FR3131044A1 - Method for detecting an attack by a threat in an operating system - Google Patents

Abstract

Method for detecting an attack by a threat in an operating system The invention relates to a method for detecting an attack by a threat in an operating system (10). The method includes the following steps, prior to the operation of the system (10): simulating a set of possible attack sequences of the threat;processing the set of attack sequences to obtain a set semantic graphs representative of the set of attack sequences; The method comprises the following steps, during operation of the system (10): measurement of the presence of a suspicious element present in the system (10) in operation by a presence sensor (30); comparison of the measurements with the set of semantic graphs and determination of a level of correlation of the measurements with each of the semantic graphs; issuance of an alert when at least one of the determined correlation levels is greater than a predetermined alert threshold. Figure for the abstract: Figure 2

Description

Method for detecting an attack by a threat in an operating system

The present invention relates to a method for detecting an attack by a threat in an operating system.

The invention also relates to a computer program product configured for the implementation of such a detection method.

The threat is, for example, an intrusion into a protected geographical area, abnormal behavior of a boat, in particular piracy, or of an aircraft in a sensitive area or even a computer attack against a server.

Conventional surveillance systems are typically composed of a set of sensors distributed over an area to be monitored and a description of the coverage of these sensors. Monitoring is based on predetermined rules or learning.

In particular, a statistical approach is known, in which an alert is raised if the current situation differs sufficiently from the usual situation. However, the characterization of the usual situation presupposes having a prior recording of this situation, which is not necessarily the case. This is particularly the case in situations where few observations and history are available, such as in the case of maritime piracy. Moreover, in a situation where the attacker specifically aims to fool surveillance systems, he will try as much as possible to avoid having unusual behavior, and thus this statistical approach will only work for threats with a strategy level limit.

An explicitly defined approach is also known, such as a so-called expert system, in which the alert is triggered from a predefined model, described by experts in the field. Again, the availability of such an expert is not guaranteed in all cases. Furthermore, the flexibility of such an approach is problematic. It is often necessary to use many heuristics, which can be difficult to design correctly and usually lead to false positives and false negatives. Such an approach also raises the issue of system reconfiguration in dynamic situations, where the threat context or behaviors change over time.

Thus, the present invention aims in particular to propose a method for detecting an attack making it possible to automatically trigger relevant alerts, in the absence of a history of threats encountered and of an expert to explicitly design the alert system.

To this end, the subject of the invention is a method for detecting an attack by a threat in a system in operation, the detection method comprising at least the following steps, upstream of the operation of the system:

• simulation of a set of possible attack sequences of the threat in the system;
• processing the set of attack sequences in order to obtain a set of semantic graphs representative of the set of attack sequences;

the detection method comprising at least the following steps, during the operation of the system:

• measurement of the presence of a suspicious element present in the operating system by at least one presence sensor;
• comparison of the measurement(s) with the set of semantic graphs and determination of a level of correlation of the measurement(s) with each of the semantic graphs;
• issuance of an alert when at least one of the determined correlation levels is above a predetermined alert threshold.

The invention therefore allows, after a prior configuration to define the context of the system and possible attacks (sensitive areas, network topology, detection areas, probabilities of detection, etc.), fully automated execution during the operation of the system. No expert involvement is required, reducing potential bias and providing the operator with an objective view. Finally, it is not necessary to have prior histories and recordings of the threats, which makes the invention particularly effective against threats not yet observed or rare events.

According to other advantageous aspects of the invention, the detection method comprises one or more of the following characteristics, taken in isolation or according to all the technically possible combinations: the system is a geographical area, each semantic graph being representative of a chosen event in the group consisting of: entry of the threat into a geographic area of interest; followed by the threat of a trajectory of interest; repeated passage of the threat through a point or geographical area of interest; passage of the threat through different consecutive points or geographical areas of interest; speed of the threat included in an interval of interest, and discrepancy between characteristics of the geographic area of interest, such as the type of geographic area of interest or the maximum speed authorized in the geographic area of interest, and threat characteristics, such as threat size, threat typology, threat velocity, or threat acceleration;

• at least one presence sensor is a fixed sensor and at least one presence sensor is a mobile sensor;
• the system is a computer network, each semantic graph being representative of an event chosen from the group consisting of: access to a computer machine of interest; access to a sub-part of interest of the network; use of a communication of interest protocol; use of a computer port of interest; transmission of packets of a computing size of interest, and use of a range of network addresses of interest;
• the simulation is carried out using a trajectory optimization algorithm in the system;
• the set of sequences and the set of semantic graphs occupy a respective size on a memory, the processing step comprising the application of an operation allowing the size of the set of semantic graphs to be less than the size of the set of sequences;
• the alert sent includes at least one item of information relating to the associated semantic graph;
• the method further comprises a step of splitting the system into a plurality of subsystems before the processing step, the processing step further comprising a splitting of each simulated attack trajectory as a function of the various subsystems traversed ;
• the method comprises, during the operation of the system, a new iteration of the simulation and processing steps in order to obtain a new set of updated semantic graphs.

