The Search for Optimality in Automated Intrusion Response

Transcription

1 The Serch for Optimlity in Automted Intrusion Response Yu-Sung Wu nd Surbh Bgchi (DCSL) & The Center for Eduction nd Reserch in Informtion Assurnce nd Security (CERIAS) School of Electricl nd Computer Engineering Purdue University Work supported by: Purdue Reserch Foundtion, Avy, CERIAS Slide 1/20 Survivble Systems nd Intrusion Response Modern life hevily depends on computer systems Intrusions/security breches to these systems occur Wys to mke system survivble At design/implementtion phse Eliminte vulnerbilities Policy/Access Control/Cryptogrphy/Forml Verifiction In production phse Use IDS (system logs checking/network pcket sniffing/virus, worms scnning, detecting files modifictions ) to identify misuses/nomlies Perform incident/intrusion response (IRS) to detected misuses/nomlies Continment nd Recovery Focus of this work Slide 2/20

2 Intrusion Response System The need for IRS A survivble system needs to provide functionlity through intrusions Humn intervention fter IDS lert cn be costly nd slow IRS tkes reports from IDS (usully bundled together), processes it, nd crries out ctions to counter the intrusion Existing exmples of IRS Anti-virus softwre which disbles ccess to worm executbles or files infected with virus Routers/firewlls which ctively block worm trffic Lptops equipped with motion sensor nd TPM module tht cn lock up the computer when unuthorized movement (usully occurs when the lptop is being stolen) is detected Slide 3/20 Intrusion Response System Summry on existing IRS Most of them re stnd-lone nd re tied with one single nd specific detector (IDS) Trget mostly t one mchine box only IRS for Distributed Systems An environment of multiple interconnected boxes with heterogeneous nd cooperting services Few generl-purpose IRS solutions exist for distributed systems The most common wy is to use the stnd-lone solutions seprtely nd independently on the boxes E.g., Hve McAfee nti-virus softwre instlled on the worksttion boxes, nd CISCO IPS on the network joints. Slide 4/20

3 IRS for Distributed Systems Drwbck of the common wy Ech IRS/IDS pir does not leverge the detection reports from the other IDSs Existing reserch on correltion IDS hve shown cler dvntges of doing so The IRS/IDS pir does not consider the effects from the response ctions crried out by the other IRS/IDS pirs This cn led to redundnt response ctions nd denil-of-service of the system t worst. At best, loclly optiml decisions from ech IRS/IDS pir There is no gurntee of system-wide globl optimlity Slide 5/20 ADEPTS IRS: Bsics Specificlly designed for distributed systems Use I-GRAPH ( vrint of ttck grph) s the core binding between detectors (stnd-lone IDSs) nd response ctions (stndlone IRSs) A detector is ssocited with n I- GRAPH node to tell the confidence index of tht node being compromised The compromise confidence index of nodes without ssocited detectors cn be inferred through the grph structure Response ctions re ssocited with edges A response is ment to stop the progression of the intrusion from the source node to the destintion node OR n QUORUM AND 3. Illegl ccess to http document root Detector D Response X 12. Execute rbitrry code on MySQL host 1. SSL module buffer overflow in Apche host 1 Detector A 2.Execute rbitrry code on Apche host MySQL informtion lek Detector B 9. MySQL buffer overflow Response Y 4. Send mlicious chunk encoded pcket 10. DoS of MySQL 2 7. DoS of Apche host 1 6. Chunk hndling buffer overflow on Apche host DoS webstore Detector C 8. DoS of Apche host 2 5. C librry code buffer overflowed Response Z Slide 6/20

4 Attck Phses The dynmics between intrusion nd response v b w c f y d h I-GRAPH X Y d Z d h b b c b c R f X R Y R Z Assuming n ttck includes three snpshots X, Y, nd Z clled ttck phses Ech snpshot includes I-GRAPH nodes which hve been chieved s prt of the ttck thus fr Following ech snpshot k, ADEPTS determines set of response ctions R k for deployment Slide 7/20 Dignosis of Achieved I-GRAPH Nodes Responses in I-GRAPH Detector X A.C. = 1 Mlwre downloded to stff computer CCI = 1 e.p.p = e.p.p = 0.8 Detector Y 0.8 A.C. = 0.6 Pssword Chnge keystroke grdes r recorded x r y recorded CCI = 0.16 CCI = 0.33 Assume: Prob(r x fils) = 0.2 Prob(r y fils) = 0.4 For n edge e connecting node to b in I-GRAPH with response r : cci() Prob(r fils) epp(e), if b hs no detector cci(b) = [ cci() Prob(r fils) epp(e) + AC(x) ], if b hs detector x 2 epp(e) : The edge propgtion probbility of edge e. This models n dversry s likelihood of tking this edge ADEPTS deploys responses on the ttck phse bsed on the CCI vlue of node Slide 8/20

