Probabilistic Assessment of Security Scenarios Challenges and Solutions

Transcription

1 Probabilistic Assessment of Security Scenarios Challenges and Solutions Barbara Kordy Joint work with Marc Pouly, Patrick Schweitzer Formal Methods and Security seminar INRIA Rennes, May 16, 2014

2 Barbara Kordy 2 Who am I? Ph.D. Student and Moniteur, Université d Orléans, France Automates pour l Analyse de Documents XML Compressés, Applications à la Sécurité d Accès Research Associate, University of Luxembourg Formal methods for modeling and analysis of real-life security problems

3 Barbara Kordy 3 Probabilistic Assessment of Security Scenarios security model ADTree dependency model Bayesian network probabilistic assessment of attack defense scenarios with dependencies

4 Barbara Kordy 4 Outline 1 Attack defense Trees 2 Probabilistic Evaluation 3 Efficiency Considerations 4 Wrap Up

5 Attack defense Trees Barbara Kordy 5 Modeling Security Scenarios Attack defense tree (ADTree) [FAST 10] Tree-like representation of an attack defense scenario depicting: How to attack a system How to protect against an attack Extend the industrially recognized model of attack trees [Schneier 99] Integrate Intuitive representation features [IJSSE 12, ICISC 12] Formal analysis techniques [GameSec 10, SIIS 11, JLC 14] Software application ADTool [QEST 13]

6 Attack defense Trees Barbara Kordy 6 Example: ADTree for Infecting a Computer infect computer virus on system execute virus with attachment USB stick antivirus install antivirus run antivirus fake antivirus

7 Attack defense Trees Barbara Kordy 7 Propositional Semantics for ADTrees [SIIS 11] B the set of non-refined nodes of ADTree t x {0, 1} B encodes whether actions from B succeed or not Action A B succeeds if x(a) = 1 Action A B does not succeed if x(a) = 0 Boolean function f t for t f t : {0, 1} B {0, 1} associates a Boolean value f t (x) {0, 1} with each vector x {0, 1} B x is called an attack vector if f t (x) = 1

8 Attack defense Trees Barbara Kordy 8 ADTrees as Boolean Functions Domain of f t is composed of the non-refined nodes of t Non-refined OR AND Countermeasure t t t' A t' t'' t' t'' t'' f t (A) = A f t = f t f t f t = f t f t f t = f t f t

9 Attack defense Trees Barbara Kordy 9 Example: Boolean Function for Infecting a Computer infect computer virus on system execute virus with attachment USB stick antivirus install antivirus run antivirus f t = fake antivirus ( (X EA X US ) ( X IA (X RA X FA ) )) X EV

10 Attack defense Trees Barbara Kordy 10 Example: Attack Vector infect computer true virus on system true execute virus true with attachment true USB stick false antivirus false install antivirus true run antivirus false f t = fake antivirus false ( (X EA X US ) ( X IA (X RA X FA ) )) X EV attack vector

11 Attack defense Trees Barbara Kordy 11 Importance of Probabilities Knowing the probabilities of particular attacks allow us to Identify the most vulnerable components Determine the strategic points Decide which defensive measures to implement

12 Attack defense Trees Barbara Kordy 12 Bottom-Up Evaluation of Probability on ADTrees [ICISC 12] Probability of a disjunctive subtree Probability of a conjunctive subtree Probability of a countered subtree attack attack x x y x y y

13 Attack defense Trees Barbara Kordy 12 Bottom-Up Evaluation of Probability on ADTrees [ICISC 12] Probability of a disjunctive subtree Probability of a conjunctive subtree Probability of a countered subtree attack attack x x y x y y x + y xy

14 Attack defense Trees Barbara Kordy 12 Bottom-Up Evaluation of Probability on ADTrees [ICISC 12] Probability of a disjunctive subtree Probability of a conjunctive subtree Probability of a countered subtree attack attack x x y x y y x + y xy xy

15 Attack defense Trees Barbara Kordy 12 Bottom-Up Evaluation of Probability on ADTrees [ICISC 12] Probability of a disjunctive subtree Probability of a conjunctive subtree Probability of a countered subtree attack attack x x y x y y x + y xy xy x(1 y)

16 Attack defense Trees Barbara Kordy 12 Bottom-Up Evaluation of Probability on ADTrees [ICISC 12] Probability of a disjunctive subtree Probability of a conjunctive subtree Probability of a countered subtree attack attack x x y x y y x + y xy xy x(1 y) Similarly for subtrees rooted in a defense node

17 Attack defense Trees Barbara Kordy 13 Example: Probability for Infecting a Computer infect computer virus on system execute virus 0.9 with attachment 0.5 USB stick 0.75 antivirus install antivirus 0.8 run antivirus 0.25 fake antivirus 0.25

18 Attack defense Trees Barbara Kordy 14 Limitations The bottom-up procedure does not take dependencies between actions into account. However, in practice Installing and running an antivirus Distributing and executing a virus are not independent actions. Thus, the standard bottom-up evaluation is not suitable for probabilistic assessment of attack defense trees.

