KR20180007832A - Apparatus and Method for estimating automated network penetration path based on network reachability - Google Patents

Abstract

The present invention relates to a network technique. More specifically, the present invention relates to a device and a method for predicting a penetration path, which analyze a vulnerability of a network system for a network manager in a network environment having complex network connection and/or multiple vulnerabilities, present an attack graph by quantitative evaluation from outside or inside and present an optimal penetration path from the attack graph. The device for predicting an automated penetration path based on network reachability comprises: an information collection part collecting network information having network reachability based on a subnet structure, pre-analyzed network vulnerability information and pre-set exploit information; a quantification part quantifying the vulnerability information and the exploit information, and calculating a risk level; a vulnerability analyzing part analyzing a final vulnerability by using the network reachability and the risk level; and a graph generating part generating the attack graph by using the final vulnerability.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention [0001] The present invention relates to an automatic penetration path prediction apparatus and method based on network reachability,

The present invention relates to a network technology, and more particularly to a network technology for analyzing a vulnerability of a network system for a network administrator in a network environment having complex network connections and / or multiple vulnerabilities, And to propose a penetration path prediction apparatus and method for presenting an optimal penetration path from an attack graph.

As cyber attacks have increased in recent years, companies and organizations have been preparing various types of security systems in order to prepare for cyber attacks and to protect the information assets of companies and organizations. They are working to establish a secure network for cyber attacks such as hacking.

However, in the face of constantly evolving cyber attacks, security experts are not sure whether the enterprise / organization's network is secure and do not know all the latest vulnerabilities that are growing exponentially. We are not sure whether cyber attacks can occur through any vulnerability and / or path within / outside the company / organization.

The Attack Graph analyzes the network environment and / or vulnerability of a company / organization in order to solve this problem, and analyzes the network environment and / or vulnerability of attack / It is a technique to show. This allows the corporate / network administrator to identify which parts of the network should be prioritized to defend against cyber attacks.

Until now, the attack graph has shown the attack graph only with all the vulnerabilities and network structure of the corporation / institution itself. However, in a real environment, not all vulnerabilities have the same risk, nor is it simply a network configuration that shows real networkable attacks.

Network administrators are limiting networks that are accessible through routers and / or firewalls. Conventional techniques do not utilize such router information. Also, because it is based on all vulnerabilities, even if the network structure grows a little, the network complexity does not provide a proper attack graph and / or attack path.

1. Korean Registered Patent No. 10-1160896 (2012.06.22) (Name of the invention: Aircraft Model Identification Using a Laser Scanner and Aircraft Self Positioning System)

1. Goflynn, "Intrusion detection methodology in SCADA system environment based on self-similarity" Dissertation (doctoral) KAIST 2015 Department of Electrical and Electronic Engineering 2. Kim, JH et al., "Automated Penetration Path Prediction Method through System Vulnerability Analysis", Journal of the Korea Institute of Information Security and Technology, Vol. 22, No. 5 (Oct. 2012) pp.1079-1090 (Please briefly describe the difference from this technology ) This paper presents a penetration path prediction method for system vulnerability analysis. The difference between the paper and the presented technique is largely different from the network structure for the scoring method and the calculation formula for the vulnerability analysis and the attack graph. In this paper, we applied the score of vulnerability, the score of user operating system, and the score of user authentication procedure for penetration path prediction. However, cyber attacks are more important than exploiting user operating systems and authentication procedures, and exploiting the vulnerabilities. Therefore, the proposed technique provides a score for vulnerability analysis and an exploit scoring technique and its calculation formula. In addition, the paper follows the network structure based on the physical connection between the host (server, terminal, etc.) and the host for the penetration path prediction. However, from the attacker 's point of view, it is important to reach the network of communication packets rather than the physical connection structure of the network itself. In other words, it is important to have access to hosts (devices such as servers and terminals) via the network. Therefore, the proposed technology suggests a subnet based cyber penetration route based on network reach.

The present invention proposes an attack graph and / or an optimal attack path on the basis of network reachability capable of actual network communication and a practical risk of a vulnerability, The present invention provides an apparatus and method for predicting a penetration path that enables an administrator to manage a network in an optimum state by a cyber attack.

