction that a specific attack/exploit may work on the target system. In some implementations, this predictive score may be a 16-bit number, though in other implementations this predictive score may be either longer or shorter than 16 bits.

The predictive score is then used as a UUID (universally unique identifier) and is used to validate the predictive score. At a first level, the validation operates by determining if the UUID corresponds to an existing attack or execution module in the system. If the module corresponding to the UUID exists, then the predictive score passes the first validation test. A second validation test is then performed, that of determining if enough resources and/or data exists to execute the module. The requirements of the module are checked against the hive state and against the data in the data hive. If all the requirements for executing the module are present, then the predictive score is fully validated. If not all of the requirements are present, then the predictive score is not validated and is discarded. As an example, if a module requires a valid login name and a valid password for that login and these are not present in the data hive, then the predictive score is discarded. Similarly, as another example, if the MAC address of a router in the target system is required by a module and such data is not available, then the predictive score is discarded (i.e., the module is not executed). It should be noted that if the predictive score is validated both times, the final validation step is to determine if other processors or execution units are executing the same module. This is done by querying the other processors. If another processor is already executing that module against the same target system,

-102018101260 29 Aug 2018 then the predictive score is discarded. Of course, if the predictive score passes this final validation step, then the module is set for execution.

[0021] As a more concrete example of the above process that ensures that the module is not being executed by another processor, this can be done by querying the command and control server using a process called pidlocking (i.e. process ID locking). In pidlocking, the module arguments (i.e. target IP address and target port), the hive name, and module, and an MD5Hash (a generated checksum) are submitted to the command and control server with a pidlock POST request. The command and control server response returns {status: success} or {status: failed}. If the command and control server returns {status: failed}, then the module is not executed since the MD5Hash is already present within the pid (process id) table and is therefore being executed by another processor. Once the processor is done executing a module, a pidunlock POST request is made using the same MD5Hash to remove the value from the pidtable.

[0022] If a hemisphere fails to generate a valid predictive score, a probability function is executed. This probability function determines whether a hemisphere selects a random module for execution against the target system. In one implementation, the probability function randomly generates an output number for the hemisphere, which can be bounded between a pre-set minimum value and a pre-set maximum value. This output number is compared with a pre-set threshold value that is also bounded between those minimum and maximum values. If the output is lower than that preset threshold value, the hemisphere selects a random module and executes that random module against the target system without first validating the random module. Each time a hemisphere fails to generate a valid prediction, the pre-set threshold value for that hemisphere is increased. Thus, each time a hemisphere fails to generate a valid prediction, the probability that the hemisphere will select a random module increases (because there is a higher chance that the randomly generated output number will be lower than the threshold value). On the other hand, each time a hemisphere produces a valid prediction, the pre-set threshold for that hemisphere is decreased. The use of such a probability function adds an element of randomness

-11 2018101260 29 Aug 2018 into the present invention and allows a trial-and-error approach when no valid predictions have been made. Additionally, as information about successful attacks is stored in the hive storage, if a randomly selected attack module is successful against the target system (i.e., the module score differs from the corresponding section of the hive state), information about that successful randomly selected attack will be preserved. In this way, the system can learn new conditions in which certain attacks were successful. These new conditions thus become part of the ‘knowledge base’ of the system.

[0023] For execution, the module is added to an execution queue along with the information needed for the module's execution. The module may be executed by any of the available processors based on the available resources for the system. After execution, any data generated by the module's execution is added to the data hive and may be used for later iterations of the prediction process outlined above. As can be imagined, data added to the data hive can change the hive state and, in doing so, may allow for other attacks and/or exploits to be available to the system. Of course, any successful penetrations of the target system can be included in a suitable report to the client. Preferably, such a report would include the vulnerabilities, the methods used to gain access to those vulnerabilities, and an indication as to how such vulnerabilities can be exploited to gain further unauthorized access to the target system. Depending on the tests executed as well as the configuration of the system, the report may include a vulnerability analysis report, a remediation plan based on vulnerabilities detected in the target system, a penetration test report, an application test report, and a social engineering test report (i.e., whether and how spoofing/phishing attacks were successfnl/unsuccessful), as well as remediation plans based on any of the above tests.