The invention also relates to a computer program comprising a readable information medium, on which is stored a computer program comprising program instructions, the computer program being loadable on a data processing unit and adapted to bring about the implementation of a detection method as defined above when the computer program is implemented on the data processing unit.

These characteristics and advantages of the invention will appear more clearly on reading the following description, given solely by way of non-limiting example, and made with reference to the appended drawings, in which:

- there is a schematic representation of a sensing device monitoring a system;

- there is a representation of the system consisting of a geographical area; And

- there is a flowchart of a method, according to the invention, for detecting an attack by a threat in the operating system.

A system 10 to be monitored is represented on the .

The system 10 is in particular a geographical area, as illustrated in the .

The geographical area is, for example, a protected land geographical area such as an industrial building, a protected aerial geographical area such as airspace above a large city or even a protected maritime geographical area such as an industrial port. . In these cases, access to this area is only authorized for certain individuals or vehicles and it is important to detect any unauthorized intrusion.

Alternatively, the geographic area is a free-access area in which it is necessary to detect suspicious behavior such as a pirate ship in the ocean or a risk of terrorist attack in public space.

In another variant, not shown, the system 10 is a computer network comprising a plurality of computer equipment interconnected and which can be the subject of a computer attack that it is necessary to detect.

The system 10 is monitored by a detection device 12 which is described below.

The detection device 12 is thus configured to detect an attack by a threat when the system 10 is in operation.

By operation of the system 10 is meant the fact that the system 10 is in operation and/or traversed by elements. The system 10 is in particular in operation as a factory or computer network, or is likely to be crossed by vehicles while presenting a strategic interest such as an airspace to be protected.

The threat is an element such as an individual, a vehicle or a computer virus aiming to enter the system 10 in order to recover critical information or to attack the security of this system 10.

The detection device 12 is placed in the system 10 to be monitored, for example in the control center of a nuclear power station or in the computer network.

Alternatively, as shown in , the detection device 12 is remote from the system 10 to be monitored, for example in a land station for monitoring a maritime zone.

As seen on the , the detection device 12 comprises a simulation module 14, a processing module 16, a reception module 18, a comparison module 20 and a transmission module 22.

The simulation module 14 is configured to simulate, prior to the operation of the system 10, a set of possible attack sequences of the threat in the system 10.

“Upstream” means that the simulations are carried out before the detection device 12 monitors the system 10 in operation.

The simulation is performed using a path optimization algorithm in System 10.

The possible threatening attacks are simulated in order to obtain a plurality of attack plans each composed of a possible attack sequence in the system 10.

In particular, the threats are simulated by a planning optimizer which calculates attack plans on the system 10. A large set of simulations, involving different threat hypotheses, provides a consequent set of attack plans.

The system 10 is represented by a model defining the various constraints, sensitive zones, sensors present, etc. The simulation module 14 is configured to explore the possible sequences in this model point by point according to the various constraints and by simulating that the threat moves in the system 10 with a given objective while trying to avoid detection and being effective in traversing the system 10.

The set of simulated attack sequences makes it possible to obtain a basic data set to describe the possible threats that can attack the system 10.

The simulation module 14 is further configured to restart all the simulations when the system 10 evolves and therefore when the associated model is modified.

The processing module 16 is advantageously configured to divide the system 10 and in particular the model associated with the system 10 into a plurality of subsystems.

In particular, each subsystem is a geographical sub-zone of the system 10 or a subset of computer equipment.

The system 10 is in particular divided into subsystems each having its own particularity. For example, a maritime zone is divided into a fishing zone, a port zone, a prohibited access zone, etc.

As a variant, the system 10 is divided in a uniform manner, for example via a grid of the geographical area.

The processing module 16 is further configured to process, upstream of the operation of the system 10, the set of attack sequences in order to obtain a set of semantic graphs representative of the set of attack sequences.