19 Attack defense Trees Barbara Kordy 15 Challenges 1 How to design the appropriate formalism? 2 How to ensure that calculations reflect the reality? 3 How to guarantee the efficiency of the evaluation?

20 Probabilistic Evaluation Barbara Kordy 16 Proposed Framework [ifm 14] security model ADTree

21 Probabilistic Evaluation Barbara Kordy 16 Proposed Framework [ifm 14] security model ADTree dependency model Bayesian network

22 Probabilistic Evaluation Barbara Kordy 16 Proposed Framework [ifm 14] security model ADTree dependency model Bayesian network probabilistic assessment of attack defense scenarios with dependencies

23 Probabilistic Evaluation Barbara Kordy 17 Modeling Probability of Dependent Actions Bayesian network A directed, acyclic graph that reflects the conditional interdependencies between variables associated with the nodes of the network Dependent variables Conditional probability table for Y X Y p(y = 1 X = 1) = 0.7 p(y = 1 X = 0) = 0.2 p(y = 0 X = 1) = 0.3 p(y = 0 X = 0) = 0.8

24 Probabilistic Evaluation Barbara Kordy 18 Constructing Bayesian Network BN t for ADTree t From an ADTree t ADTree B set of all non-refined nodes of t To a Bayesian network Elements of B are nodes of the Bayesian network BN t Relations between actions are depicted by edges in BN t Conditional probability tables quantify dependencies between actions

25 Probabilistic Evaluation Barbara Kordy 19 Example: BN t for Infecting a Computer ADTree p(x EA = 1 X FA = 1) = 0.9 p(x EA = 1 X FA = 0) = 0.5 with attachment p(x FA = 1) = 0.3 fake antivirus USB stick p(x US = 1 X FA = 1) = 0.4 p(x US = 1 X FA = 0) = 0.5 execute virus p(x EV = 1 X EA = 1, X US = 1) = 0.9 p(x EV = 1 X EA = 1, X US = 0) = 0.2 p(x EV = 1 X EA = 0, X US = 1) = 0.8 p(x EV = 1 X EA = 0, X US = 0) = 0.1 install antivirus run antivirus p(x IA = 1) = 0.6 p(x RA = 1 X IA = 1) = 0.9 p(x RA = 1 X IA = 0) = 0.0

26 Probabilistic Evaluation Barbara Kordy 20 Joint Probability Distribution for the Network BN t with attachment fake antivirus execute virus USB stick install antivirus run antivirus p(x EA, X US, X IA, X RA, X FA, X EV ) = p(x EV X EA, X US ) p(x EA X FA ) p(x US X FA ) p(x FA ) p(x RA X IA ) p(x IA )

27 Probabilistic Evaluation Barbara Kordy 21 Propositional Semantics Using Algebraic Operations Non-refined OR AND Countermeasure t t t' A t' t'' t' t'' t'' f t (A) = A f t = f t f t f t = f t f t f t = f t f t

28 Probabilistic Evaluation Barbara Kordy 21 Propositional Semantics Using Algebraic Operations Non-refined OR AND Countermeasure t t t' A t' t'' t' t'' t'' f t (A) = A f t = f t f t f t = f t f t f t = f t f t id A max{f t, f t } f t f t f t (1 f t )

29 Probabilistic Evaluation Barbara Kordy 22 Probability Computation x {0, 1} B vector of successful/unsuccessful actions Probability of attack vector x f t (x) p(x) Probability related to ADTree t P(t) = x {0,1} B f t (x) p(x) Probability of the most probable attack vector P max (t) = max f t(x) p(x) x {0,1} B

30 Probabilistic Evaluation Barbara Kordy 23 Compatibility Results [ifm 14] Theorem Probability computations on propositionally equivalent ADTrees yield the same result. Observation For ADTree t without dependent actions, P(t) coincides with the result of the bottom-up computation.