[0024] From the above, it is preferable that such a report includes an executive summary (indicating the scope of the test as per which hemispheres were enabled for testing) and the most critical vulnerabilities that were discovered. As well, it is preferable that the report include statistical data and graphs to visualize the number of vulnerabilities discovered (the vulnerabilities being organized by their risk rating),

- 122018101260 29 Aug 2018 the vulnerabilities themselves, the methods used to gain access to those vulnerabilities, an indication as to how such vulnerabilities can be exploited to gain further unauthorized access to the target system, and a mitigation plan for such vulnerabilities. For proof of the presence of the vulnerability, suitable screenshots may also be provided in the report.

[0025] It must be noted that the execution of a module may also involve the engagement of other processors and other neural networks. As an example, if a module designed for a login-based attack is executed, that module can activate a neural network to analyze and extract names from social network webpage as well as to analyze and extract email addresses from the results of a targeted online search. As well, other processors and neural networks may be called on to sift through the data gathered from other websites to determine a potential user's interests and, accordingly, possible passwords for that potential user.

[0026] As noted above, other processors and other neural networks may be engaged in aid of an attack. As another example if a module was designed for performing loginbased attacks against a web-form and the web-form was designed with a CAPTCHA test, a Convolutional Neural Network can be loaded that has been trained to specifically solve CAPTCHA tests. Another example of using dedicated neural networks is the use of natural language processing. For instance, a post-exploitation module may be executed where the module is designed to login to a compromised email account and read over each message sent and received with the objective of extracting sensitive information. This module can implement natural language processing in order to derive context from emails and to thereby extract sensitive data, including financial information or additional passwords. It should be clear that these additional neural networks are not part of any hemisphere and are libraries accessible by modules during run time. Additionally, it should be noted that these subsidiary neural networks are built into the automation workflow by the module developer and it is up to the module developer to use their discretion to determine if the use of an additional neural network is applicable to the module. For instance, if a module was to be designed to automate the process of downloading and analyzing

- 13 2018101260 29 Aug 2018 attachments from a compromised email, it would be likely that the module developer would determine that the best way to achieve this would be by using multiple neural networks that implement systems such as image recognition systems and natural language processing systems.

[0027] It should therefore be clear that, at any given point, the system may have multiple neural networks in their respective hemisphere groups generating potential attacks to the target system based on the hive state while, at the same time, other neural networks are, in parallel, executing other attacks and/or exploits against that target system as part of an execution unit. As well, other parts of the system may be performing a data sweep and/or reconnaissance to find further data regarding the target data. This data sweep may take the form of generating queries on online search engines to search for email addresses with the target system's domain name. As well, this may take the form of analyzing and parsing the target system's website to, again, extract email addresses, the names of potential users of the target system, contact information (e.g. telephone numbers, contact emails, names of contact persons), as well as potential target system portal information. It should be clear that, for online queries, the results of online searches can, again, be analyzed and parsed to find such information.

[0028] In addition to the above, publicly available social media networks and websites may also be mined for suitable information. Once the names of potential users of the target system are known (z. e,, stored in the hive storage and made available to the system), these names can be searched for in social media networks such as Linkedln and Facebook. These publicly available networks can then be, again, mined for information regarding the potential users. Such information retrieved is stored in the hive storage and is made available for later attempts at gaining access to the target system.

[0029] The above data mining operation may form one stage of a more complex attack that involves gaining access to the target system by logging into the target system itself.

The system can identify target system login portals commonly used by employees such as email and VPN web portals. The IP addresses in use by a target system may -142018101260 29 Aug 2018 be found by analyzing DNS responses for specific queries such as the results of an

MX record or SPF record. This may disclose information of hosted services or which IP addresses are able to send mail on behalf of the target system domain.

These and other tasks can be automated by using the classifier neural networks to classify the state of the available data and, based on that available data, determine whether a DNS record search, an IP address scan, or an analysis of web responses for login portal is necessary.

[0030] Once login portals have been identified, user names and passwords would be needed to be able to login to the target system itself. As noted above, social media networks may be mined for such information as people tend to self-identify their employers.

