適應於多量弱點資訊之智慧型攻擊圖形產生器

Intelligent Attack Graph Generator Adapting to Large Vulnerability Information

林崇頤(Chung-Yin Lin)

指導教授 ： 田筱榮

中原大學/工學院/資訊工程研究所/碩士(2003年)

https://doi.org/10.6840/cycu200300124

摘要

弱點分析重要於確保一個網路環境的安全。假如網路環境中存在著由某些服務所導引之攻擊路徑，則表示這些具有弱點之服務是易受攻擊的。目前研究上，已經有許多以圖形理論為基礎的工具提出發現這些可能被攻擊者利用來達成目標之攻擊路徑的方法。雖然這些可找出所有可能攻擊路徑之自動化工具都為可用的，但是在電腦化模型檢查程序以前，他們仍需以手動方式來將知識努力並熟練的描述成攻擊樣板。另外，由於每一年發現的弱點的數量以指數增加，加上網路中的架構變化發生得更多和更為經常，以及個體系統安裝的軟體常常變化，所以理想的攻擊圖形產生系統為盡量減少手動建立。在本文中，將提出智慧型攻擊圖形產生器。在此攻擊圖形產生器中，弱點資訊為由收集官方來源資料而取得。而系統設定與軟體安裝資訊則透過報告機制被採集，而此二者都是自動程式。最後結果資訊將構成關於環境的原始事實。然後藉由再一套從專家知識所衍生之規則，來取得攻擊樣板。最後透過此推論規則以分析原始事實所產生之攻擊樣板來將可能的攻擊路徑在一個完全自動化的過程中找出。此智慧型攻擊圖形產生器已被實作成系統，並且以實驗證實其提出架構之正確性。

關鍵字

網路安全稽核 ； 智慧型 ； 攻擊圖形產生器 ； 弱點分析

並列摘要

Vulnerability analysis is important to ensure the security of a network environment. Critical services in a network environment with vulnerabilities are vulnerable if there are attack paths leading to the services. Many tools based on graph theory have been proposed to discover the possible attack paths through which an attacker may exploit to reach his final goal. Although automated tools to find all possible attack paths are available, they require manual effort and expert knowledge to describe the one-step attack templates before computerized model checking procedure can be performed. As the amount of vulnerabilities discovered doubles exponentially every year, the configuration change in network occurs more and more often, and the softwares installed to individual system varies from time to time, an attack graph generation system which demands little manual effort and expert knowledge is desirable. In this thesis, an intelligent attack graph generator is proposed. In this attack graph generator, vulnerability information is derived from data collected from authoritative sources. The configuration and the software installation information are gathered through a reporting mechanism. Both are automatic procedures. The resulted information constitutes the primitive facts about the environment. A set of rules is derived to model the expert knowledge central to the derivation of the one-step attack templates. By utilizing the influence rules to analyze the primitive facts, the one-step attack templates can be generated and the possible attack paths can be explored in a fully automated process. The intelligent attack graph generator has been implemented, and experiments have been conducted to verify the correctness of the proposed scheme.

並列關鍵字

intelligent ； attack graph generator ； network security audit ； exploit ； Vulnerability analyze

參考文獻

[17] 陳宗裕，支援弱點稽核與入侵偵測之整合性後端資料庫設計研究，中原大學研究所，碩士論文，中華民國九十年七月。

[1] K. Micki and T.F. Harold, Information security management handbook, vol. 2, Boca Raton, 1999.

[3] R. Ritchey and P. Ammann, “Using Model Checking to Analyze Network Vulnerability,” Proceeding of IEEE Symposium on Security and Privacy, pp. 156-165, May 2000.

[5] R. Sekar, C.R. Ramakrishnan, I.V. Ramakrishnan, and S. Smolka,“Model-Based Analysis of Configuration Vulnerability,” New Security Paradigms Workshop, 2000.

[6] C.R Ramakrishnan and R. Sekar, “Model-Based Analysis of Configuration Vulnerabilities,” Journal of Computer Security, vol. 10, num 1/2, pp. 189-209, 2002.