Session-level Adversary Intent-Driven Cyberattack Simulator

D 2020

Session-level Adversary Intent-Driven Cyberattack Simulator

DRAŠAR, Martin; Stephen MOSKAL; Shanchieh Jay YANG a Pavol ZAŤKO

Základní údaje

Originální název

Session-level Adversary Intent-Driven Cyberattack Simulator

Název česky

Simulátor kyberútoků řízený z pohledu útočníkova záměru

Autoři

DRAŠAR, Martin ; Stephen MOSKAL; Shanchieh Jay YANG a Pavol ZAŤKO

Vydání

Praha, DS-RT '20: Proceedings of the IEEE/ACM 24th International Symposium on Distributed Simulation and Real Time Applications, od s. 7-15, 9 s. 2020

Nakladatel

IEEE

Další údaje

Jazyk

angličtina

Typ výsledku

Stať ve sborníku

Obor

10201 Computer sciences, information science, bioinformatics

Stát vydavatele

Spojené státy

Utajení

není předmětem státního či obchodního tajemství

Forma vydání

elektronická verze "online"

Odkazy

URL

Označené pro přenos do RIV

Ano

Kód RIV

RIV/00216224:14610/20:00116424

Organizační jednotka

Ústav výpočetní techniky

ISBN

978-1-7281-7343-6

UT WoS

000628982300002

EID Scopus

2-s2.0-85094812273

Klíčová slova anglicky

discrete event simulation;adversarial behavior;cyberattack

Štítky

core_B, rivok

Příznaky

Mezinárodní význam, Recenzováno

Změněno: 27. 4. 2021 16:09, Mgr. Alena Mokrá

Anotace

V originále

Recognizing the need for proactive analysis of cyber adversary behavior, this paper presents a new event-driven simulation model and implementation to reveal the efforts needed by attackers who have various entry points into a network. Unlike previous models which focus on the impact of attackers' actions on the defender's infrastructure, this work focuses on the attackers' strategies and actions. By operating on a request-response session level, our model provides an abstraction of how the network infrastructure reacts to access credentials the adversary might have obtained through a variety of strategies. We present the current capabilities of the simulator by showing three variants of Bronze Butler APT on a network with different user access levels.

Návaznosti

EF16_019/0000822, projekt VaV

Název: Centrum excelence pro kyberkriminalitu, kyberbezpečnost a ochranu kritických informačních infrastruktur

Citovat

DRAŠAR, Martin; Stephen MOSKAL; Shanchieh Jay YANG a Pavol ZAŤKO. Session-level Adversary Intent-Driven Cyberattack Simulator. Online. In Dusan Maga, Jiri Haek. DS-RT '20: Proceedings of the IEEE/ACM 24th International Symposium on Distributed Simulation and Real Time Applications. Praha: IEEE, 2020, s. 7-15. ISBN 978-1-7281-7343-6.

@inproceedings{1679082,
   author = {Drašar, Martin and Moskal, Stephen and Yang, Shanchieh Jay and Zaťko, Pavol},
   address = {Praha},
   booktitle = {DS-RT '20: Proceedings of the IEEE/ACM 24th International Symposium on Distributed Simulation and Real Time Applications},
   editor = {Dusan Maga, Jiri Haek},
   keywords = {discrete event simulation;adversarial behavior;cyberattack},
   howpublished = {elektronická verze "online"},
   language = {eng},
   location = {Praha},
   isbn = {978-1-7281-7343-6},
   pages = {7-15},
   publisher = {IEEE},
   title = {Session-level Adversary Intent-Driven Cyberattack Simulator},
   url = {https://dl.acm.org/doi/abs/10.5555/3451906.3451908},
   year = {2020}
}

TY  - CONF
ID  - 1679082
AU  - Drašar, Martin - Moskal, Stephen - Yang, Shanchieh Jay - Zaťko, Pavol
PY  - 2020
TI  - Session-level Adversary Intent-Driven Cyberattack Simulator
PB  - IEEE
CY  - Praha
SN  - 9781728173436
KW  - discrete event simulation;adversarial behavior;cyberattack
UR  - https://dl.acm.org/doi/abs/10.5555/3451906.3451908
N2  - Recognizing the need for proactive analysis of cyber adversary behavior, this paper presents a new event-driven simulation model and implementation to reveal the efforts needed by attackers who have various entry points into a network. Unlike previous models which focus on the impact of attackers' actions on the defender's infrastructure, this work focuses on the attackers' strategies and actions. By operating on a request-response session level, our model provides an abstraction of how the network infrastructure reacts to access credentials the adversary might have obtained through a variety of strategies. We present the current capabilities of the simulator by showing three variants of Bronze Butler APT on a network with different user access levels.
ER  -

DRAŠAR, Martin; Stephen MOSKAL; Shanchieh Jay YANG a Pavol ZAŤKO. Session-level Adversary Intent-Driven Cyberattack Simulator. Online. In Dusan Maga, Jiri Haek. \textit{DS-RT '20: Proceedings of the IEEE/ACM 24th International Symposium on Distributed Simulation and Real Time Applications}. Praha: IEEE, 2020, s.~7-15. ISBN~978-1-7281-7343-6.

Přehled o publikaci