The processing advantageously comprises a breakdown of each simulated attack trajectory according to the various subsystems traversed.

In particular, all the sequences are processed and semantized in order to obtain a representative description of the attack plans, using a given ontology.

The ontology is a description of the different elements that appear in the system 10.

Semantic graphs are a simpler representation of threats, with the advantage of being discreet and understandable in terms of concepts, areas, speeds, etc. for an operator in charge of monitoring the system 10.

The processing module 16 therefore makes it possible to pass from a set of sequences to a set of semantic graphs, which is a sum of events and concepts understandable to the operator.

The processing module 16 is advantageously configured to merge the semantic graphs, so as to obtain a description of the most common elements which characterize the threats, that is to say the elements that the detection device 12 must try to identify. to detect a threat.

Fusion makes it possible to obtain the common and/or the most threatening parts in the semantic graphs. Each merged graph forms an attack pattern.

It will therefore be understood that the processing of the sequences makes it possible to obtain a set of semantic graphs forming a simpler summary for the operator. Thus, the set of sequences and the set of semantic graphs occupy a respective size on a memory. The processing thus includes the application of an operation allowing the size of the set of semantic graphs to be less than the size of the set of sequences.

The semantic graphs thus obtained form the reference which makes it possible to raise alerts subsequently, during the operation of the system 10.

In particular, when the system 10 is a geographical area, an attack sequence is an attack trajectory of a threat.

Each semantic graph is then representative of an event chosen from the group consisting of:

• entry of the threat into a geographic area of interest;
• followed by the threat of a trajectory of interest;
• repeated passage of the threat through a point or geographical area of interest;
• passage of the threat through different consecutive points or geographical areas of interest;
• velocity of the threat within an interval of interest, and
• discrepancy between characteristics of the geographic area of interest, such as the type of geographic area of interest or the maximum speed authorized in the geographic area of interest, and characteristics of the threat, such as the size of the threat, threat typology, threat velocity, or threat acceleration.

An element of "interest" means that this element is a sensitive element from the point of view of security or is of strategic interest.

There illustrates in particular two types of semantic graphs in a geographical area. In particular, the shows circles 24 associated with the passage of the threat through these points of interest and striped lines 26 associated with a sequence of points followed by the threat and thus following a sequence of interest.

When the system is a computer network, each semantic graph being representative of an event chosen from the group consisting of:

• access to a computer machine of interest;
• access to a sub-part of interest of the network;
• use of a communication of interest protocol;
• use of a computer port of interest;
• transmission of packets of a computational size of interest, and
• use of a range of network addresses of interest.

The reception module 18 is configured, during the operation of the system 10, to receive the measurements of at least one presence sensor 30 arranged in the system 10.

Each sensor 30 is configured to detect the presence of a suspicious element. In particular, the sensor 30 is configured to measure the position of a suspicious element present in the system 10 in operation and/or to measure the characteristics of a suspicious element, for example its size or its type.

When the system 10 is a geographical area, each sensor 30 is for example a motion detector, a radar sensor, a video surveillance system, etc.

Advantageously, the system 10 comprises at least one fixed sensor 30 and at least one mobile sensor 30.

Each fixed sensor 30 is capable of detecting a suspect element in a fixed zone.

Fixed sensors are likely to be known to threats and will be avoided by them.

Conversely, the mobile sensor 30 is capable of moving in the system 10 and is therefore capable of detecting a suspicious element in different zones of the system 10. The mobile sensor 30 is for example embedded in a drone.

The movements of mobile sensors are less likely to be known to threats and therefore allow detection of certain behaviors that avoid fixed sensors.

When the system 10 is a computer network, each sensor 30 is for example a counting hardware block configured to measure the number of accesses to a computer equipment, the number of interactions on the network of an equipment, the quantity of data transiting to equipment etc.

The comparison module 20 is configured to compare the measurements of the sensors 30 with the set of semantic graphs.

For example, when one of the semantic graphs corresponds to a presence zone of interest, the comparison module 20 compares the measured positions of the suspect element with respect to this zone.

When one of the semantic graphs corresponds to a trajectory, the comparison module 20 compares the succession of measured positions of the suspect element with respect to this trajectory.

Advantageously, the processing module 16 is configured to apply to the measurements the same processing as to the simulations carried out. Thus, the measures are first processed by the same semantization process before being compared to the semantic graphs. Thus, the detection of threats is then expressed in the same formalism as the attack models.

The comparison module 20 is further configured to determine a level of correlation of the measurement(s) with each of the semantic graphs.

