WEBVTT 00:00.000 --> 00:03.380 Thanks everyone for attending my talk. 00:03.400 --> 00:10.880 So those of you who don't know me, I am a PhD candidate at Arizona State University. 00:11.180 --> 00:18.560 I am specializing in use of artificial intelligence and machine learning in the field of cybersecurity. 00:18.560 --> 00:22.200 I'm also a security consultant at Bishop Fox. 00:22.340 --> 00:31.620 I also authored a book known as Software Defined Virtual Network Security, dealing with security in software-defined systems. 00:31.840 --> 00:37.760 I'm also co-founder of DevilSec, which is the hacking club that we have at ASU. 00:37.760 --> 00:46.920 I've worked for BlackBerry and Public Services and Computer Sciences Corporation in the past, and this is my contact information. 00:46.980 --> 00:51.280 So let's dive into the overview of the talk. 00:51.280 --> 00:53.940 What is the motivation? 00:53.940 --> 00:58.180 What would be the overview of our system, ASAP? 00:58.260 --> 01:02.500 There are three main modules in the system. 01:02.500 --> 01:12.100 Stringer, which is used for the discovery of information, both services and vulnerability in the network. 01:12.100 --> 01:18.960 Americano, which is used for analysis of different paths an attacker can take in a network. 01:18.980 --> 01:25.180 And Cappuccino, which is our AI-based autonomous attack plan generator. 01:25.900 --> 01:36.260 And finally, we do the validation of these attack plans, and we will jump into the demo after the end of the presentation. 01:36.920 --> 01:40.880 So let's see what is machine learning. 01:40.880 --> 01:51.520 It's a statistical way of learning from the information present in your network, what kind of network traffic you have, the logs on your system. 01:51.520 --> 02:01.820 So using some pattern recognition to identify some attack patterns in a network, we use machine learning techniques for that. 02:01.820 --> 02:08.080 And it's already been used successfully in things like spam detection on your email. 02:08.080 --> 02:16.360 You don't get those Nigerian Prince emails these days because of amazing job done by spam detection systems. 02:17.080 --> 02:32.760 Artificial intelligence, on the other hand, it perceives the network traffic, what kind of activities are going on within the environment, and uses that information to take some decisions. 02:32.760 --> 02:39.560 So it basically acts on the information provided by different agents in the environment. 02:39.560 --> 02:58.100 You can think of smart ideas that we can design in a system, which basically collects information from different parts of the system, updates its beliefs, and then takes some intrusion prevention system measure. 02:58.100 --> 03:03.680 So that is something that we can take the help of AI in designing. 03:05.740 --> 03:14.180 AI and machine learning have found some useful applications in cyber security, both in industry and research. 03:14.180 --> 03:22.880 We use the attack patterns for detection to basically identify malicious actors within our network. 03:22.880 --> 03:29.080 And we try to see if the attacks are very stealthy in nature. 03:29.080 --> 03:36.860 There are attacks like advanced persistent threat, which are basically slow and low kind of attacks, which are hard to detect. 03:36.860 --> 03:41.020 They are carried over like multiple days. 03:41.620 --> 03:47.360 A good example is Sony hack, which was carried out over a period of several months. 03:47.380 --> 03:56.780 So identifying some valuable patterns from those kinds of attacks is some place where we can definitely utilize machine learning. 03:57.500 --> 04:38.360 And there are recent investigation in the use of AI to design deception based system, moving target defense and cyber deception in general are two ways or two fields of research that explore how to identify the attack patterns in a network and basically use that information to present a fake view of the network to an attacker and deceive him into honeypots where they can do further analysis of his attack intentions. 04:40.640 --> 04:45.120 So why do we need AI and machine learning in cybersecurity? 04:45.120 --> 04:56.000 And I did some background research and it's estimated that there will be 25 billion IoT devices in US by 2021. 04:56.000 --> 05:02.760 And the investment in cybersecurity will be up to a trillion dollars. 05:02.980 --> 05:10.580 With penetration testing, if we look at it, market size would be 3.2 billion US dollars. 05:10.580 --> 05:22.400 So the number of devices are growing perhaps at a quadratic scale, but we have a shortage of cybersecurity workforce. 05:22.400 --> 05:34.500 It's estimated that 65% of the organizations feel that their staff is not very well equipped in cybersecurity. 05:35.110 --> 05:49.160 And 36% of the organization reported that there is a lack of training or skills in existing cybersecurity workforce. 05:49.340 --> 05:55.470 So that is where we plan to use AI to kind of bridge this gap. 05:59.090 --> 06:13.020 So if you look at a very practical example of application of artificial intelligence, DARPA Cyber Grand Challenge was one place where AI was successfully applied. 