By analyzing and parsing search results on queries based on the target system's organization name, as well as search results based on the known information from the target system's own website, the names of potential users can be found. In addition, metadata from files found in Google searches (e.g., PDF or DOC files) can be retrieved and analyzed for author information. As well, targeted online searching can result in email addresses from forum posts or from blog postings. Another useful method for automated gathering of information, once the names of potential users are known, is the analysis of previously hacked databases that have been publicly leaked. These hacked databases from organizations such as Ashley Madison, Adobe, MySpace, and more, can yield not just employment information but also further names of potential users and passwords of the target system.

[0031] With the information gathered from various sources, the system can then seek suitable usernames and login information. The naming convention or the login convention can either be determined from an available known email address (from the data mining operation) or from an analysis of mined information. As noted above, this and other analyses may be performed using the various neural networks that form part of the system. Once the naming convention has been determined and once multiple potential target system users have been identified, a list of potential accounts on the target system can easily be automatically generated.

- 15 2018101260 29 Aug 2018 [0032] With the login portals determined and potential usernames and accounts identified, the system can then determine potential passwords for these accounts. Each potential user, now identified by name, can be the subject of an online search and not just on identified social networks. In addition to the well-known social network platforms (e.g., Facebook, MySpace, etc.), searches can also be performed on professional network sites such as Linkedln. These searches on the potential user should result in data reflecting what is important to that person as well as that person's interests. As an example, a suitable search on the social network platforms could result in, among other data, that person's possible birthdate, dates of milestones in life (e.g, graduation date, children's birthdates, etc.), the names of people potentially close to that person (e.g., names of spouse, children, friends, and/or pets), that person's favorite movies, that person's favorite songs, events that occurred in that person's life (e.g., concerts attended, vacations taken, where the vacations were taken, etc.), and sometimes even what is tattooed on that person’s body, or the bodies of their family members, acquaintances, and friends.

[0033] Natural language processing may be used to identify addresses, phone numbers, zip or postal codes, as well as names and other identity signifiers.

[0034] These data points for each potential user on the target system can form the basis of potential passwords that can automatically be generated by the system. In addition to these data points, common dictionary words related to the person's position within the target organization or related to that person's interests can also be used as the bases for automatically generated potential passwords. The automatically generated potential passwords can be a random rearranging of the various data points for that person (e.g., that person's last name concatenated with his or her first name, a pet name concatenated with a last name, an important date concatenated with non-letter symbols, etc., etc.), a random combination of these data points, a combination of one or more of these data points with letters, with numbers, and so on. The result is a list of automatically generated potential passwords for each of the potential usernames for the target system. With these potential names, usernames, and passwords generated, the system can then launch a targeted attack on the various login portals

- 162018101260 29 Aug 2018 for the target system. As can be imagined, the attack can simply be one where the system enters the various usernames into the login portal and then sequentially tries the various possible passwords into the portal. The main parts of the process for a login-based attack are detailed in Figure 2.

[0035] As noted above, any data derived from any of the attacks or from any of the probes or analyses of websites or of search results are all saved in the data hive. This ensures that the data is available for the generation of other possible attack vectors and other potential attacks or exploits against the target system.

[0036] It should also be clear that other types of attacks that target the users of the target system are also possible. One other type of attack is the more insidious phishing attack. Phishing is defined as the attempt to obtain sensitive information such as usernames, passwords, and credit card details (and money), by disguising an attacking entity as a trustworthy entity in an electronic communication. Thus, at its core, the phishing attack involves sending a disguised illegitimate email that prompts the recipient to re-enter his or her login credentials. When the user enters his or her credentials, the system can then use those login credentials to enter the target system and thus gain access to the target system's assets. Such access would allow other attacks to be possible and other parts of the target system to be compromised. The phishing attack can be launched once enough information has been gathered about the target system users such as email addresses. Preferably, the format and look of either the web login portal or the email login portal for the target system is known and can be replicated by the system. This can be extracted once the address of the login portal being used is known. Once a list of target email addresses have been compiled and once the fake login portal has been created, an email can then be formulated with the email warning or requesting that the recipient re-login because of some system issue or error. A link can be inserted into the email that causes its activation to bring the user to a webpage that replicates the target system's email login portal or the target system's web login portal. Of course, for added authenticity, the email sent can be spoofed so that its origin can seem to be from either the target system's administrator or a target system user in a technical role

- 172018101260 29 Aug 2018 (e.g., someone in the IT department that runs the target system). Alternatively, the email might describe a change or an issue with a mail server and explain that, in order to prevent further problems, the target system user is required to authenticate the phishing link in the email. Using the classifier neural network, the system can select the best fitting email template to use based on the information that has been saved in the data hive.