The present invention provides an infiltration path prediction apparatus for presenting an attack graph and / or an optimal attack path so that a network administrator can manage a network in an optimal state against a cyber attack.

The infiltration path predicting apparatus comprises:

An information collecting unit for collecting network information having a network reachability based on a subnet structure, vulnerability information of a network analyzed in advance, and exploit information set in advance (please explain);

Explanation

To exploit vulnerabilities in the system, exploit code is required. Exploit information includes related vulnerability information (CVE number), target system operating system (OS information), acquisition right after attack success, exploit utilization index, and so on.

Network administrators can obtain various exploit information from mock penetration tools and black market.

A quantification unit for quantifying the vulnerability information and the exploit information to calculate a risk level;

A vulnerability analysis unit for analyzing a final vulnerability using the network reachability and the risk level; And

And a graph generating unit for generating an attack graph using the final vulnerability.

In addition, the attack graph may be expressed using graph information, vulnerability information, and a risk level based on the subnet structure.

Also, the attack graph is represented by a plurality of edges and nodes based on the network reachability and the vulnerability information, and the plurality of nodes are nodes of an attack graph based on the vulnerability, And a connection line between the two nodes.

In addition, each of the plurality of nodes is allocated for each IP (Internet Protocol) and service port, and the service port is included in a list of threat-weak services set in advance.

In addition, the subnets to which the two nodes belong can be communicated with each other.

In addition, the connecting line may have a different risk level depending on the direction.

In addition, the penetration path prediction apparatus may further include an attack path analyzing unit that calculates an attack path based on the risk of the vulnerability on the attack graph to which the risk level is applied by using a Dijkstra algorithm, And further comprising:

(여기서, CVSS(Common Vulnerability Scoring System)는 NVD(National Vulnerability Database)에서 제시하는 취약점에 대한 위험도를 의미하고, EXP는 수집된 익스플로잇에 대한 활용성 지수이다)에 의해 산출되는 것을 특징으로 할 수 있다.Further, the risk level may be expressed by Equation

(Where Common Vulnerability Scoring System (CVSS) refers to the risk for vulnerabilities presented by the NVD (National Vulnerability Database), and EXP is the utilization index for the collected exploits) .

In order to analyze the potential attack potential in the absence of an exploit, we assign a weight to α = 1 and β = 0, or weights α = 0 and β = 1 in order to analyze the attack potential around the actual collected exploit . ≪ / RTI >

According to another embodiment of the present invention, there is provided a method of managing network information, comprising: collecting network information having network reachability based on a subnet structure, vulnerability information of a previously analyzed network, and preset exploit information; Quantifying the vulnerability information and the exploit information to calculate a risk level; Analyzing the final vulnerability using the network reachability and the risk level; And generating an attack graph using the final vulnerability by the graph generating unit. The network penetration prediction method of the present invention can provide an automatic penetration path predicting method based on network reachability.

 According to the present invention, an unprofessional network administrator can quantitatively measure vulnerable networks and improve network security according to priorities through a simulated attack graph test on a network of a corporation / institution.

FIG. 1 illustrates a network reachability graph based on a subnet based on an attack graph according to an exemplary embodiment of the present invention.
FIG. 2 shows a substantial attack graph based on vulnerability and / or subnet-based reachability according to an embodiment of the present invention.
3 is a block diagram of a configuration of an automatic penetration path prediction apparatus 300 based on network reachability according to an embodiment of the present invention.
FIG. 4 is an example of providing a criterion for defining exploitability indexes for a vulnerability level of a vulnerability according to an embodiment of the present invention.
5 is a flowchart illustrating a process of predicting an automated penetration path based on network reachability according to an embodiment of the present invention.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It is to be understood, however, that the invention is not to be limited to the specific embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

Like reference numerals are used for similar elements in describing each drawing.

The terms first, second, etc. may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another.

For example, without departing from the scope of the present invention, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component. The term "and / or" includes any combination of a plurality of related listed items or any of a plurality of related listed items.

Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the contextual meaning of the related art and are to be interpreted as either ideal or overly formal in the sense of the present application Should not.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, an apparatus and method for predicting an automated penetration path based on network reachability according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

An embodiment of the present invention generates an attack graph from a network configuration and / or a vulnerability in order to prepare for a cyber attack through a network and presents an optimal attack path from the generated attack graph. To this end, one embodiment of the present invention provides techniques such as information gathering, vulnerability metrics, vulnerability analysis, attack graph generation, attack path analysis, and the like.

Here, the information collection is to collect the base information for generating the attack graph. To generate attack graphs, we collect vulnerability information that is public and / or unlisted, and exploit information that can perform direct attacks.

Various databases can be used to collect vulnerability information. For example, the National Vulnerability Database (NVD) provided by the National Institute of Standards and Technology (NIST), the Open Source Vulnerability Database (OSVDB) provided by the open source campus, the CVE Common Vulnerabilities and Exposures, and Symantec DeepSight from Symantec.

In particular, MITER has released CVEs that disclose and systematize the vulnerabilities found. The Common Vulnerability Scoring System (CVSS) is calculated based on the CVE that has been constructed. The network administrator collects information about open and / or closed exploits. Exploit information is publicly or unofficially disclosed by various groups of security experts. For the collected exploit information, the network administrator evaluates the exploitability index of the exploit information.

This is because each exploit has its own characteristics and the impact of the attack or system is different. Figure 4 presents the criteria for evaluating the exploitability index of an exploit. The index of the exploit can be used by reassigning the score by the network administrator.

On the other hand, a network administrator who wants to check the network of a company / institution collects network information about the network of the company / institution. The collected network information provides its reachability based on the subnet structure. Reachability is an expression of whether network communication from one subnet to another is possible. Actual corporate / institutional networks limit the areas where network communication is possible through routers or firewalls. Subnet-based reachability is an important criterion for attack graphs because it is difficult for real attacks to occur if communication is not possible.

FIG. 1 illustrates a network reachability graph based on a subnet based on an attack graph according to an exemplary embodiment of the present invention. Particularly, FIG. 1 shows a network map based on reachability of a subnet structure.

Referring to FIG. 1, each square in the subnet graph represents the first to seventh subnets 110 to 170 constituting the network, and the connection line 101 connecting the squares represents connection of the subnet. Here, the connection of the subnet means that the network packet can be reached from the corresponding subnet to another subnet.

For example, in subnet A.A.A./24 (110), B.B.B.B / 24 120 means that a packet sent from A.A.A./24 (110) can reach B.B.B.B / 24 120. However, A.A.A./24 (110) can not directly send a packet to F.F.F.F / 24 (160). To send a packet to F.F.F.F / 24 (160), the host (terminal or server) in B.B.B.B / 24 (120) must be connected. The nodes and edges for a graphical representation of subnet-based network reachability are as follows.

G (V_sub, E_sub)

              V_sub = {list of subnets}

                     E_sub = {< u, v > | u, v? V_sub}

Here, the V-sub is a list of subnets in the graph indicating network reachability based on the subnet.

E_sub is a list of connections for each node in the subnet graph. The fact that the two nodes are connected means that the subnets are networked to each other.

The network manager provides information on the host (terminal or server) that provides service in each subnet. The host information provided by the network administrator is as follows.

List of <subnet_id, IP, OS, service information (Port, etc.)>

Here, subnet_id is an ID assigned to the subnet constituting the network map. The subnet's network ID (such as x.x.x.x / 24 or x.x.x.x / 25) can be given as the subnet id.

IP is the IP information assigned to the hosts on each subnet.

OS is OS information installed in each host. OS information may include OS version, service pack version, kernel version, and the like.

The service information list is a list of services provided by each host on the network. The list includes information such as service name, version, port, and the like.

Vulnerability metrics are a part of scoring for vulnerable services. To analyze the final attack path, you must quantify the risk for vulnerabilities found in the network. In an embodiment of the present invention, a risk level (RL) is proposed for risk quantification. To calculate the risk level, this technique uses CVSS and EXP values. The risk level is as follows.

Here, the Common Vulnerability Scoring System (CVSS) represents the risk to the vulnerability presented by the National Vulnerability Database (NVD).

EXP is the utilization index for the collected exploits.

