Towards Unifying Vulnerability Information for Attack Graph Construction Sebastian Roschke Feng Cheng, Robert Schuppenies, Christoph Meinel ISC2009-2009-09-08 Internet-Technologies and -Systems Prof. Dr. Ch. Meinel
Outline 2 Introduction Outline Introduction Attack Graph Workflow Sources of Vulnerability Information Source Comparison CVE, CVSS, and OVAL Implementation of an Extraction Tool Data Model Architecture Proof of Concept Summary & Conclusions
Attack Graph Workflow 3 Attack Graph Workflow Phases Information Gathering, Attack Graph Contruction, Analysis & Visualization Introduction Attack Graph Workflow
Outline 4 Introduction Outline Introduction Attack Graph Workflow Sources of Vulnerability Information Source Comparison CVE, CVSS, and OVAL Implementation of an Extraction Tool Data Model Architecture Proof of Concept Summary & Conclusions
Vulnerabilty Information 5 Sources of Vulnerability Information
Sources of Vulnerabilty Information 6 Sources of Vulnerability Information Existing databases are either commercial or community-based Commercial: DragonSoft (D.Soft), Secunia, SecurityFocus (S.Focus), Securiteam, and X-Force Community-based: Cooperative Vulnerability Database (CoopVDB), the Department of Energy Cyber Incident Response Capability (DoE-CIRC), the National Vulnerability Database (NVD), the Open Source Vulnerability Database (OSVDB), and the United States Computer Emergency Readiness Team (US-CERT) Vulnerabilty standardization efforts CVE Common Vulnerabilty and Exposures CVSS - Common Vulnerability Scoring System OVAL - Open Vulnerability and Assessment Language
Vulnerabilty Standardization Efforts 7 Sources of Vulnerability Information Standardization CVE Common Vulnerabilty and Exposures Dictionary providing common names and references for vulnerabilites CVSS - Common Vulnerability Scoring System Metric indicates how critial a vulnerability is Metrics: base metrics, temporal metrics, and environmental metrics Base metrics: access vector and complexity information, degree of Confidentiality, Integrity, and Availability (CIA) violations, and number of required authentication steps OVAL - Open Vulnerability and Assessment Language Detailed and structured description of congurations affected by vulnerabilities Defintion Types: vulnerability definitions, compliance definitions, inventory definitions, patch definitions, miscellaneous type
Sources of Vulnerabilty Information 8 Comparison Sources of Vulnerability Information Comparison
Outline 9 Introduction Outline Introduction Attack Graph Workflow Sources of Vulnerability Information Source Comparison CVE, CVSS, and OVAL Implementation of an Extraction Tool Data Model Architecture Proof of Concept Summary & Conclusions
Implementation Data Model 10 Data Model Description of vulnerabilities as set of pre- and post-conditions Condition consists of system properties Extraction Tool Data Model (1/3)
Implementation Data Model 11 System Properties Extraction Tool Data Model (2/3)
Implementation Data Model 12 Description Example Extraction Tool Data Model (3/3)
Automatic Vulnerability Extraction 13 Architecture Extraction Tool Architecture Plugin enabled architecture of readers and writers Reader plugins parse VDBs and create internal vulnerability representation (according to introduced data model) Writer plugins use the data model to transform internal representation, e.g., to create AG creator compatible data
Automatic Vulnerability Extraction 14 Extraction Tool Extraction Process Proof of Concept PoC implemented in python with simple web based front end Reader plugins: NVD Reader, OVAL Reader, XML Reader, CVE Reader Writer plugins: MulVAL Writer, XML Writer Extraction Process Main source NVD Utilization of CVSS: CIA impact, access vector Utilization of OVAL: description of environment Extraction based on common patterns and phrases execute arbitrary code" Microsoft Windows 2000 SP4 or later is installed
Correctness 15 Evaluation of Textual Extraction NVD comparison of textual description with CVSS counterpart Extraction Tool Correctness
Outline 16 Introduction Outline Introduction Attack Graph Workflow Sources of Vulnerability Information Source Comparison CVE, CVSS, and OVAL Implementation of an Extraction Tool Data Model Architecture Proof of Concept Summary & Conclusions
Summary 17 Main contributions Comparison of vulnerability databases Data model to unify vulnerabilities Automatic extraction of vulnerability information Transformation to different attack graph tools, e.g., MulVAL (Ou et al.) Summary - Conclusion Conclusions Vulnerability information often is inconsistent, e.g., CVSS compared to textual description Extraction from textual descriptions applicable (70%-90% correctness)
Open Issues 18 Improve the extraction process Additional plugins to enrich functionality Reader for new VDBs, e.g.,... Writers for different Attack Graph tools Universal vulnerability database providing unified vulnerability information (extracted from multiple databases) at runtime Summary Open Issues Utilization of data model to describe system and network information Attack Graph toolkit focusing on wide range of vulnerability information
Questions 19 Any Questions? Summary - Questions