The level of correlation is representative of the proximity between the measurements and the semantic graphs. The higher the level of correlation, the more exactly the measures correspond to the semantic graphs.

Advantageously, the comparison module 20 is configured to perform the comparison in real time to allow efficient and reactive monitoring. This is in particular possible due to the semantization of the sequences which provide semantic graphs of reduced size.

The transmission module 22 is configured to transmit an alert when at least one of the determined correlation levels is greater than a predetermined alert threshold.

Thus, the measurements are matched with the semantic graphs representative of the attack models, in order to issue alerts if the measurements correspond to a sub-part of an attack model.

The alert threshold is determined upstream of the operation of the system 10 during the performance of the simulations, in particular by an expert in the field.

The alert threshold is for example a function of the criticality of the subsystems associated with the semantic graph.

Thus, it is possible to exploit the operational knowledge of experts which makes it possible to complete the simulated attack plans automatically without the intervention of an expert.

The alert sent includes at least one piece of information relating to the associated semantic graph. Thus, the alert provides the operator in charge of monitoring the system 10 with information relating to the detected threat allowing him to easily understand the situation and react accordingly.

In the example of the , the detection device 12 comprises an information processing unit formed for example of a memory and of a processor associated with the memory. The various modules are each produced in the form of software, or a software brick, executable by the processor and stored in the memory. The processor is then capable of executing each of these software programs.

In a variant not shown, the different modules are each made in the form of a programmable logic component, such as an FPGA (Field Programmable Gate Array), or even in the form of a dedicated integrated circuit, such as an ASIC (Application Specific Integrated Circuit).

When the detection device 12 is made in the form of one or more software, that is to say in the form of a computer program, it is also capable of being recorded on a medium, not shown, readable by computer. The computer-readable medium is, for example, a medium capable of storing electronic instructions and of being coupled to a bus of a computer system. By way of example, the readable medium is an optical disc, a magneto-optical disc, a ROM memory, a RAM memory, any type of non-volatile memory (for example EPROM, EEPROM, FLASH, NVRAM), a magnetic card or an optical card. On the readable medium is then stored a computer program comprising software instructions.

The operation of the detection device 12 according to the invention will now be explained using the representing a flowchart of the method, according to the invention, of detecting an attack by a threat in the system 10 in operation.

Subsequently, an example of implementation of the method will be described in a system 10 formed of a geographical area but those skilled in the art will understand that this method applies more generally to any system 10, in particular to a computer system .

There represents a system 10 here consisting of a sensitive geographical area, such as for example an airport, a nuclear power plant, etc.

A plurality of sensors 30 are arranged in the system 10. A part of these sensors 30 is fixed and a part of these sensors 30 is mobile.

There shows fixed presence sensors 30 represented by triangles and which are likely to be known to the threat.

There also shows mobile presence sensors 30, represented by squares, as well as their movement in dotted lines. These movements are not known by the threat.

In the example shown, threats move from an entry boundary to an exit boundary and may encounter impassable terrain and traverse terrain where they are undetected.

The surveillance device 12 thus aims to detect these intrusions which can be carried out via several vehicles, for example land or air, and which attempt to reach, for example here, the northwestern limit of the system 10 which represents a sensitive subsystem .

Initially, prior to exploiting system 10, the detection process includes simulating 100 a set of possible attack sequences of the threat in system 10.

This simulation is possibly carried out away from the system 10.

These simulated sequences are represented by the arrowed lines 32 on the .

Then, the method comprises a step 110 of processing the set of attack sequences in order to obtain a set of semantic graphs representative of the set of attack sequences.

In particular, the sequences are semantized and merged in order to obtain semantic graphs easily understandable by an operator.

Here, the semantic graphs are represented by the circles 24 associated with a presence in these areas and linked by a sequence relationship represented by the striped lines 26.

Then, the system 10 is monitored during its operation. For example, the airport is monitored while aircraft flights are operating or the nuclear power plant is monitored during operation.

The detection method then comprising the measurement 120 of the presence of a suspicious element present in the system 10 in operation by the various sensors 30.

Then during a step 130, these measurements are compared with the set of semantic graphs in order to determine a level of correlation of the measurements with each of the semantic graphs.

When a match is found, that is to say when at least one of the determined correlation levels is greater than a predetermined alert threshold, an alert is issued during a step 140.

This monitoring is carried out in real time. By real time, it is meant that the lag between the measurement of the position and the lifting of the alerts is carried out in a very short time, typically less than one minute.