31 Efficiency Considerations Barbara Kordy 24 Efficiency Problems P(t) = x {0,1} B f t (x) p(x) P max (t) = max x {0,1} B f t(x) p(x) The number of configurations x grows exponentially with the number of involved actions. For large systems, it is therefore not feasible to Enumerate all the values of f t Enumerate all the values of the joint probability distribution for BN t

32 Efficiency Considerations Barbara Kordy 25 security model ADTree dependency model Bayesian network probabilistic assessment of attack defense scenarios with dependencies

33 Efficiency Considerations Barbara Kordy 25 security model ADTree constraint reasoning fusion dependency model Bayesian network probabilistic assessment of attack defense scenarios with dependencies

34 Efficiency Considerations Barbara Kordy 26 Local Indicators ( ( )) f t = (X EA X US ) XIA (X }{{} RA X FA ) X }{{} EV Y 1 Y }{{ 2 } }{{} Y 4 } {{ } Y t Y 3 φ 1 (Y 1, X EA, X US ) = 1 exactly if Y 1 = max{x EA, X US } φ 2 (Y 2, X RA, X FA ) = 1 exactly if Y 2 = X RA (1 X FA ) φ 3 (Y 3, X IA, Y 2 ) = 1 exactly if Y 3 = X IA Y 2 φ 4 (Y 4, Y 1, Y 3 ) = 1 exactly if Y 4 = Y 1 (1 Y 3 ) φ 5 (Y t, Y 4, X EV ) = 1 exactly if Y t = Y 4 X EV

35 Efficiency Considerations Barbara Kordy 27 Global indicator function φ t for ADTree t Domain of φ t : Non-refined nodes of t Inner variables of all local indicators Global indicator function φ t = product of all local indicators φ i Y=inner variables B=non-refined nodes {}}{{}}{ φ t ( Y 1, Y 2, Y 3, Y 4, Y t, X EA, X US, X IA, X RA, X FA, X EV ) = φ 1 (Y 1, X EA, X US ) φ 2 (Y 2, X RA, X FA ) φ 3 (Y 3, X IA, Y 2 ) φ 4 (Y 4, Y 1, Y 3 ) φ 5 (Y t, Y 4, X EV ) Φ t indicates valid assignments with respect to f t

36 Efficiency Considerations Barbara Kordy 28 Important Property Theorem Consider an ADTree t over the set of non-refined nodes B and the global indicator function φ t with the set of inner variables Y. x {0, 1} B!y {0, 1} Y, such that φ t (y, x) = 1 Corollary: x {0, 1} B max φ t(y, x) = y {0,1} Y y {0,1} Y φ t (y, x) = 1

37 Efficiency Considerations Barbara Kordy 29 Filtering Interesting Assignments of φ t A t B φ t (Y t = 1, X A = 1, X B = 1) = 1 φ t (Y t = 1, X A = 1, X B = 0) = 1 φ t (Y t = 1, X A = 0, X B = 1) = 1 φ t (Y t = 0, X A = 0, X B = 0) = 1 We are only interested in assignments such that φ t = 1 and Y t = 1 Y t φ t (y, x)

38 Efficiency Considerations Barbara Kordy 30 Expressing f t with its Global Indicator x {0, 1} B : max φ t(y, x) = y {0,1} Y y {0,1} Y φ t (y, x) = 1 x {0, 1} B ( max Yt φ t (y, x) ) = y {0,1} Y y {0,1} Y = f t (x) = ( Yt φ t (y, x) ) = { 1, if x is an attack vector 0, otherwise

39 Efficiency Considerations Barbara Kordy 31 Factorized Form for Probability Formulas Probability of attack vector x ( ) f t (x) p(x) = max Y t φ t (y, x) p(x) y {0,1} Y Probability related to ADTree t P(t) = x {0,1} B f t (x) p(x) = (y,x) {0,1} Y B ( ) Y t φ t (y, x) p(x) Probability of the most probable attack vector P max (t) = ( ) max f t(x) p(x) = max Y t φ t (y, x) p(x) x {0,1} B (y,x) {0,1} Y B

40 Efficiency Considerations Barbara Kordy 32 Our Framework in the Context of Semiring Theory Inference problem over the arithmetic semiring R, +, ( ) P(t) = Y t φ t (y, x) p(x) (y,x) {0,1} Y B Inference problem over the product t-norm semiring [0, 1], max, ( ) P max (t) = max Y t φ t (y, x) p(x) (y,x) {0,1} Y B

41 Efficiency Considerations Barbara Kordy 33 Local Computation Powerful local computation algorithms } Fusion smart distributivity Variable elimination P(t) Complexity bound Using Nenok tool [IJAIT 10] Direct computation sec Using fusion sec Complexity bounded by a structural parameter of the problem

42 Summary Wrap Up

43 Wrap Up Barbara Kordy 34 Summary security model ADTree

44 Wrap Up Barbara Kordy 34 Summary security model ADTree dependency model Bayesian network

45 Wrap Up Barbara Kordy 34 Summary security model ADTree dependency model Bayesian network probabilistic assessment of attack defense scenarios with dependencies

46 Wrap Up Barbara Kordy 34 Summary security model ADTree constraint reasoning fusion dependency model Bayesian network probabilistic assessment of attack defense scenarios with dependencies

47 Wrap Up Barbara Kordy 35 Addressing Challenges 1 How to design the appropriate formalism? 2 How to ensure that calculations reflect the reality? 3 How to guarantee the efficiency of the evaluation?

