Vulnerability Take Grant (VTG): An efficient approach to analyze network vulnerabilities

Abstract

Modeling and analyzing information system vulnerabilities help predict possible attacks to computer networks using vulnerabilities information and the network configuration. In this paper, we propose a comprehensive approach to analyze network vulnerabilities in order to answer the safety problem focusing on vulnerabilities. The approach which is called Vulnerability Take Grant (VTG) is a graph-based model consists of subject/objects as nodes and rights/relations as edges to represent the system protection state. Each node may have properties including single vulnerabilities such as buffer overflow. We use the new concept of vulnerability rewriting rule to specify the requirements and consequences of exploiting vulnerabilities. Analysis of the model is achieved using our bounded polynomial algorithm, which generates the most permissive graph in order to verify whether a subject can obtain an access right over an object. The algorithm also finds the likely attack scenarios. Applicability of the approach is investigated by modeling widespread vulnerabilities in their general patterns. A real network is modeled as a case study in order to examine how an attacker can gain unauthorized access via exploiting the chain of vulnerabilities. Our experience shows the efficiency, applicability, and expressiveness in modeling a broader range of vulnerabilities in our approach in comparison to the previous approaches.

Introduction

The goal of vulnerability analysis in computer and network systems is to analyze vulnerabilities' dependencies to find the attack scenarios before malicious attackers find them. Currently, several tools exist which analyze the single host vulnerabilities in isolation. However, protecting networks against attacks requires considering all network vulnerabilities; vulnerabilities inter-dependencies; and the dependency among services.

Considering individually, a service may provide an acceptable level of security, but a combination of such services may lead to subtle attack scenarios. For example, the file transfer protocol (ftp) and the hypertext transfer protocol (http), provided simultaneously in the same host, may permit an attacker to write into a web directory using ftp. This causes the web server to execute a program written by the attacker. Accordingly, a comprehensive analysis of network vulnerabilities needs consideration of individual hosts as well as their relationships.

The complexity of analyzing network vulnerabilities increases extremely as the number of hosts and services increases. Manual handling of such complexity is very difficult or even impossible in the case of current enormous networks. Accordingly, automated approaches are necessary for vulnerability analysis.

Our vulnerability analysis problem is to determine whether an attacker can obtain unauthorized access to a particular resource. This is a specific form of the safety problem, which asks “Given an initial configuration of a protection system, can a subject s obtain some access right r over an object o?” (Shapiro, 2003). In other words, we focus on determining whether a set of known vulnerabilities allows a given subject to acquire some specific set of rights over an object representing a resource.

Based on the authors' knowledge, the previous literature has not explored the safety problem focusing on vulnerabilities. Approaches proposed in Zerkle and Levitt, 1996, Dacier and Deswarte, 1994, Ritchey and Ammann, 2001, Ramakrishnan and Sekar, 2002, Shahriari and Jalili, 2004, Noel et al., 2003, Noel et al., 2004, and Noel and Jajodia (2004) analyze network vulnerabilities from the point of view of the relations among individual hosts and network configurations. These approaches mainly use model checking and graph-based techniques to generate and analyze an attack graph; the task has been done in exponential time. In Ammann et al. (2002) and Noel et al. (2003), polynomial time approaches have been suggested for the same problem without any specific upper bound on polynomial degree.

In this paper, we propose a new access control based model to address the concept of vulnerabilities and their effects on the system protection state. The model has been motivated from the Take-Grant protection model; a graph-based access control model, where subjects and objects are considered as nodes of a graph, and access rights as well as administrative rights (Take and Grant) are considered as the edges (Jones et al., 1976). We also propose a framework to model vulnerabilities based on their pre-conditions and post-conditions as well as an algorithm to analyze the model with bounded polynomial time in the size of the protection system graph. The proposed algorithm can generate possible attack scenarios. The applicability of the framework has been shown through real examples of vulnerabilities. The examples cover a general form of widespread vulnerabilities such as buffer-overflow and cross-site scripting.

The remainder of this paper is organized as follows. In Section 2, we review previous works on the Take-Grant protection model and network vulnerability analysis. The outline of our proposed approach has been presented in Section 3. The detail of our approach has been presented in Section 4. Section 5 discusses the applicability of the approach through modeling broad types of vulnerabilities and their rewriting rules. Section 6 presents an algorithm to analyze the model in order to answer the safety problem considering vulnerabilities. Section 7 provides a real case study. The conclusion and future works have been presented in Section 8.