[0037] For the replication of the login portal, one option would be to analyze the HTML,

CSS, and Javascript source code of the target login page works, and then to recreate that login portal using the line by line code of the legitimate portal. Another option would be to create a reverse proxy using a similar domain name and a valid SSL certificate that allows for the capture of the user's password submissions from target system users. This step may be accomplished by using the neural network classifiers, as creating a reverse proxy requires both knowing a login portal, HTTP response headers for the login portal, and being able to generate a believable domain. The system may also slip in exploit code into the page content if a vulnerable client browser is identified. This allows for social-engineering/phishing attacks to deliver payloads such as Trojans (i.e., software that gets installed on to a system and gains access from within the network) to gain internal network access.

[0038] As noted above, the email generated may be configured to come from a member of the organization's technical team, i.e., the IT department in charge of the target system. The identity of a member of that department may have already been determined and stored in the data hive if a password or login-based attack has already been launched. If not, such an identity may be found by mining the various online sources noted above. To add further credence and authenticity to the email, a signature may be generated for the email or the signature may be extracted from a legitimate email. This may be executed by harvesting email addresses -- pregenerated emails from fake email accounts may be sent out to known or potential email addresses in an attempt to elicit a response from a user of the target system. Any response received from the target system user might contain a valid email signature and this signature can be extracted and used in later fake emails.

- 18 2018101260 29 Aug 2018

Alternatively, with enough information gathered, the system can create an email signature by generating one using location information discovered during reconnaissance steps. The main steps in the process for a social engineering/phishing attack can be found in Figure 3.

[0039] As noted above, the system may perform penetration tests on the target system to determine its vulnerabilities. In addition to the usual scanning and testing for open ports, the system may combine the detected vulnerabilities to find heretofore unknown issues with the target system. Known scanning methods involve scanning for open ports and attempting to grab version information related to the listening service. This version information is then cross-referenced with publicly disclosed vulnerabilities to determine the risk associated with the finding.

[0040] For the system, vulnerability scanning begins with no information present within the data hive regarding the target system. This results in a low hive state (that is, because little information is available, more initial functions return “0” than return “1”) and the system thus executes preliminary testing modules such as ping sweeps and port scans. As data discovered in these sweeps populates the data hive, the system will identify more opportunities to run additional fingerprinting modules. Depending on the kind of data discovered and saved to the data hive, the system will predict and generate new opportunities. The initial fingerprinting modules are used to get version information from the target system.

[0041] Once services have been identified and version information is known, the system can then attempt to predict which modules can be executed to trigger vulnerabilities. For instance, if an OpenS SH server is identified, the identifying neural network will classify it and select the appropriate modules. Each module is a standalone attack which can be executed in an attack chain within any order. The module(s) executed depends on the predictions produced by the classifier, as discussed above. Each vulnerability reported in the data hive is then classified in an attempt to select an exploitation module. For instance, if a password guessing vulnerability is identified where a user’s email password has been guessed, the system will likely identify the opportunity to run an “email harvester module” which can use natural language -192018101260 29 Aug 2018 processing to identify sensitive information within an employee's emails. Additionally, software exploitation modules use payloads that are automatically generated using information collected in previous phases/data sweeps. These payloads act as droppers to download and execute Trojans that will provide the system with remote access to the affected target system. Once this occurs, the system can perform target-system-side post-exploitation, which includes escalating privileges and spreading penetration software to additional systems that are discovered behind firewalls. Such penetration software, once installed, can thus be controlled from outside the firewalls and can assist in gaining further access to the target system.

[0042] The above process is repeated for each vulnerability discovered during a vulnerability assessment phase. The system therefore tries to trigger every vulnerability possible, but also tries to exploit the vulnerabilities to update the data hive with information which may be used in new attacks. For instance, if credentials are discovered in an employee's email, the system will identify an opportunity to use these credentials with another service. The steps in the process for a vulnerability testing process are detailed in Figure 4.

