Download ppt - Taxonomies of Attacks and Vulnerabilities in Computer Systems

Taxonomies of Attacks and Vulnerabilities in Computer Systems

Igure, V.M.; Williams, R.D.

IEEE Communications Surveys & Tutorials, Volume: 10 Issue: 1 (2008)

R96725034 林昕彥R96725036 陳政彥

Why do we need taxonomy?

• Their main goal was to organize information about known vulnerabilities or attacks, so that designers could use that information to build more secure systems or defense systems

• If the classification is based on the actual vulnerability exploited by the attack, the dimension of classification can be considered as the cause of flaw

• The taxonomy provides useful information to find unknown vulnerabilities as well as to avoid introducing similar vulnerabilities in future designs.

• They provide a classification of testing techniques based on the vulnerability the test is meant to discover. Each test class discovers all the vulnerabilities that have similar characteristics

Attack sophistication vs. intruder technical knowledge

INTRODUCTION

Introduction

• Security assessment of a system is the process of determining the system’s capability to resist attacks

• This process typically involves probing the system to detect the presence of known vulnerabilities – most attacks typically exploit known vulnerabilities

• This process is limited because it only searches for known vulnerabilities

• Security assessment is an objective process only as long as it is limited to searching for known weaknesses

• Probing a system to detect previously unidentified flaws is still a very subjective process

Introduction

• Prior work has attempted to gain an understanding of the characteristics and nature of known vulnerabilities to support the prediction of vulnerabilities in new systems

• The first step in understanding vulnerabilities is to classify them into a taxonomy based on their characteristics– A taxonomy classifies the large number of vulnerabilities into a few

well defined and easily understood categories– Such classification can serve as a guiding framework for performing a

systematic security assessment of a system

• This article provides a state-of-the-art survey of existing security related taxonomies

• The survey covers papers published between 1974 and 2006

TAXONOMIES AND SECURITY ASSESSMENT

Taxonomies and Security Assessment

• A taxonomy is formally defined as “the study of the general principles of scientific classification”

• This classification is done according to the relationships between the characteristics of the objects

• A good taxonomy also provides a common language for the study of the field

Taxonomies and Security Assessment

• taxonomies of vulnerabilities and attacks might be useful in the security assessment process– can also be useful for system designers– can also provide a way to explore unknown attacks

• Many taxonomies of attacks and vulnerabilities have been published over the years, but there is still no standard or universally accepted taxonomy

• Our primary interest is in the development and use of attack and vulnerability taxonomies in the security assessment process

ATTACK TAXONOMIES

Attacks Goals Dimension of taxonomy

Comments

Types of Computer Crimes (Perry & Wallich 1984)

Listing main types of crimes Two-dimensional matrix: crime vs. users committing the crime

Common characteristics: source of attack

Replay Attacks in Crypto-Protocols (Syverson 1994)

“consider which detection, representation, or preventionmechanisms are appropriate for a replayattack”

Source of attack is the primary dimensionof classification

Common characteristic: source of attack

Types of Misuse (Brinkley& Schell 1995)

Listing of types of misuse; Not intended to be a taxonomy

Two-level hierarchy; classes are notproperly defined

Provides overview of types of misuse

IDS Attack Signatures(Kumar 1995)

Classified attack signatures to develop comprehensivedatabase for an IDS

Based on manifestation of attacks innetwork traffic and logs

Applied in IDS development

Types of Misuse(Attacks) (Lindquist &Jonsson 1997)

“Makes systematic study possible” “useful forreporting incidents to response teams” “included agrading of the severity”

Extended Neumann and Parker’s taxonomy

Discuss usefulness of selecting agood dimension of classification


Comments

Attacks AgainstInformation Systems(Cohen 1997)

“Putting all of the methods of attack into a classificationscheme and co-locating them with each other so that knowledgeable experts can … consider… possible attacks”

No classification, just a long list ofknown attacks

An exhaustive list of attacks is static and needs to be constantlyupdated to keep it relevant

Attacks (Lough 2001)

Develop a taxonomy of attacks in wireless networks

Distilled the classes discussed in priorwork on taxonomies into four common categories

The categories are similar to thebasic security properties

Attacks against MobileAgents (Man, Wei 2001)

“Used in the analysis of existing protectionschemes … useful for research developments”

Hierarchical taxonomy:1. Intention2. Number of attackers3. Read vs. non-read

Classification is not based oncharacteristics of attack

DoS Attacks in WSNs(Wood, Stankovic 2002)

