An Integrated Network Scanning Tool for Attack Graph Construction
Scanning is essential for gathering information about the actual state of computer systems or networks. Therefore, it is always taken as the first step of potential attacks against targets. In certain cases, scanning itself is categorized as an attack. Scanning can on the other hand be used for the right purposes, for example, checking the system configurations, verifying firewall rules, proofing security polices, as well as monitoring the large scale network environment. From this point of view, scanning is an effective method for system or network management, security measurement and auditing. To visualize, analyze, and finally evaluate the data gathered by scanners, Attack Graph plays an important role. High quality information about the target system or network is the prerequisite for constructing the attack graph. However, different implementations of scanners have different capabilities and always result in different kinds of outputs. These outputs are usually heterogeneous and not machine-readable, which makes the further analysis a challenging task. In this paper, we examine common types of scanners and demonstrate how to combine multiple types of scanners. The results of all the involved scanners are integrated into a well-designed and consistent data structure, which can not only be well interpreted by human security specialists but also be directly fed into an attack graph construction tool.
KeywordsVirtual Machine Scanning Technique Open Port Common Data Model Attack Graph
Unable to display preview. Download preview PDF.
- 1.Caceres, M.: Syscall Proxying - Simulating Remote Execution. Technical report, Core Security Technologies (2002)Google Scholar
- 2.Moore, H., Valsmith: Tactical Exploitation, Version 1.0.0. Technical report, Metasploit LLC (2007)Google Scholar
- 3.Bhatia, A., Lam, B., et al.: Automated Network Security Audit Tool (ANSAT). Technical report, University of Colorado at Boulder (2006)Google Scholar
- 5.Siamwalla, R., Sharma, R., Keshav, S.: Discovering Internet Topology. Technical report, Cornell University (1998)Google Scholar
- 7.Schneier, B.: Attack Trees - Modeling Security Threats. Dr. Dobb’s Journal 21, 21–29 (1999)Google Scholar
- 11.Arboi, M.: The NASL2 Reference Manual. Tenable Network Security (2005)Google Scholar
- 12.Cheikes, B.A., Waltermire, D.: Common Platform Enumeration: Naming Specification Version 2.3 (DRAFT). Technical Report The MITRE Corporation, National Institute of Standards and Technology, NIST (2010)Google Scholar