In one embodiment of the present invention, the final risk level is calculated by weighting these two items. The network administrator can adjust the risk level by changing the weights to fit the intent to analyze. For example, if there is no exploit collected, or if we analyze the potential attack potential, we can calculate the risk that depends only on CVSS by weighting α = 1 and β = 0. In order to analyze the possibility of attacks based on actual collected exploits, it is possible to analyze the actual attackable risk by weighting α = 0 and β = 1.

The vulnerability analysis extracts vulnerabilities that can be attacked on terminals or servers that provide services on the network based on previously calculated risk level. In a real network attack, there are many services, but attacks with low network access or low risk are less likely to succeed. Therefore, the network administrator can classify vulnerabilities based on services with high risk level among actual services.

The attack graph generation is a part to generate an attack graph based on the classified vulnerabilities.

FIG. 2 shows a substantial attack graph based on vulnerability and / or subnet-based reachability according to an embodiment of the present invention. Particularly, FIG. 2 shows an example of an attack graph. In the attack graph, the nodes 211, 212, and 213 are configured for each of the terminals (including the server) and their service ports in the subnet. That is, when two or more ports are opened in one terminal, each terminal is marked as a separate node. A connection line connecting a node in an attack graph indicates that an attack is possible through the corresponding port. Each connection line is given a risk weight for the vulnerability. A double-headed arrow for that line indicates that an attack is possible. The weight given to each connection line is given differently depending on the direction of the connection line.

That is, in the connection line from <10.10.10.10, 21, 7.0> node to <10.10.11.10, 445, 8.0> node, the weight value is 8.0 and the value of 8.0 assigned to <10.10.11.10, 445, Weight. On the contrary, in the connection line from the <10.10.11.10, 445, 8.0> node to the <10.10.10.10, 21, 7.0> node, the value of 7.0 assigned to the <10.10.10.10, 21, Respectively. Expressions for the nodes 211, 212 and 213 and the edge 220 for drawing the attack graph G (V, E) are as follows.

G (V, E)

         V = {<subid, IP, Port, RL> | <IP, Port> ∈ Threat vulnerable service list}

         E = {< u, v > | u, v ∈ V, and <u_subid, v_subid> ∈ E_sub}

Here, V is a set of nodes of the attack graph based on the vulnerability. Each node is assigned by IP and service port, and the corresponding service port may be included in the list of vulnerable services.

E represents the edges in the vulnerability-based attack graph. In order for an edge to be formed between two nodes, two nodes must be included in the node set V and the subnets of the two nodes must be in a position where they can communicate with each other. That is, the subnet to which each node belongs should be a graph connected to each other by the connection line 101.

Attack path analysis is the part that finds the optimal path that can be attacked based on the risk of the vulnerability on the attack graph. The network administrator enters the attack start terminal and the final target terminal on the attack graph and starts attack analysis. The starting terminal and the target terminal are inputted based on the IP of the terminal, not the service.

In one embodiment of the present invention, a Dijkstra algorithm can be used to find the optimal attack path. The Dijkstra algorithm is an algorithm that finds the shortest path between two points on a weighted graph. The weights on the general graph are given one weight on the edge. However, the proposed attack graph is given different weights (risk level) according to the direction of the graph. In addition, the nodes in the graph are given nodes according to the service (port), and even if they are actually the same terminal, they are assumed to be different for each service. Therefore, access to the same terminal is restricted to obtain a substantial attack path.

3 is a block diagram of a configuration of an automatic penetration path prediction apparatus 300 based on network reachability according to an embodiment of the present invention. 3, the penetration path prediction apparatus 300 includes an information collecting unit 310 for collecting information, a database 320 for storing collected information, and a database 320 for calculating a risk level A vulnerability analysis unit 340 for analyzing the final vulnerability using the risk level, a graph generating unit 350 for generating an attack graph using the final vulnerability, And an attack path analyzing unit 360 for analyzing the attack path.

The information collecting unit 310 collects network information having network reachability based on the subnet structure, vulnerability information of the network analyzed in advance, and exploit information that is set in advance.

The database 320 stores network information, vulnerability information of a previously analyzed network, and exploit information that is set in advance.