48 Wrap Up Barbara Kordy 35 Addressing Challenges 1 How to design the appropriate formalism? Used by industry, intuitive & well formalized Security model and dependency network are kept separated 2 How to ensure that calculations reflect the reality? 3 How to guarantee the efficiency of the evaluation?

49 Wrap Up Barbara Kordy 35 Addressing Challenges 1 How to design the appropriate formalism? Used by industry, intuitive & well formalized Security model and dependency network are kept separated 2 How to ensure that calculations reflect the reality? Real-life data take dependencies into account Complement ADTree with additional information 3 How to guarantee the efficiency of the evaluation?

50 Wrap Up Barbara Kordy 35 Addressing Challenges 1 How to design the appropriate formalism? Used by industry, intuitive & well formalized Security model and dependency network are kept separated 2 How to ensure that calculations reflect the reality? Real-life data take dependencies into account Complement ADTree with additional information 3 How to guarantee the efficiency of the evaluation? Local computation algorithms Existing software tools, well-known heuristics

51 Wrap Up Barbara Kordy 36 Where to take it from here? Find the best elimination sequence for Bayesian ADTrees NP-complete in general Prediction is possible for specific families of graphs Extend to probability distributions Probability dependent on time Interface ADTool [QEST 13] with Nenok Automated probability assessment of large scale scenarios

52 Thank you for your attention! Barbara Kordy 37 Follow Up Project Attack Defense Trees: Theory Meets Practice Ph.D. vacancy: Contact information: Barbara Kordy

53 References Barbara Kordy 38 References I Bruce Schneier. Attack Trees. Dr. Dobb s Journal of Software Tools, 24(12):21 29, Barbara Kordy, Sjouke Mauw, Matthijs Melissen, and Patrick Schweitzer. Attack Defense Trees and Two-Player Binary Zero-Sum Extensive Form Games Are Equivalent. In Tansu Alpcan, Levente Buttyán, and John S. Baras, editors, Decision and Game Theory for Security (GameSec 2010), volume 6442 of LNCS, pages Springer, Barbara Kordy, Sjouke Mauw, Saša Radomirović, and Patrick Schweitzer. Foundations of Attack Defense Trees. In Pierpaolo Degano, Sandro Etalle, and Joshua Guttman, editors, Formal Aspects of Security and Trust (FAST 2010), volume 6561 of LNCS, pages Springer, Marc Pouly. Nenok - a software architecture for generic inference. International Journal on Artificial Intelligence Tools, 19(1):65 99, 2010.

54 References Barbara Kordy 39 References II Barbara Kordy, Marc Pouly, and Patrick Schweitzer. Computational Aspects of Attack Defense Trees. In P. Bouvry, M. A. Klopotek, F. Leprevost, M. Marciniak, A. Mykowiecka, and H. Rybinski, editors, Security & Intelligent Information Systems (SIIS 2011), volume 7053 of LNCS, pages Springer, Barbara Kordy, Sjouke Mauw, Saša Radomirović, and Patrick Schweitzer. Attack Defense Trees. Journal of Logic and Computation (JLC), 24(1):55 87, Barbara Kordy, Piotr Kordy, Sjouke Mauw, and Patrick Schweitzer. ADTool: Security Analysis with Attack Defense Trees. In Kaustubh R. Joshi, Markus Siegle, Mariëlle Stoelinga, and Pedro R. D Argenio, editors, Quantitative Evaluation of Systems (QEST 2013), volume 8054 of LNCS, pages Springer, Alessandra Bagnato, Barbara Kordy, Per Håkon Meland, and Patrick Schweitzer. Attribute Decoration of Attack Defense Trees. International Journal of Secure Software Engineering (IJSSE), 3(2):1 35, [IGI Global s 2012 Best Article Award].

55 References Barbara Kordy 40 References III Barbara Kordy, Sjouke Mauw, and Patrick Schweitzer. Quantitative Questions on Attack Defense Trees. In Taekyoung Kwon, Mun-Kyu Lee, and Daesung Kwon, editors, Information Security and Cryptology (ICISC 2012), volume 7839 of LNCS, pages Springer, Barbara Kordy, Marc Pouly, and Patrick Schweitzer. A Probabilistic Framework for Security Scenarios with Dependent Actions Under review. Barbara Kordy, Ludovic Piètre-Cambacédès, and Patrick Schweitzer. DAG-Based Attack and Defense Modeling: Don t Miss the Forest for the Attack Trees Under submission, pre-print available at