Personalized Vulnerability Analysis through Automated Planning

Attack trees and attack graphs are a well-known representation for computer security vulnerabilities. They capture how malicious activity can result in compromised systems. Unfortunately, attack graphs scale poorly, are targeted primarily to capture key components of vulnerabilities inindustrial settings and focus on attacker actions. We extend the attack graph formalism by integrating user actions and supporting personalization that restricts the focus to those vulnerabilities present in a particular user/system combination (i.e., considering specific computer configuration and a user’s normal activities). The enhanced attack graph is captured in the Planner Domain Definition Language (PDDL) with user specific attributes being included as facts. Given the PDDL representation, we can use a planner to 1) prune the attack graph to only those vulnerabilities for which we can derive a plan, 2) perform what-if analyses of user actions and 3) help identify interventions that are most likely to reduce the system’s susceptibility to attacks. Personalizing Security Computer security models usually focus on identifying and preventing network breaches from malicious actors. Attack trees (Schneier 1999) and attack graphs (Sheyner et al. 2002 ) capture how malicious activity can result in compromised systems or conversely how computer systems might be vulnerable to intentionally destructive actions. The systems are in workplaces, and the non-malicious users are largely disregarded. Yet studies (CERT 2008; Sasse, Brostoff, and Weirich 2001) suggest that the user, rather than an active adversary, may well pose the largest security risk. In this paper, we discuss some initial steps in “personalizing” security vulnerability analysis. In particular, we augment the canonical form of the attack graph to admit user actions and associated system states, thus personalizing t he notion of attack to encompass user culpability. Additional ly, we exploit the enhanced representation to help define attack graphs that can be automatically tailored to specific users, their behaviors, and their specific computer systems. The re sulting attack graphs need only encompass vulnerabilities that are likely for a particular user/personal computer com bination. The personalized attack graphs can be analyzed to determine what system states to monitor and how to intervene – either preventing vulnerabilities or taking correct ive actions once a breach has occurred. We highlight two systematic ways to model a networked system’s risk to malicious attacks: attack trees (Dawkins, Campbell, and Hale 2002; Dewri et al. 2007; Schneier 1999; Tidwell et al. 2001) and attack graphs (Ammann, Wijesekera, and Kaushik 2002; Artz 2002; Cuppens and Ortalo 2000; Dawkins and Hale 2004; Jajodia, Noel, and O’Berry 2003; Jha, Sheyner, and Wing 2002; Ritchey and Ammann 2000; Sheyner et al. 2002; Swiler et al. 2001; Templeton and Levitt 2000). They help to organize and analyze intrusion and/or misuse scenarios (also called attac k scenarios) by enumerating known vulnerabilities or weak spots in the system, and capturing the cause-consequence relationships between system configuration and these vulnerabilities in the form of an And-Or tree (attack trees) or a directed graph (attack graph). For every system resource (such as, a web server, account information on a host, or a piece of confidential information ) that needs to be protected, an attack tree/graph is defined. I their simplest forms, the nodes in the tree/graph represent certain system states of interest to an attacker, with edges connecting them to indicate the cause-consequence relatio nship among the states. The root node in the case of attack trees or a final node in the case of attack graphs, represents the attacker’s ultimate goal, namely, causing damage to the protected resource. The interior nodes represent pos sible system states during the execution of the attack (attack er sub-goals). The leaf nodes or one or more source nodes represent system states that must exist for an attacker to successfully initiate the attack. System states can include di ff rent levels of partial compromise effectuated by the attacke r (e.g., access to the password file), configuration informati on (e.g., operating system and hardware configuration, networ k connectivity etc.), state changes achieved on specific system components (e.g., implanting a keystroke logger), or any other subgoal that will ultimately lead to the final goal. Edges represent actions taken by the attacker causing a progression of the attack. Researchers have also proposed different variants of attack trees and attack graphs to capture more information about system risks. Examples of these are the multipleprerequisite graph (Lippman et al. 2006) and the exploitdependency graph (Noel et al. 2003) that includes the differ ent conjunctive and disjunctive relationships between var ious nodes in the graph. Although different attack