During the operation of the system 10, when the system 10 evolves and/or is modified, a new iteration of the simulation and processing steps is carried out in order to obtain a new set of updated semantic graphs.

For example, in the example of the , if sensors 30 are added or a passage is condemned, the possible attack sequences are recalculated in order to maintain effective and relevant monitoring.

Such a reconfiguration therefore allows an adaptability of the monitoring system which is not possible in a conventional system designed by experts who are not necessarily available at each modification of the system 10.

Those skilled in the art will understand that the invention is advantageously coupled with conventional warning systems based on historical learning or expert systems in a complementary manner. Depending on the constraints and the availability of data and personnel, one or more of the approaches can be used and/or combined, further enhancing the operator's confidence in the monitoring device.

It is therefore understood that the present invention has a certain number of advantages.

The prior art only considers a learning approach on raw sensor data, explicit rules, etc.

Conversely, the present invention makes it possible to compensate for the lack of real data by using an optimized simulation and the fusion of semantic graphs to trigger alerts.

The invention is based on the synergy of the three stages of simulation, semantics and comparison.

The invention enables fully automated execution during operation of the system 10 after prior configuration.

No experts are needed in the design of the monitoring system, reducing potential biases or reinforcing their prior beliefs. However, the operational knowledge of experts can be used to optimize the monitoring system, particularly in the definition of alert thresholds and the categorization of semantic graphs.

Additionally, there is no need for prior threat records, making the invention particularly effective for previously unobserved threats or low-signal events.

Claims (10)

Method for detecting an attack by a threat in a system (10) in operation,
the detection method comprising at least the following steps, upstream of the operation of the system (10):

• simulating (100) a set of possible attack sequences of the threat in the system (10);
• processing (110) the set of attack sequences to obtain a set of semantic graphs representative of the set of attack sequences;

the detection method comprising at least the following steps, during the operation of the system (10):

• measurement (120) of the presence of a suspect element present in the system (10) in operation by at least one presence sensor (30);
• comparing (130) the measurement(s) with the set of semantic graphs and determining a level of correlation of the measurement(s) with each of the semantic graphs;
• transmission (140) of an alert when at least one of the determined correlation levels is greater than a predetermined alert threshold.

Detection method according to claim 1, in which the system (10) is a geographical area,
each semantic graph being representative of an event chosen from the group consisting of:

• entry of the threat into a geographic area of interest;
• followed by the threat of a trajectory of interest;
• repeated passage of the threat through a point or geographical area of interest;
• passage of the threat through different consecutive points or geographical areas of interest;
• Threat velocity within an interval of interest, and
• discrepancy between characteristics of the geographic area of interest, such as the type of geographic area of interest or the maximum speed authorized in the geographic area of interest, and characteristics of the threat, such as the size of the threat, threat typology, threat velocity, or threat acceleration.

Detection method according to claim 2, in which at least one presence sensor (30) is a fixed sensor and at least one presence sensor (30) is a mobile sensor. A detection method according to claim 1, wherein the system (10) is a computer network,
each semantic graph being representative of an event chosen from the group consisting of:

• access to a computer machine of interest;
• access to a sub-part of interest of the network;
• use of a communication protocol of interest;
• use of a computer port of interest;
• transmission of packets of a computational size of interest, and
• use of a range of network addresses of interest.

A detection method according to any preceding claim, wherein the simulation (100) is performed by means of a path optimization algorithm in the system (10). Detection method according to any one of the preceding claims, in which the set of sequences and the set of semantic graphs occupy a respective size on a memory, the processing step (110) comprising the application of an operation allowing the size of the set of semantic graphs to be smaller than the size of the set of sequences. Detection method according to any one of the preceding claims, in which the alert sent includes at least one item of information relating to the associated semantic graph. Detection method according to any one of the preceding claims, further comprising a step of dividing the system (10) into a plurality of subsystems before the processing step (110), the processing step (110) comprising in addition, a breakdown of each simulated attack trajectory according to the various subsystems traversed. Detection method according to any one of the preceding claims, in which the method comprises, during the operation of the system (10), a new iteration of the steps of simulation (100) and processing (110) in order to obtain a new updated set of semantic graphs. Computer program product comprising a readable information medium, on which is stored a computer program comprising program instructions, the computer program being loadable on a data processing unit and adapted to cause the implementation a detection method according to any one of claims 1 to 9 when the computer program is implemented on the data processing unit.