Vulnerability Modelling for the Analysis of Network Attacks

In order to perform a successful attack on a network, an intruder must know various penetration techniques, also known as exploits. In general, an exploit can be successful only if some pre-conditions are true. Such conditions may involve the presence of vulnerable programs and/or specific software configurations, as well as certain attacker privileges on hosts and network reachability. When an exploit has success, it usually induces a new set of conditions within the network (post-conditions), such as new attacker privileges, and increased connectivity. Therefore, a network attack can be made of a series of exploits that gradually increase the attacker "power" on the network, until some final goal has been reached or the whole network has been compromised. Reaching such a goal is possible because of dependencies among exploits in terms of pre- and post-conditions. This paper describes how the OVAL language, originally aimed at describing how to check for the existence of vulnerabilities on hosts, can be enhanced to allow automatic reasoning for precisely determining the possible chains of exploits that an attacker could use to compromise the hosts in the network. Moreover, the paper shows how the description of vulnerabilities can be enriched to allow performing risk analysis, so as to determine the impact of attackers on the network, as well as the likelihood of attacks.