Extending Attack Graphs to Represent Cyber-Attacks in Communication Protocols and Modern IT Networks

Orly Stan, Ron Bitton, Michal Ezrets, Moran Dadon, Masaki Inokuchi, Ohta Yoshinobu, Yagyu Tomohiko, Yuval Elovici, Asaf Shabtai

Research output: Contribution to journalArticlepeer-review

2 Scopus citations

Abstract

An attack graph is a method used to enumerate the possible paths that an attacker can take in the organizational network. MulVAL is a known open-source framework used to automatically generate attack graphs. MulVAL's default modeling has two main shortcomings. First, it lacks the ability to represent network protocol vulnerabilities, and thus it cannot be used to model common network attacks, such as ARP poisoning. Second, it does not support advanced types of communication, such as wireless and bus communication, and thus it cannot be used to model cyber-attacks on networks that include IoT devices or industrial components. In this paper, we present an extended network security model for MulVAL that: (1) considers the physical network topology, (2) supports short-range communication protocols, (3) models vulnerabilities in the design of network protocols, and (4) models specific industrial communication architectures. Using the proposed extensions, we were able to model multiple attack techniques including: spoofing, man-in-the-middle, and denial of service attacks, as well as attacks on advanced types of communication. We demonstrate the proposed model in a testbed which implements a simplified network architecture comprised of both IT and industrial components

Original languageEnglish
JournalIEEE Transactions on Dependable and Secure Computing
DOIs
StatePublished - 1 Jan 2020

Keywords

  • Attack Graph
  • Computer architecture
  • Databases
  • MulVAL
  • Network Attacks
  • Network Protocols
  • Protocols
  • Risk management
  • Security
  • Software
  • Tools

Fingerprint

Dive into the research topics of 'Extending Attack Graphs to Represent Cyber-Attacks in Communication Protocols and Modern IT Networks'. Together they form a unique fingerprint.

Cite this