The quantification unit 330 quantifies the vulnerability information and the exploit information to calculate a risk level.

The vulnerability analysis unit 340 may analyze the final vulnerability using the network reachability and the risk level.

The graph generating unit 350 generates an attack graph using the final vulnerability.

The attack path analyzing unit 360 performs a function of finding an attack path according to the input of the attack start terminal and the final target terminal based on the risk of the vulnerability on the attack graph to which the weight is applied by using the Dijkstra algorithm.

FIG. 4 is an example of providing a criterion for defining exploitability indexes for a vulnerability level of a vulnerability according to an embodiment of the present invention. Referring to FIG. 4, FIG. 4 presents a criterion for evaluating the exploitability index of an exploit. The index of the exploit can be used by reassigning the score by the network administrator.

5 is a flowchart illustrating a process of predicting an automated penetration path based on network reachability according to an embodiment of the present invention. 5, the information collecting unit 310 collects and classifies network information having network reachability based on a subnet structure, vulnerability information of a network analyzed in advance, and preset exploit information, (Steps S510 and S520).

The quantification unit 330 quantifies the vulnerability information and the exploit information to calculate a risk level, and the vulnerability analysis unit 340 analyzes the final vulnerability using the network reachability and the risk level (steps S530 and S540) .

Thereafter, the graph generating unit 350 generates an attack graph using the final vulnerability (step S550).

Thereafter, the attack path analyzer 360 performs a function of finding an attack path according to the input of the attack start terminal and the final target terminal based on the risk of the vulnerability on the attack graph to which the weight is applied by using the Dijkstra algorithm do.

110 to 170: first to seventh subnets
300: Penetrating path prediction device
310: Information collecting unit
320: Database
330: Quantification part
340: Vulnerability Analysis Department
350:
360: attack path analysis unit

Claims (10)

An information collecting unit for collecting network information having network reachability based on a subnet structure, vulnerability information of a network analyzed in advance, and exploited information to be set in advance;
A quantification unit for quantifying the vulnerability information and the exploit information to calculate a risk level;
A vulnerability analysis unit for analyzing a final vulnerability using the network reachability and the risk level; And
A graph generating unit for generating an attack graph using the final vulnerability;
Based on the network reachability of the network.
The method according to claim 1,
Wherein the attack graph is expressed using graph information, vulnerability information, and a risk level based on the subnet structure.
3. The method of claim 2,
Wherein the attack graph is represented by a plurality of edges and nodes based on the network reachability and the vulnerability information, the plurality of nodes are nodes of an attack graph based on a vulnerability, and the plurality of edges are nodes of two nodes Wherein the network is formed as a connection line between the network and the network.
The method of claim 3,
Wherein each of the plurality of nodes is assigned an IP (Internet Protocol) and a service port, and the service port is included in a list of pre-established threat vulnerable services.
The method of claim 3,
Wherein the subnets to which the two nodes belong are in a position where they can communicate with each other.
The method of claim 3,
Wherein the connection line has a different risk level depending on the direction.
The method according to claim 6,
And an attack path analyzer for finding an attack path according to the input of the attack start terminal and the final target terminal based on the risk of the vulnerability on the attack graph to which the risk level is applied using the Dijkstra algorithm. An automated penetration path prediction device based on network reachability.
The method according to claim 1,
The risk level is calculated using Equation

Wherein the Common Vulnerability Scoring System (CVSS) refers to a risk for a vulnerability presented by NVD (National Vulnerability Database), and EXP is a utilization index for collected exploits. Potential based automated penetration path prediction device.
9. The method of claim 8,
If there is no exploit or to analyze the potential attack potential, we assign a weight to α = 0 and β = 1 to give a weight to α = 1 and β = 0 or to analyze the possibility of attacks based on actual collected exploits. Based on the network reachability.
Collecting network information having a network reachability based on a subnet structure, vulnerability information of a network analyzed in advance, and exploited information to be set in advance;
Quantifying the vulnerability information and the exploit information to calculate a risk level;
Analyzing the final vulnerability using the network reachability and the risk level; And
Generating an attack graph using the final vulnerability;
The method comprising the steps of: (a) determining a penetration path of a network;

Images