Hierarchical Modeling of Cyber Assets in Kill Chain Attack
Graphs

D 2024

Hierarchical Modeling of Cyber Assets in Kill Chain Attack Graphs

SADLEK, Lukáš; Martin HUSÁK a Pavel ČELEDA

Základní údaje

Originální název

Hierarchical Modeling of Cyber Assets in Kill Chain Attack Graphs

Autoři

SADLEK, Lukáš; Martin HUSÁK a Pavel ČELEDA

Vydání

New York, NY, 2024 20th International Conference on Network and Service Management (CNSM), od s. 1-5, 5 s. 2024

Nakladatel

IFIP Open Digital Library, IEEE Xplore

Další údaje

Jazyk

angličtina

Typ výsledku

Stať ve sborníku

Obor

10200 1.2 Computer and information sciences

Utajení

není předmětem státního či obchodního tajemství

Forma vydání

elektronická verze "online"

Odkazy

URL, URL

Označené pro přenos do RIV

Ano

Kód RIV

RIV/00216224:14610/24:00137295

Organizační jednotka

Ústav výpočetní techniky

ISBN

978-3-903176-66-9

ISSN

Klíčová slova anglicky

attack graph;kill chain;cyber threat scenario;MITRE ATT&CK;MITRE D3FEND

Štítky

core_B, firank_B, rivok

Příznaky

Mezinárodní význam, Recenzováno

Změněno: 4. 4. 2025 13:11, Mgr. Eva Špillingová

Anotace

V originále

Cyber threat modeling is a proactive method for identifying possible cyber attacks on network infrastructure that has a wide range of applications in security assessment, risk analysis, and threat exposure management. Popular modeling methods are kill chains and attack graphs. Kill chains divide attacks into phases, and attack graphs depict attack paths. A difficult issue is how to hierarchically model categories of cyber assets that should be used in threat models due to the variety of cyber systems in the current networks. This task should be addressed to provide automation of realistic threat modeling and interoperability with public knowledge bases, such as MITRE ATT&CK. In this paper, we propose a hierarchical modeling methodology for representing cyber assets in kill chain attack graphs. We illustrate its practical application on MITRE D3FEND’s Digital Artifact Ontology. Moreover, we define how cyber assets with related attack techniques should be transformed into logical facts and attack rules. We implemented proof-of-concept software modules that can process data obtained from network and host-based monitoring together with attack rules to generate attack graphs. We evaluated the approach with data from a cyber exercise captured in a network of a digital twin organization. The results show that the approach is applicable in real-world networks and can reveal ground-truth attacks.

Přiložené soubory

2024_CNSM_Hierarchical_Modeling_of_Cyber_Assets_KCAGs_paper.pdf Verze souboru

2024_CNSM_Hierarchical_Modeling_of_Cyber_Assets_KCAGs_poster.pdf

Citovat

SADLEK, Lukáš; Martin HUSÁK a Pavel ČELEDA. Hierarchical Modeling of Cyber Assets in Kill Chain Attack Graphs. Online. In Varga, P; Celeda, P; Wauters, T; Tortonesi, M; Francois, J; Jimenez, JG. 2024 20th International Conference on Network and Service Management (CNSM). New York, NY: IFIP Open Digital Library, IEEE Xplore, 2024, s. 1-5. ISBN 978-3-903176-66-9. Dostupné z: https://doi.org/10.23919/CNSM62983.2024.10814501.

@inproceedings{2441297,
   author = {Sadlek, Lukáš and Husák, Martin and Čeleda, Pavel},
   address = {New York, NY},
   booktitle = {2024 20th International Conference on Network and Service Management (CNSM)},
   doi = {https://doi.org/10.23919/CNSM62983.2024.10814501},
   editor = {Varga, P; Celeda, P; Wauters, T; Tortonesi, M; Francois, J; Jimenez, JG},
   keywords = {attack graph;kill chain;cyber threat scenario;MITRE ATT&CK;MITRE D3FEND},
   howpublished = {elektronická verze "online"},
   language = {eng},
   location = {New York, NY},
   isbn = {978-3-903176-66-9},
   pages = {1-5},
   publisher = {IFIP Open Digital Library, IEEE Xplore},
   title = {Hierarchical Modeling of Cyber Assets in Kill Chain Attack Graphs},
   url = {https://ieeexplore.ieee.org/abstract/document/10814501},
   year = {2024}
}

TY  - CONF
ID  - 2441297
AU  - Sadlek, Lukáš - Husák, Martin - Čeleda, Pavel
PY  - 2024
TI  - Hierarchical Modeling of Cyber Assets in Kill Chain Attack Graphs
PB  - IFIP Open Digital Library, IEEE Xplore
CY  - New York, NY
SN  - 9783903176669
KW  - attack graph;kill chain;cyber threat scenario;MITRE ATT&CK;MITRE D3FEND
UR  - https://ieeexplore.ieee.org/abstract/document/10814501
N2  - Cyber threat modeling is a proactive method for identifying possible cyber attacks on network infrastructure that has a wide range of applications in security assessment, risk analysis, and threat exposure management. Popular modeling methods are kill chains and attack graphs. Kill chains divide attacks into phases, and attack graphs depict attack paths. A difficult issue is how to hierarchically model categories of cyber assets that should be used in threat models due to the variety of cyber systems in the current networks. This task should be addressed to provide automation of realistic threat modeling and interoperability with public knowledge bases, such as MITRE ATT&CK. In this paper, we propose a hierarchical modeling methodology for representing cyber assets in kill chain attack graphs. We illustrate its practical application on MITRE D3FEND’s Digital Artifact Ontology. Moreover, we define how cyber assets with related attack techniques should be transformed into logical facts and attack rules. We implemented proof-of-concept software modules that can process data obtained from network and host-based monitoring together with attack rules to generate attack graphs. We evaluated the approach with data from a cyber exercise captured in a network of a digital twin organization. The results show that the approach is applicable in real-world networks and can reveal ground-truth attacks.
ER  -

SADLEK, Lukáš; Martin HUSÁK a Pavel ČELEDA. Hierarchical Modeling of Cyber Assets in Kill Chain Attack Graphs. Online. In Varga, P; Celeda, P; Wauters, T; Tortonesi, M; Francois, J; Jimenez, JG. \textit{2024 20th International Conference on Network and Service Management (CNSM)}. New York, NY: IFIP Open Digital Library, IEEE Xplore, 2024, s.~1-5. ISBN~978-3-903176-66-9. Dostupné z: https://doi.org/10.23919/CNSM62983.2024.10814501.

Přehled o publikaci