Highlight the various threats faced by WSNs

Attacks classified under the various networklayers of the communication protocol

Dimension is similar to locationof flaws

Sybil Attacks in WSNs(Newsome et al. 2004)

“To better understand the implications of the Sybilattack and how to defend against it”

Multidimensional:1. Mode of communication2. Type of identity3. Simultaneity

Underscores the need for a taxonomyto study a new field


Comments

DoS Attacks (Hussain etal. 2003)

“Provide the classification component of a realtimeattack analysis to aid network administrators”

Source of attack: single source vs. multiplesources

Taxonomy can be used todevelop tools for real-timedefense

Web Attacks (Alvarez,Petrovic 2003)

“Help designers … build more secure application… a useful reference framework for security application”

Multidimensional taxonomy based on a“Web attack life cycle”

Common classification types:vulnerability; service; target

Attacks: Defense centric(Killourhy et al. 2004)

“Organizes attacks by virtue of the way they manifestas anomalies in sensor data”

Anomaly seen in sensor data; four categories

Mostly relevant only in IDS; lowlevelcategories

DDoS Attack andDefense Mechanisms(Mirkovic, Reiher 2004)

“Structure the DDoS field and facilitate a globalview of the problem and solution space”

Eight characteristics of an attack; threecharacteristics of defenses

Common characteristic: exploitedweakness; impact on victim;type of victim

Internet Attacks(Mostow, Bott 2000);(Delooze — 2004)

Build an attack simulator; Taxonomy was used inthe simulator model

Effects of the attack Common characteristic: DoS,Deception, Reconnaissance,Unauthorized access


Comments

Attacks in VANETS (Golleet al. — 2004)

Taxonomy was not the main aim

1. Nature2. Target3. Scope4. Impact

Common characteristic natureof attack; impact on victim;scope; target;

Shellcode Attacks (Arce2004)

“Understanding these programs’ technical capabilitiesand their connection to those who developand use them”

Functional perspective:1. Attack vector2. Exploitation technique3. Payload

Multiple ways to trigger a vulnerability

Attacks (Hansman, Hunt— 2005)

Develop a “pragmatic taxonomy that is useful tothose dealing with attacks on a regular basis.”

Four taxonomies based on:1. Attack vector2. Attack target3. Vulnerability4. Payload

For application-specifictaxonomies, it might be possibleto combine all these intoone taxonomy

Types of Computer Crimes [17]

• Two-dimensional matrix of computer attacks• First dimension: Users

– Operators, programmers, data entry, internal users, outside users, and intruders

• Second dimension: Computer crimes– Physical destruction, information destruction, data diddling, theft of

services, browsing, and theft of information

The six classes of users are not distinct

The six classes of users are not distinct

Types of Computer Misuse [18]• Level One:

– Theft of computer resources– Disruption of computer resources– Unauthorized disclosure of information– Unauthorized modification of information

• Level Two:– Human error– User abuse of authority– Direct probing– Probing with malicious software– Direct penetration– Subversion of security mechanism

Information System Attacks [19]

• First attempts at developing a taxonomy to help the security assessment process– put all possible attacks under a single taxonomy– could be used to predict future attacks in existing systems

• The biggest drawback of [19] is that it is not a classification– It is merely a long list of all known attacks

• The article lists 94 different attacks on information systems

Computer Attack [24]• In [24] Neumann identified 26 different kinds of computer

attacks and classified them into nine categories:– External– Hardware misuse– Masquerading– Pest programs– Bypasses– Active misuse– Passive misuse– Inactive misuse– Indirect misuse

• This can be considered a hierarchical taxonomy because it has two levels of classification

Classify Computer Security Intrusions [7]

• Lindquist and Jonsson’s taxonomy [7, 26] is a very good example of one that is suitable for a security assessment process– the first to introduce the notion of dimension of classification

• they extended three of Neumann and Parker’s categories into multiple subdivisions:– Bypass of intended controls– Active misuse of resources– Passive misuse of resources

IDS Related Taxonomies

• Two main types of IDSs:– Signature-based system– Anomaly-based system

• The primary motivation for this classification was to provide a defense-centric taxonomy to help network defenders

Signature-based system

• Every attack manifests itself as some kind of event or sequence of events in a network– These unique events are called the signatures of the attack

• Every known attack is given a signature based on its characteristics

• Attack taxonomy can ensure that all known attacks are represented in the database