[0043] When the system encounters a customized or custom developed web application in the target system, the system operates in a manner as noted above.

[0044] When the system identifies a web application, the tables within the data hive for the web application will not contain any information. This will force the classifier to perform reconnaissance (i.e., a data gathering or a data sweep operation) as a first step. This may include launching web-spider modules, or URL brute force modules in an attempt to map out the size of the application. During this process, the system will save any information encountered that pertains to each web page that is discovered. This may include, among other data, HTTP response codes, response sizes and HTTP methods. The results of the initial reconnaissance are stored in the data hive and will affect the hive state. Based on the new hive state, the prediction stage will cause modules to analyze each web page discovered. During this process, the system will use a variety of modules based on how each page is classified. Pages -202018101260 29 Aug 2018 might receive multiple classifications and this may cause a single page to be processed in multiple ways. As an example, one neural network might flag a web page to be using PHP and, consequently, will cause the selection of a PHP attack module. Another neural network might notice that the same web page has a login portal and this neural network might determine that a login attack should be performed. A third neural network might determine that, rather than performing a password guessing attack, the login form should be tested for injection vulnerabilities. This shows that the system may check, in parallel, many possibilities for the existence of vulnerabilities. Moreover, this parallel scanning is accomplished while narrowing the scope of the scanning down to a select few modules that are relevant to the web application.

[0045] It should be noted that the analysis of each page in the web application may also include additional intelligence. One example is the use of natural language processing to identify sensitive information and to further identify additional attack vectors. As another example, image recognition may be used to break CAPTCHA tests and to circumvent other security mechanisms.

[0046] Each vulnerability discovered in the web application passes through an analysis process that leads to multiple attack and exploitation attempts as the classifier neural networks identify additional opportunities. When a vulnerability in the web application is successfully exploited, post-exploitation opportunities will be identified. This may lead to the system's extraction of sensitive information from the web application databases or to the system gaining remote code execution. As with other data discovered in other attacks and exploits, any findings from any postexploitation module are saved in the data hive. Such new data may lead to new opportunities for attacks that can be identified by the classifier neural networks. As a further example, if a SQL injection attack is performed and the system is able to extract administrator credentials from a database, the system can then identify the opportunity to use those credentials in a login form that may have been previously discovered. This process is repeated many times until all possible attack paths have been exhausted.

-21 2018101260 29 Aug 2018 [0047] [0048] [0049] [0050] [0051]

As with other attack vectors, for web applications, if successful exploitation of the various vulnerabilities occur and code execution is achieved on the targeted system, the system can activate different hemispheres to identify opportunities for deploying payloads such as Trojans. When this occurs, the system will follow the same intelligent workflow as the post-exploitation portion of the penetration testing hemisphere.

The steps in the testing of web applications are detailed in Figure 5.

It must be noted that, to initially train the various neural networks that are producing the predictions, multiple artificially generated hive states that resemble a specific data hive state are passed into the neural network to be trained to create a raw prediction. Then, using the calculated error from an initial prediction, adjustments to neuron dendrites can be made through a well-known process called backpropagation. This process can be completed a number of times until the calculated error on each cycle is acceptable. This is the standard way of training a feed-forward artificial neural network.

It should also be noted, as discussed above, that the system continues to learn after initial training. If an attack or exploit is successful (z. e., that attack or exploit changes the hive state), the initial hive state and data from the relevant attack or exploit module are stored in the hive storage and provide a basis for future predictions. This storage practice, coupled with the ability of the system to select a random module in certain circumstances (as already described), allows the system to account for new information and attempt attacks and/or exploits that it would not have initially predicted. Additionally, storing attack data in this way allows other neural networks on other, geographically separated systems to learn from the experiences of their peers. Thus, multiple bots can simultaneously benefit from one bot’s use of trial-and-error-based learning, in a community-learning process.

In one implementation, the various parts of the system communicate with each other by way of an IRC network. The IRC communications can also act as event logs that

-222018101260 29 Aug 2018 allow operators to monitor operations. Servers that are geographically dispersed can communicate through the IRC network.