5 Impct Vector A system hs trnsction gols nd security gols tht it needs to meet through the time of opertion Exmple: providing e-mil service nd ensuring the confidentility of sensitive dt Attcks re ment to impct some of these gols Deployed responses lso impct some of these gols Assume the impct from n ttck to the system cn be quntified through vector IV with ech element in the IV corresponding to the impct on ech trnsction/security gol [0, 1] Impct vector for dversry reching I-GRAPH node n k is IV(n k ) Impct vector for response r k is IV(r k ) Slide 9/20 Optimlity of Response Actions We formlly define the cost for response combintion ( set of response ctions) RC i s: m n i = i = k k + k k= 1 k= 1 Cost( RC ) Iv( RC ) Iv( n )Prob( n ) Iv( r ) In our ttck grph model, Prob(n k ) is estimted s CCI(n k ) Accurtely speking, Prob(n k ) is conditioned on mny fctors, nd determining its vlue is by itself chllenging reserch problem The response combintion RC i is sid to be optiml for the given ttck if it chieves minimum Cost(RC i ) Slide 10/20

6 Types of Response Actions Given snpshot s nd I-GRAPH G In terms of continment, ADEPTS should consider ll response ctions pplicble to the grph (G-s) In terms of recovery, ADEPTS should consider ll response ctions pplicble to the grph s s is typiclly not huge, s its size is liner in the number of detectble steps in multi-stge ttck But (G-s) cn be huge A function of pplicble ttck steps (vulnerbilities) in ll services in the ppliction system However, for nodes in (G-s) which re fr wy from s, the likelihood of them being reched is lower thn for closer ones Slide 11/20 Domin Grph Our solution is to limit the response serch spce for snpshot s to subset of (G-s), nmely the domin grph D(s) D(s) includes criticl nodes from I-GRAPH A node n is criticl if CCI n *IV n is greter thn given threshold The current snpshot S (chieved ttck stges) b c f d e k g j h i Domin Grph D(S) : chieved : non-chieved / criticl : non-chieved / non-criticl Slide 12/20

7 Approximte O.R.D. with Genetic Algorithm Optiml Response Determintion is proved to be NPhrd by mpping the Set Covering Problem to it The current snpshot S (chieved ttck stges) Encode the set R of responses pplicble within D(S) into chromosomes; Fitness of chromosome relted to cost b c f Apply Genetic Algorithm Solver: Crossover/Muttion/ Elitism Preserve the top chromosomes for future ttcks tht hve similr snpshots s s d e k g j h i Domin Grph D(S) : chieved : non-chieved / criticl : non-chieved / non-criticl Pick the best chromosome (the best response combintion) s the pproximte solution to ORD. Slide 13/20 Genetic Algorithm bsed Solver for ORD Why choose G.A.? Derivtive bsed optimiztion techniques do not work s our objective function is discrete Since exct problem is NP-hrd, one hs to look for pproximte serch Trde-off between the optimlity of the solutions nd the computtionl expense is djustble by controlling the size of the domin grph nd the number of evolutions in the GA bsed solver Good solutions (response combintions) from previous instnces re preserved into the chromosome popultion for future instnces of similr ttcks This speeds up the serch of good response combintions for future ttcks which re similr to the current one Slide 14/20

8 Experiment nd preliminry results The testbed A three-tier ecommerce system s the reference bsis for constructing ttck scenrios. Apche Tomct Apche Lod Blncer IPTbles Apche Tomct JBoss AS Jv PetStore Controller JBoss AS Jv PetStore Components MySQL A drone bsed testing frmework RESPONSE MESSAGES ATTACK MESSAGE Slide 15/20 Experiment nd Preliminry results Attck scenrios 0.C Ping or trceroute to web servers 2.A Exploit ssldump vuln. on web server 3.A Copy hcker tool to web svr using tftp 1.C Run portscnner on web servers 2.B.1 Access web server dmin site 2.B.2 Brute force dmin pssword 3.B Instll vuln. scnner on web svr Attck scenrios 3 nd 4, used for experimentl evlution. Boxes with A nd B denote the stges for scenrio 3 nd 4 respectively, while C denotes stges common to both. 5.A Exploit rpc.sttd service on pp controller 4.C Run port scnner on internl network 6.A Brute force root pwd on pp controller 6.B Exploit remote vuln. on MySQL 7.C Run MySQL modifiction queries on dtbse tbles Slide 16/20

9 Experiment Comprison ginst Bseline ADEPTS vs. the bseline (loclly optimized responses) Attck Scenrio 3 8 Survivbility ADEPTS Bseline ADEPTS Number of itertions Slide 17/20 Experiment Incorrect Initil Conditions ADEPTS where initil settings (effectiveness of responses, IV vlues, etc.) re incorrect, sy due to inexperienced sysdmin Attck Scenrio Survivbility ADEPTS Bseline ADEPTS Number of itertions After 16 itertions of the ttck, the effect of incorrect initil prmeters disppers Slide 18/20

10 Experiment Lerning from Similrity Utilizing the informtion (chromosomes) from similr ttcks Attck Scenrio 4 nd vrint Attck Scenrio Survivbility AS4 with history AS4 without history Number of itertions For one cse, AS4 is run fter running its vrint AS3 nd generting history. For the other, AS4 is run without such history. It tkes 8 itertions for the ltter to ctch up. Slide 19/20 Wrp-up Defined frmework to reson bout optimlity of intrusion responses in distributed systems The frmework is implemented using genetic lgorithm bsed solver since exct solution is NP-hrd Experiments with rel multi-stge ttcks indicte tht globlly optimizing response choices is beneficil Wht s coming next: How cn the number of evolutions of the GA be determined? Wht hppens if some detectors re misconfigured nd ttck phses re incomplete? How to hndle incomplete I-GRAPHs? Slide 20/20