Generative Adversarial Networks (GANs) have been successfully used in a large number of domains. This paper proposes the use of GANs for generating network traffic in order to mimic other types of traffic. In particular, our method modifies the network behavior of a real malware in order to mimic the traffic of a legitimate application, and therefore avoid detection. By modifying the source code of a malware to receive parameters from a GAN, it was possible to adapt the behavior of its Command and Control (C2) channel to mimic the behavior of Facebook chat network traffic. In this way, it was possible to avoid the detection of new-generation Intrusion Prevention Systems that use machine learning and behavioral characteristics. A real-life scenario was successfully implemented using the Stratosphere behavioral IPS in a router, while the malware and the GAN were deployed in the local network of our laboratory, and the C2 server was deployed in the cloud. Results show that a GAN can successfully modify the traffic of a malware to make it undetectable. The modified malware also tested if it was being blocked and used this information as a feedback to the GAN. This work envisions the possibility of self-adapting malware and self-adapting IPS.

/pdf/bringing-a-gan-to-a-knife-fight-adapting-malware-fdhtjzx4fi.pdf

Bringing a GAN to a Knife-Fight: Adapting Malware Communication to Avoid Detection

Penetration testing (also known as pentesting or PT) is a common practice for actively assessing the defenses of a computer network by planning and executing all possible attacks to discover and exploit existing vulnerabilities. Current penetration testing methods are increasingly becoming non-standard, composite and resource-consuming despite the use of evolving tools. In this paper, we propose and evaluate an AI-based pentesting system which makes use of machine learning techniques, namely reinforcement learning (RL) to learn and reproduce average and complex pentesting activities. The proposed system is named Intelligent Automated Penetration Testing System (IAPTS) consisting of a module that integrates with industrial PT frameworks to enable them to capture information, learn from experience, and reproduce tests in future similar testing cases. IAPTS aims to save human resources while producing much-enhanced results in terms of time consumption, reliability and frequency of testing. IAPTS takes the approach of modeling PT environments and tasks as a partially observed Markov decision process (POMDP) problem which is solved by POMDP-solver. Although the scope of this paper is limited to network infrastructures PT planning and not the entire practice, the obtained results support the hypothesis that RL can enhance PT beyond the capabilities of any human PT expert in terms of time consumed, covered attacking vectors, accuracy and reliability of the outputs. In addition, this work tackles the complex problem of expertise capturing and re-use by allowing the IAPTS learning module to store and re-use PT policies in the same way that a human PT expert would learn but in a more efficient way.

Reinforcement learning for efficient network penetration testing

Enterprise systems are growing in complexity, and the adoption of cloud and mobile services has greatly increased the attack surface. To proactively address these security issues in enterprise systems, this paper proposes a threat modeling language for enterprise security based on the MITRE Enterprise ATTC by using available tools, the proposed language enables attack simulations on its system model instances. These simulations can be used to investigate security settings and architectural changes that might be implemented to secure the system more effectively. Our proposed language is tested with a number of unit and integration tests. This is visualized in the paper with two real cyber attacks modeled and simulated.

/pdf/cyber-security-threat-modeling-based-on-the-mitre-enterprise-3oo9u0sxxo.pdf

Cyber security threat modeling based on the MITRE Enterprise ATT&CK Matrix

A machine learning framework for investigating data breaches based on semantic analysis of adversary’s attack patterns in threat intelligence repositories

In recent years, there has been a growing demand for cybersecurity experts, and, according to predictions, this demand will continue to increase. Cyber Ranges can fill this gap by combining hands-on experience with educational courses, and conducting cybersecurity competitions. In this paper, we conduct a systematic survey of ten Cyber Ranges that were developed in the last decade, with a structured interview. The purpose of the interview is to find details about essential components, and especially the tools used to design, create, implement and operate a Cyber Range platform, and to present the findings.

Cyber Ranges and TestBeds for Education, Training, and Research

Red teams play a critical part in assessing the security of a network by actively probing it for weakness and vulnerabilities. Unlike penetration testing - which is typically focused on exploiting vulnerabilities - red teams assess the entire state of a network by emulating real adversaries, including their techniques, tactics, procedures, and goals. Unfortunately, deploying red teams is prohibitive: cost, repeatability, and expertise all make it difficult to consistently employ red team tests. We seek to solve this problem by creating a framework for automated red team emulation, focused on what the red team does post-compromise - i.e., after the perimeter has been breached. Here, our program acts as an automated and intelligent red team, actively moving through the target network to test for weaknesses and train defenders. At its core, our framework uses an automated planner designed to accurately reason about future plans in the face of the vast amount of uncertainty in red teaming scenarios. Our solution is custom-developed, built on a logical encoding of the cyber environment and adversary profiles, using techniques from classical planning, Markov decision processes, and Monte Carlo simulations. In this paper, we report on the development of our framework, focusing on our planning system. We have successfully validated our planner against other techniques via a custom simulation. Our tool itself has successfully been deployed to identify vulnerabilities and is currently used to train defending blue teams.

Intelligent, automated red team emulation

A network attack simulation method including, at a network with a server and a plurality of computers, selecting one or more actions from a plurality of actions for operating on a first computer of the plurality of computers, transmitting instructions from the server to the first computer to execute the one or more selected actions, executing the one or more selected actions on the first computer, and generating data based on the execution of the selected actions. The method includes transmitting the data generated from the first computer to the server, identifying a target computer of the plurality of computers to access, transmitting one or more additional instructions from the server to the first computer to access the target computer using at least a portion of the data, and receiving confirmation from at least one of the first computer and the target computer that the target computer was accessed.

Network attack simulation systems and methods

/pdf/automated-adversary-emulation-a-case-for-planning-and-acting-41x5sfrd6j.pdf

Automated Adversary Emulation: A Case for Planning and Acting with Unknowns

Adversary emulation offers a concrete way to measure a network's resilience against an advanced attacker. Unfortunately, adversary emulation is typically a manual process, making it costly and hard to employ. Progress in automated adversary emulation techniques has only been lightly validated, and technique dependence on network properties has not been quantified. In this paper, we describe a simulation testbed designed to model attackers operating within a Windows enterprise network. Running a series of tests, we found that strategies that use automated planning tend to outperform those that do not. Additionally, we found that detection frequency was the most significant factor in attacker performance, with network activity a close second; host connectivity, by contrast, was not particularly significant. We obtained similar results when the attacker mitigated risk, however in these scenarios we found that detection was less significant and vulnerability incidence more. These results can be used to inform future cyber simulation efforts.

Doug Miller

Papers

Intelligent, automated red team emulation

Network attack simulation systems and methods

Automated Adversary Emulation: A Case for Planning and Acting with Unknowns

Analysis of automated adversary emulation techniques