[0052] The embodiments of the invention may be executed by a computer processor or similar device programmed in the manner of method steps, or may be executed by an electronic system which is provided with means for executing these steps. Similarly, an electronic memory means such as computer diskettes, CD-ROMs, Random Access Memory (RAM), Read Only Memory (ROM) or similar computer software storage media known in the art, may be programmed to execute such method steps. As well, electronic signals representing these method steps may also be transmitted via a communication network.

[0053] Embodiments of the invention may be implemented in any conventional computer programming language. For example, preferred embodiments may be implemented in a procedural programming language (e.g. C) or an object-oriented language (e.g. C++, “java”, “PHP”, “PYTHON” or “C#”). Alternative embodiments of the invention may be implemented as pre-programmed hardware elements, other related components, or as a combination of hardware and software components. Embodiments can be implemented as a computer program product for use with a computer system. Such implementations may include a series of computer instructions fixed either on a tangible medium, such as a computer readable medium (e.g., a diskette, CD-ROM, ROM, or fixed disk) or transmittable to a computer system, via a modem or other interface device, such as a communications adapter connected to a network over a medium. The medium may be either a tangible medium (e.g., optical or electrical communications lines) or a medium implemented with wireless techniques (e.g., microwave, infrared or other transmission techniques). The series of computer instructions embodies all or part of the functionality previously described herein. Those skilled in the art should appreciate that such computer instructions can be written in a number of programming languages for use with many computer architectures or operating systems. Furthermore, such instructions may be stored in any memory device, such as semiconductor, magnetic, optical or other memory devices, and may be transmitted

-23 2018101260 29 Aug 2018 using any communications technology, such as optical, infrared, microwave, or other transmission technologies. It is expected that such a computer program product may be distributed as a removable medium with accompanying printed or electronic documentation (e.g., shrink-wrapped software), preloaded with a computer system (e.g., on system ROM or fixed disk), or distributed from a server over a network (e.g., the Internet or World Wide Web). Of course, some embodiments of the invention may be implemented as a combination of both software (e.g., a computer program product) and hardware. Still other embodiments of the invention may be implemented as entirely hardware, or entirely software (e.g., a computer program product).

[0054] A person understanding this invention may now conceive of alternative structures and embodiments or variations of the above all of which are intended to fall within the scope of the invention as defined in the claims that follow.

-242018101260 29 Aug 2018

Claims (5)

1. We claim:

   1. A system for use in security testing at least one target computer system, the system comprising:

   - a command and control server for controlling and managing said system;

   - a central data storage for said system;

   - a plurality of processors, at least one of said plurality of processors executing computer readable instructions that implements a plurality of neural networks, said plurality of neural networks being organizable into hemisphere groups, each hemisphere group being tasked with at least one specific task, each of said plurality of processors being enabled to send and receive data to and from said central data storage and each of said plurality of processors being enabled for data communication with at least one other processor and with said command and control server;

   wherein

   - any data collected by processes executed by said plurality of processors regarding said at least one target computer system is stored in said central data storage.
2. 2. The system according to claim 1, wherein at least one hemisphere group is assembled for querying social media networks for data regarding potential users of said at least one target computer system.
3. 3. The system according to claim 1, wherein said system formulates potential attacks against said target computer system based on data stored in said central data storage.
4. 4. The system according to claim 3, further comprising a plurality of modules for use in executing attacks against said target computer system, said plurality of modules being selected for execution by at least one processor based on predictions formed from said at least one neural network of which potential attacks are likely to succeed against said target computer system.

   -25 2018101260 29 Aug 2018
5. 5. The system according to claim 3, wherein said potential attacks are validated to determine which of said potential attacks are likely to succeed against said target computer system, said potential attacks being validated based on data regarding said target computer system in said central data storage, and wherein when said potential attacks are invalid, said system executes a probability function that determines if said system selects a random module for use in executing a random attack against said target computer system.

   -262018101260 29 Aug 2018

   FIG. 1

   2018101260 29 Aug 2018

   FIG. 2

   2018101260 29 Aug 2018

   Attack P Email P Signatures

   2018101260 29 Aug 2018 ’d^- ώ

   2018101260 29 Aug 2018