scenarios are easily perceived in attack graphs, attack graphs can potentially suffer from a state space explosion problem. Ammann et al. (2002) proposed a refined formulation of attack graphs with the assumption of monotonicity. The monotonicity property supposes that if a state is reached as a result of some attack, it remains so during subsequent attacks. Such an assumption can greatly reduce the number of nodes in the attack graph. Other approaches to address scalability include aggregating a set of nodes representing similar host configurations into single nodes (Noel and Jajodia 2004; Swiler et al. 2001), building restricted attack graphs simp ly for answering very specific queries (Sheyner et al. 2002), building reduced attack trees that are minimal spanning tre es in graphs (Birkholz et al. 2010), and reducing attack graphs using planning techniques (Ghosh and Ghosh 2010). Almost all of these approaches to attack trees and attack graphs are constructed to capture vulnerabilities in enter prise/industrial settings and focus on attacker actions. N one of them integrate user actions and support personalization that restricts the focus to those vulnerabilities present f or a particular user/system combination. Attack graphs are designed to support network analysis. Thus, they do not include the level of detail – or dynamism in the representation – required to direct active monitoring for attacks and determine consequences of interventions. In contrast, aut omated planning has been used to help simulate and analyze security breaches in networked computer systems. Boddy et al. (2005) built a mixed initiative planning system, called the Behavioral Adversary Modeling System (BAMS), that could identify potential vulnerabilities and countermeas ure in cyber security for large organizations. The authors wrot e a domain model in the Planner Domain Definition Language (PDDL), which is a common input language for many recent planners (Fox and Long 2003). They were able to produce “insider subversion” plans of 40–60 steps. A key contribution of the work was showing that automated planning could highlight novel (sometimes unexpected) attack scenarios f or the analyst driving BAMS. The BAMS PDDL domain was later released as a suite of problems for the International Planning Competition. Ghosh and Ghosh (2010) proved they could reduce the computational complexity of an attack graph by iteratively applying a planner to eliminate from further consideration possible attack scenarios. They use a PDDL model that is similar to that of Boddy et al. and generate minimal attack paths. Their approach allows the model to scale to realistic, complex networks. A similar planner/model setup as tha t of Ghosh and Ghosh was integrated into a penetration testing framework (Obes, Sarraute, and Richarte 2010). Their model contained 1800 actions and was extensively tested against medium-sized networks. Our work complements the previous approaches by leveraging these PDDL domains with a detail-oriented, usercentered extension to the formal model of the attack tree/graph. The representation is intended to form the core Figure 1: The proposed Mixed Initiative Planning and Scheduling Agent (MIPSA) Architecture. of an agent that will help home computer users maintain security on their machines by monitoring some of their actions and recommending actions to reduce security risks. The agent will be developed from studies of users. In this paper, we describe the project in brief and present a proof of concept of the enhanced attack graph and its representation in PDDL. Psychologically Motivated Computer Security Home users are often considered the weakest link in computer security. In our project, we combine expertise from psychology, computer security and artificial intelligence to study the nature of the risks inherent in normal activity on the Internet, the perception of those risks, the judgment about trade-offs in behavior and the design of a personalize d agent that can alert users to risky behavior and help to prote ct them. The key insight is that security and privacy protectio n requires the efforts of both the computer and the user; thus, the security measures must work in concert with the user’s activities and needs. The goal of our project is to develop a semi-autonomous, intelligent and personalized approach to computer security that leverages psychological studies of what users want/need, what security and privacy risks are imminent based on the status of the system and the user’s actions and what interventions will be most effective. The intelligent agent will act as an interface between the system, the security software and the user. As shown in Figure 1, we anticipate having two conceptual components: a user/system monitor (U/SM) and a semi-autonomous action planner (SAIP). The actions will include coaching the user about the consequences of their choices, administrating the security so f ware and identifying system modifications that mitigate threats. Thu