RULES FOR THE IMPLEMENTATION OF EXPLOITS DURING AN ACTIVE ANALYSIS OF THE CORPORATE NETWORKS` SECURITY BASED ON A FUZZY ASSESSMENT OF THE QUALITY OF THE VULNERABILITY VALIDATION MECHANISM
DOI:
https://doi.org/10.28925/2663-4023.2021.14.148157Keywords:
active analysis of the security; corporate network; exploit; vulnerability validation; fuzzy logicAbstract
The dynamics of the increase in the number of vulnerabilities of software and hardware platforms of corporate networks, the accessibility of exploit modules for these vulnerabilities in the Internet and the Darknet, along with the lack of a sufficient number of highly qualified cybersecurity specialists make the problem of effective automation of preventive information protection mechanisms quite urgent. In particular, the basic algorithms for the sequential implementation of exploits embedded in the vulnerability exploitation tools are quite primitive, and the proposed approaches to their improvement require constant adaptation of mathematical models of the implementation of attacking actions. This justifies the direction of this research. This paper considers the issue of forming decision-making rules for the implementation of vulnerabilities’ exploits during an active analysis of the corporate networks’ security. Based on the results of the analysis of quantitative indicators of the quality of the validation mechanism of the identified vulnerabilities and the use of fuzzy logic methods, a fuzzy system was formed, membership functions for each of the linguistic variables were determined and a knowledge base was built, which makes it possible to determine the quality level of the validation mechanism of the identified vulnerabilities based on all available information. At the same time, in order to eliminate the “human factor” of making mistakes when validating vulnerabilities, based on the built fuzzy knowledge base and the established levels of exploit modules’ efficiency, the rules for the implementation of individual exploit modules during an active analysis of the corporate network’s security were formed. Results of research make it possible to create expert systems for diagnosing the effectiveness of the validation mechanism of the identified vulnerabilities of target systems, and also help to solve the problem of the lack of qualified specialists in the analysis and maintenance of an appropriate level of information security of corporate networks.
Downloads
References
State of Cybersecurity Resilience 2021 (4th Annual Report): How aligning security and the business creates cyber resilience. Accenture. https://www.accenture.com/_acnmedia/ PDF-165/Accenture-State-Of-Cybersecurity-2021.pdf
CVSS Severity Distribution Over Time. National vulnerability database. https://nvd.nist.gov/general/visualizations/vulnerability-visualizations/cvss-severity-distribution-over-time#CVSSSeverityOverTime.
Durkota, K. & Lisy, V. (2014). Computing optimal policies for attack graphs with action failures and costs. In 7th European Starting AI Researchers` Symposium (STAIRS). https://doi.org/10.3233/978-1-61499-421-3-101
Obes, J., Richarte, G., Sarraute, C. (2010). Attack planning in the real world. In 2nd Workshop on Intelligent Security (SecArt). https://arxiv.org/abs/1306.4044
Sarraute, C., Buffet, O., Hoffmann J. (2011). Penetration testing == POMDP solving? In 3rd Workshop on Intelligent Security (SecArt'11). https://arxiv.org/abs/1306.4714
Sarraute, C., Buffet, O., Hoffmann, J. (2012). POMDPs make better hackers: Accounting for uncertainty in penetration testing. In 26th AAAI Conference on Artificial Intelligence (AAAI’12). https://arxiv.org/abs/1307.8182
Shmaryahu, D., Shani, G., Hoffmann, J. (2017). Partially observable contingent planning for penetration testing. In 1st Int Workshop on Artificial Intelligence in Security. Melbourne. https://cyber.bgu.ac.il/wp-content/uploads/2017/10/IWAISe-17_paper_8-ds.pdf
Zhou, T., Zang, Y., Zhu, J. & Wang, Q. (2019). NIG-AP: a new method for automated penetration testing. Frontiers of Information Technology & Electronic Engineering. https://doi.org/10.1631/FITEE.1800532
Kyrychok, R., Zinchenko, О., Sribna, І., Marchenko, V., Kitura, О. (2021). Improved method of automatic active analysis of corporate network security. Ukrainian Information Security Research Journal, 23(2), 83-89. https://doi.org/10.18372/2410-7840.23.15725
Vulnerability & Exploit Database. Rapid7. https://www.rapid7.com/db/
Zak, Yu. (2013). Decision making in conditions of fuzzy and blurry data: Fuzzy technologies. Book House "LIBROKOM".
Kyrychok, R., Shuklin, G. (2020). Methodology for analysing the quality of the vulnerability validation mechanism in the corporate networks. Telecommunication and information technologies. 2(67). 29-40. https://doi.org/10.31673/2412-4338.2020.022930
Orlovsky, S. (1981). Decision-making problems with fuzzy initial information. The science.
Pospelov, D. (1986). Fuzzy Sets in Management and Artificial Intelligence Models. The science.
