Génération automatique de graphes d'attaque et de remédiation

Cyberattacks have increased since the COVID-19 pandemic because of the increasing use ofthe internet and home office trends. They can have several origins. This thesis focuses oncyberattacks exploiting vulnerabilities in computer networks. Organizations should spendtime deciding which vulnerabilities should be addressed as a priority. The amount of alertsreceived by organizations is huge. Cybersecurity experts can only deal with some of them.They should also decide which incident response action should be part of the organization’sincident response plan.This thesis aims to automate the incident response plan by building it based on the discoveredvulnerabilities’ exploitation requirements, system composition, and organization constraints.This approach is based on attack graphs, which help represent the paths an adversary canfollow to cause damage to the system.The main objective of this thesis is to generate an automated incident response playbookin real-time to respond to the cyberattack. Some essential research activities are defined toreach this goal. They are subdivided into four research objectives that constitute a basis forthe proposed contributions of this thesis.The first research objective is updating real-time attack graphs based on a vulnerabilityontology and system monitoring. This contribution proposes a tool composed of a moduleresponsible for correlating alerts generated by a monitoring tool integrated into this tool withlogical attack graphs. This module deduces which vulnerability is susceptible to be exploitedor is exploited and then queries the ontology to find possible new attack paths leading to theattacker’s goal. This launches then the attack graph enrichment with new paths.This contribution is validated thanks to a use-case scenario concerning a smart city. Theattack’s goal is to cause physical damage to public transportation. This goal is reachablebecause an attacker gains administrator privileges, allowing the modification of sensitive informationby exploiting the BlueKeep vulnerability. The vulnerability exploitation activatesthe ontology deduction of a new impact of its exploitation, leading to new attack paths deduction.This work shows that the adversary could reach the attack goal faster by takingthis path. This approach helps anticipate attack paths that were not known when generatingthe proactive attack graph.The second research objective focuses on selecting cybersecurity countermeasures automaticallybased on graph matching. This contribution consists of matching the knowledge graphof the vulnerability ontology with a countermeasure knowledge graph to deduce potentialcountermeasures against the system’s vulnerabilities. This approach is evaluated using theF1 Score metric to assess the countermeasures’ correctness.The third research objective is to generate optimal incident response playbooks automatically.This contribution focuses on generating an optimal playbook for each vulnerability identifiedin the system based on countermeasures selected from the second contribution. The proposedsolution automatically generates the candidate incident response actions for the playbookby matching the selected countermeasures with an incident response framework. The toolprunes the incident response actions based on the vulnerability exploitation requirements,the system’s security tools, and the organization’s constraints.Therefore, all the combinations of actions are generated considering constraints such as theminimum number of actions in a playbook. An optimization algorithm helps to select theoptimal playbook by doing a tradeoff between three defined optimization objectives. Thiscontribution is validated for an illustrative system, demonstrating how the optimal generatedplaybook is logically effective. The time performance of the process is evaluated for theoptimal playbook generated for 40 vulnerabilities. The effectiveness of the optimizationalgorithm is also evaluated by using a metric of the percentage gap between the number ofplaybooks generated before and after applying the optimization algorithm over the playbooksgenerated for the 40 vulnerabilities.The fourth research objective is to generate an attack-defense graph in real-time. The contributionfocuses on instantiating the incident response actions of a playbook generated onthe attack graph when an alert generated matches at least a node of the attack graph. Thesolution is deployed on a workstation in a virtual industrial infrastructure. The configurationenables a router to send traffic between the target network and the network where theadversary network is to the workstation.The monitoring tool integrated into the proposed solution monitors the traffic passing throughthe router and traffic coming from different network interfaces. Then, it is able to generatealerts. When a generated alert matches an attack graph node, the tool looks for countermeasuresthat can be instantiated on the attack graph in a table correlating attack facts withincident response actions. The approach is validated for two use case scenarios, consideringthe security relevance of the countermeasures instantiated on the attack graph and the timeperformance of the instantiation process.This thesis responds to several research problems. However, it has some limitations. Theautomated graph-matching process enables the selection of relevant countermeasures but istime-consuming. Therefore, it can not be launched in real time. The time complexity ofthe playbook generation process is non-polynomial. Depending on the system’s size andcomplexity and the number of vulnerabilities, the instantiation of incident response actionsfrom the optimal playbook on the attack graph can take more than three minutes. However,an adversary generally takes over three minutes to take his/her next step toward reaching theattack goal. The proposed approach is, therefore, optimal. It automates the instantiationof remediation actions on the attack graph in real-time and reports actions that cannot beinstantiated on the attack graph to cybersecurity experts.

Récupéré en direct depuis OpenAlex et désinversé. Les résumés ne sont pas conservés dans cette base de données : les index inversés représentent 8,6 Go des 9,3 Go de texte de la base, et le serveur dispose de 13 Go libres.