Signature-based system

• In [27] Kumar presents a taxonomy signatures to help build an effective IDS– Attack signatures are classified into five categories:

• Existence• Sequence• Partial order• Duration• Interval

Anomaly-based system

• Looking for any network activity that deviates from the norm• Killourhy et al. [28] developed a taxonomy of attacks based on

their manifestation as anomalies in IDS sensor data– Every attack manifests itself either as a:

• Foreign symbol• Minimal foreign sequence• Dormant sequence• Non-anomalous sequence

DoS Attack Related Taxonomies

• Attacker can carry out a successful attack without penetrating the target network

• In [29] Neumann lists three types of DoS attacks based on the source of the attack– no network penetration and can be carried out remotely over the

Internet– attacker exploits some known vulnerability to penetrate the network

and then carries out resource exhaustion attacks– distributed DoS (DDoS) attacks, attackers penetrate or compromise

many third party computers and use them to launch a DoS attack against the target network

DoS Attack Related Taxonomies• Mirkovic and Reiher [8] intended to build a taxonomy that

would provide a complete overview of the field of DDoS attacks and defenses

• Each attack has multiple characteristics, and Mirkovic and Reiher classify attacks along multiple dimensions– This classification is not mutually exclusive

• Eight dimensions:– Degree of automation– Exploited weakness– Source address validity– Attack rate dynamics– Possibility of characterization (based on packet content)– Persistence of agent set– Victim type– Impact on the victim

DoS Attack Related Taxonomies

• In [35] Campbell uses a novel dance metaphor to characterize DoS attacks– He characterizes a DoS attacker as a third person interrupting two

dancing partners

• He groups all DoS attacks under four classes that represent the attacker’s strategy for success:– Partner -> spoofing– Flood -> flooding– Trip -> shutting down– Intervene -> interception

Web Attack Taxonomies• Alvarez and Petrovic [34] analyzed and classified Web attacks,

their goal was to extract useful information for application developers to build more secure systems

Specialized Attack Taxonomies

• There are many attack taxonomies that cover only certain specific applications

• Man and Wei [42] developed a taxonomy of attacks against mobile agents– The goal of the work was to understand all possible attacks against

mobile agents and then use this understanding to develop appropriate protection mechanisms

• The first level of classification in [42] divides attacks into two categories based on the intentions of the attack– hierarchical, and this characteristic is useful for security assessment

Taxonomies for Security Assessment

• Lough presents an exhaustive survey of computer attack and vulnerability taxonomies in [15]

• Classifies all attacks under four categories:– Incorrect validation– Incorrect exposure– Incorrect randomness– Incorrect deallocation

• This classification is made on the cause of attack dimension• Lough’s taxonomy is not application-specific

Taxonomies for Security Assessment

• In [25] Hansman and Hunt aim to develop a “pragmatic taxonomy that is useful to those dealing with attacks on a regular basis.”

• They conclude that it is difficult to develop an effective tree-structure taxonomy of attacks

• Four dimension:– Attack vector– Attack target– Vulnerabilities and exploits– Attacks with payloads

• If the taxonomy were application-specific instead of trying to incorporate all possible kinds of attacks, it might not be very difficult to develop a single tree-structure taxonomy of attacks

VULNERABILITY TAXONOMIES

Vulnerability Taxonomy• One of the earliest works on this topic was done by McPhee.

• McPhee’s paper was published in 1974, and since then there has been much research done on computer security.

• McPhee lists seven class of integrity flaws in operating systems:

System data in user area

Non-unique identification of system resource

System violation of storage protection

User data passed as system data

User-supplied address of protected control blocks

Concurrent use of serial resources

Uncontrolled sensitive system resource

Vulnerability Taxonomy

• Attanasio described the methodology and results of penetration testing experiments.

• The penetration analysts had three goals:

• The paper does not provide a taxonomy, as that was not their goal, but it makes the important contribution of listing operations system characteristics that are likely to have flaws.

To obtain information to which they were not entitled

To launch a DoS attack by exhausting resources

To obtain resources bypassing the accountability mechanisms


• After the penetration testing experiment, Attanasio et al. Listed 16 OS features that are likely to have flaws:

Implicit or explicit resource sharing mechanisms

Man-machine interfaces administered by the OS

Configuration management problem

Add-on features

Design modifications and design extensions

Parameter checking

Control of security descriptors


Error handling

Side effects

Parallelism

Access to microprogramming

Complex interfaces

Duplication of function

Limits and prohibitions

Access to residual information

Violation of design principles

TAXONOMY OF SOFTWARE PROGRAM FLAWS

Taxonomy of Software Program Flaws

• The Research in Secured Operating Systems (RISOS) project and the Protection Analysis (PA) project were two of the earliest efforts at producing taxonomies of vulnerabilities in computer software.

