Communication Dans Un Congrès Année : 2024

Attack-Defense Graph Generation: Instantiating Incident Response Actions on Attack Graphs

Résumé

Cyber-attacks are increasing; it is more urgent for organizations to automate their Incident Response (IR) plan process. Attack Graphs (AGs) are used to represent actions followed by an adversary to reach a goal. However, an expert should analyze each possible action and their impact to decide which mitigation actions should be applied to block the attack fulfillment. This paper proposes an approach to generate Attack-Defense Graphs in real-time by instantiating IR actions on a logical AG. The system’s real-time monitoring enables the detection of malicious actions, which leads to the generation of alerts mapped with the AG to deduce the attacker’s location on the system. Our solution can decide where to apply IR actions to mitigate the attack impact. These IR actions are part of playbooks that are generated automatically for the attack. We propose correlating IR actions with the AG fact nodes to choose which IR actions to instantiate on the AG. Therefore, we propose generating predicates for the mitigation actions, which are mapped with the AG predicates. We validate our approach with an industrial use case. An asset is vulnerable to Remote Code Execution (RCE) requiring user credentials that can be obtained through a brute force attack. We show how our approach helps anticipate an adversary’s next step. The countermeasures predicates are instantiated on the AG to prevent the attacker from going further on the system.

Fichier principal
Vignette du fichier
ADG_generationfinal.pdf (582.14 Ko) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)
Licence

Dates et versions

hal-04766418 , version 1 (03-03-2025)

Licence

Identifiants

  • HAL Id : hal-04766418 , version 1

Citer

Kéren A Saint-Hilaire, Christopher Neal, Frédéric Cuppens, Nora Cuppens-Boulahia, Francesca Bassi. Attack-Defense Graph Generation: Instantiating Incident Response Actions on Attack Graphs. IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TRUSTCOM), Dec 2024, Sanya, China. ⟨hal-04766418⟩

Collections

399 Consultations
1113 Téléchargements

Partager

  • More