• Both of the projects examined the vulnerabilities in different operating systems.


• The seven classes of vulnerabilities in the RISOS project were:

Incomplete parameter validation

Inconsistent parameter validation

Implicit sharing of privileged/confidential data

Inadequate identification

Authentication or authorization

Asynchronous validation or inadequate serialization

Violable prohibition or limiting and exploitable logic error


• The ten classes from the PA project were:

Consistency of data over time

Validation of operands

Validation of residuals

Validation of naming

Validation of domain

Serialization

Interrupted atomic operations

Exposed misrepresentations

Queue management dependencies

Critical operator selection error


• The categories of both the RISOS and PA classifications indicate that the dimension of classification was by operations.

• This means that the categories represent operations of the OS which can be misused to cause attacks.

• The RISOS and PA categories would be greatly beneficial in a larger taxonomy.


• Bishop analyzed the RISOS and PA taxonomies, and showed that these classes could be mapped onto each other.

• Bishop classified each vulnerability along six axes:

Nature of the flaw

Time of introduction

Exploitation domain of the vulnerability

The effect domain

The minimum number of components needed to exploit the vulnerability

The source of the identification of the vulnerability


• After the PA project, the most influential work on taxonomies of flaws was done by Landwehr et al.

• They did not limit their taxonomy to operating systems but provided a more general taxonomy of flaws in computer programs.

• They classified their flaws in three different dimensions:– Genesis– Time of introduction– location


• Jiwnani et al. used Landwehr’s taxonomy to aid security testing.

• They adapted Landwehr’s three dimensions to build a matrix that related the cause of the vulnerability.

• To be effective, the taxonomy must be used in conjunction with all the dimensions of the classification.

• The assessment process can be more systematic if these dimensions are arranged hierarchically.


• All the work we have seen so far classified attacks or vulnerabilities based on some inherent characteristic of the attack or vulnerability itself.

• Krsul departed from this norm.

• He developed a taxonomy based on the observation that most of the vulnerabilities were introduced into programs because of mistaken assumptions by the programmer.

• He classified flaws according to the assumption that led to their introduction into the software.


• Aslam focused only on the UNIX operating system.

• Aslam’s taxonomy is hierarchical, and the first level had three main categories:– Configuration flaws– Environment flaws– Coding flaws

• The dimension of classification for these three classes is the cause of the flaw.


• Du and Mathur described each flaw with multiple attributes. They classify flaws along three axes:– Cause – Impact– Fix

• Landwehr’s original genesis class had two main subclasses: intentional and inadvertent flaws.

• Du and Mathur ignore the intentional flaws. Instead, they focused on the inadvertent flaws in the software.

• Since the taxonomy provides details about the flaws, it could be effective in a security assessment process.


• Kamara et al. successfully use Du and Mathur’s taxonomy for analyzing vulnerabilities in Internet firewalls.

• They break down a firewall into its constituent components, and its operations and data flow.

• They analyze some of the well-known firewall vulnerabilities, and map them to both Du and Mathur’s taxonomy and the specific operations and parts of the firewalls.

• The result is a matrix that identifies which operations and parts of a firewall are likely to produce flaws.

• This is very useful in future security assessments of other firewalls as well as in preventing the same kinds of flaws in new products.


• Gray’s aim was to develop a taxonomy of vulnerabilities that would be useful to people in various positions in a software development organization.

• Gray combined the work of Landwehr, Bishop, and Wang into an extended and multi-perspective taxonomy.


• The taxonomy had ten classes of program flaws:

Genesis

Time of introduction

Location

Execution environment

Quality impact

Method of discovery

Thread and exploitation scenarios

Monitoring and exploitation scenarios

Limitation and remediation scenarios

Elimination methods


• Gray’s approach of combining all the perspectives within one taxonomy is not very efficient.

• Gray does not offer any subclasses for any of these classes.

• Such a single-level taxonomy does not provide adequate information about the flaws.

• This ineffectiveness shows that taxonomies are most useful when they are developed for a particular application from a specific perspective.


• Tsipenyuk et al. seek to simplify the existing software vulnerabilities taxonomies.

• They claim that most of the existing taxonomies are too complex.


• In order to help software developers and security practitioners, they group all software security flaws under eight classes:

Input validation and representation

API abuse security features time and state

Errors

Code quality

Encapsulation

Environment


• Yu et al. provide a framework for analyzing the security of Web software service.

• The unique contribution is that they relate all the attacks with the software vulnerabilities each attack exploits.


• Yongzheng and Xiochen develop a taxonomy of vulnerabilities to aid the security risk assessment process.

• They base on the concept of “privilege sets” and “privilege escalation.”

• A vulnerability can be viewed as a feature that gives additional privileges to the attacker.

• The paper ranks the privilege sets of nine user classes, ranging from common user to root.

• The paper provides a ranking of the impacts of each privilege level, with the root level causing the greatest damage and the user level causing the least.


• Wang’s work also explored the link between a flaw and the risk posed by that flaw.

• A flaw that could be exploited in multiple ways can be considered more risky.– Than one that can be exploited only in one way.


• Alhazmi et al. test the efficacy of vulnerability discovery models to predict the number of vulnerabilities in a software product.

• Having a target number of vulnerabilities could help the security analyst, but traditional taxonomy–based classifications would have to be used to find the actual vulnerabilities.

NETWORK VULNERABILITY TAXONOMIES

Network Vulnerability Taxonomies

• Ristenbatt describes a methodology name Network Communications Vulnerability Assessment (NCVA)– which was developed to perform network

vulnerability assessment.

• The first taxonomy classified the various types of networks according to their design.


• The objective of this taxonomy was to provide the analyst with a high-level overview of the network. The top-level categories were:

The transfer strategy

The network transfer control method

The transfer link structure

Link access method or protocol

System topology architecture


• The second taxonomy outlined the typical network susceptibilities.

• He defines susceptibilities as system features that might be targeted by attackers. Susceptibilities are potential vulnerabilities.

• The network susceptibilities taxonomy has five classes:Topology

Physical layer

Data link layer

Network layer

Management and control


• Jayaram and Morse provide a taxonomy of security threats to networks. Their taxonomy has five categories:

Physical threats

System weak spots

Malign problems

Access rights

Communication-based threats


• A more elaborate taxonomy of threats to networks is provided by Welch and Lathrop.

• The taxonomy was developed to build a security architecture for a wireless network.

• The taxonomy is hierarchical and provides a systematic approach for analyzing al the security threats faced by a network.

• They begin by considering threats to each of the basic security properties: confidentiality and integrity.


• The taxonomy lists seven attacks that pose a threat to security properties:

Traffic analysis

Passive eavesdropping

Active eavesdropping

Unauthorized access

Man-in-the-middle

Session highjacking

Replay attacks


• Pothamsetty and Akyol made an effort at producing a taxonomy of network protocol vulnerabilities.

• Their main goal was to organize information about known vulnerabilities.

• They classify the vulnerabilities into seven categories:

Clear text communication

Non-robust protocol message parsing

Insecure protocol state handling

Inability to handle abnormal packet rates

Replay and reuse

Protocol field authentication

Entropy problems

PROPERTIES OF A TAXONOMY FOR SECURITY ASSESSMENT

Properties of a Taxonomy for Security Assessment

• The goal is to identify a set of characteristics for a very specific taxonomy: one that can be used effectively in a security assessment process.

• The taxonomy must be tailored to the viewpoint of an assessment professional. It should also help make the process as objective as possible.

• The basic properties of such a taxonomy would be:

Application- or system-specific taxonomy

Taxonomy must be layered or hierarchical

First level of classification – attack impact

Second level of classification – system-specific attack types

Third level of classification – system components (attack targets)

Fourth level of classification – system features (source of vulnerability)

Classes need not be mutually exclusive

Properties of a Taxonomy for Security Assessment

• The efficacy of a security assessment process should be measured by its objectivity and vulnerability coverage.

• A process with good vulnerability coverage explores all relevant system features that are likely to have vulnerabilities.

• Although there are no metrics for measuring objectivity and vulnerability coverage, we believe that a taxonomy with the above properties greatly aids a security assessment process.

Conclusion

• This article presents a survey of all taxonomies related to computer and network security.

• The survey analyzes existing work on security taxonomies and assess their usefulness in terms of security assessment.

• The analysis helps identify specific properties of taxonomies that aid security assessment.