06:13.020 --> 06:32.020 There were seven participating schools, seven or eight, who took part in a hacking competition where each school was trying to target the infrastructure of everybody else while keeping its own infrastructure secure. 06:32.040 --> 06:40.980 So the important catch was that all of these participants were AI, not AI, but autonomous systems. 06:40.980 --> 06:47.240 And there was no human involved in this competition. 06:47.240 --> 06:56.240 So Mayhem, which was a company based out of CMU, they automated what white hat hackers could do. 06:56.240 --> 07:02.380 So they found and exploited the weaknesses present in these system. 07:02.380 --> 07:09.080 What they did was they created a mathematical model of the paths that attacker can take. 07:09.080 --> 07:13.220 And then they used two techniques, symbolic execution and fuzzing. 07:13.220 --> 07:21.780 So symbolic execution was the way to point out interesting code paths. 07:21.780 --> 07:33.740 And fuzzing was kind of a hammer, which was hammering through those code paths to exploit the vulnerabilities pointed out using symbolic execution. 07:33.780 --> 07:44.440 And they won this championship and they managed to find 14,000 vulnerabilities on Debian system as well. 07:44.440 --> 07:47.060 And 250 of these vulnerabilities were new. 07:47.060 --> 07:54.940 So imagine a human attacker trying to do all this, it's kind of difficult. 07:54.940 --> 08:03.320 And this shows a successful motivation to use machine learning and AI in the field of cybersecurity. 08:04.520 --> 08:10.320 So if you look at our system, ASAP, there are four main modules. 08:10.320 --> 08:14.280 Stinger, which is, S stands for scanning. 08:14.280 --> 08:17.180 So we use Stinger for scanning and Recon. 08:18.060 --> 08:21.640 The information from Stinger is fed into Americano. 08:21.640 --> 08:23.940 So A stands for attack analysis. 08:23.940 --> 08:34.500 And we use this information from Americano to identify the attack states in the network. 08:34.500 --> 08:39.580 Latte, which is a module, L stands for log here. 08:39.580 --> 08:46.240 So it's a module which identifies network and host logs to gather the threat evidence. 08:46.240 --> 09:04.440 And Cappuccino, which is kind of the network controller, it takes all this information from Americano and Latte to encode in form of AI model, Markov decision process. 09:04.720 --> 09:19.720 And based on that model, it identifies some attack plans, like if a penetration tester were to test or attack this network, what kind of plan would yield him maximum output? 09:20.660 --> 09:33.780 And eventually we can execute these attack plans on a cloud or web application and update the risk score and attack graph, which is basically Americano. 09:35.760 --> 09:40.340 So I am addicted to caffeine. 09:40.340 --> 09:46.460 That is why I chose the name of these modules based on different kinds of coffee flavors. 09:47.360 --> 09:50.460 So let's dive deeper into Stinger. 09:50.460 --> 09:58.040 So Stinger basically scans the network topology for service information and discovers the vulnerability. 09:58.040 --> 10:08.060 So we have automated Nessus and OpenVS APIs to identify this attack information. 10:08.820 --> 10:15.000 And this attack information is then fed into Americano, which is attack graph generation tool. 10:16.540 --> 10:21.040 So let's look at one of the known vulnerabilities. 10:21.180 --> 10:30.980 This is a shell shock vulnerability, and there are different parameters from common vulnerability scoring system for this particular vulnerability. 10:30.980 --> 10:38.260 Like you need just a network access to execute this attack and it has a low access complexity. 10:38.260 --> 10:46.100 So you don't need to do a lot of investment as an attacker to exploit this vulnerability. 10:46.100 --> 10:59.820 So this is a example of kind of vulnerability where we can implement some sort of automation once we are able to identify this vulnerability. 11:01.440 --> 11:18.630 And the reason of providing this information is that we will see later that how we can use these CVSS parameters like access complexity and possibly CVSS score to encode the information in our AI solver. 11:20.270 --> 11:36.280 These are some other parameters like the impact on confidentiality, integrity and availability is very high and attacker can take full control of that system if he were to exploit this particular vulnerability. 11:37.380 --> 11:55.660 So let's take a look at a motivating example where attacker is located on internet and his goal is to reach this database server and exfiltrate the information out of database server to his command and control center. 11:55.660 --> 12:01.120 And there are some publicly known vulnerabilities on these machines. 12:03.640 --> 12:15.660 So basically attacker is trying to exfiltrate the information from database server but there is a firewall on his way so he cannot directly access this database server. 12:15.660 --> 12:31.160 So he either needs to go through the web server or wait for internal user to download some of his malicious code and use that as a pivot to go to the database server. 12:32.460 --> 12:37.120 And the web server is the only publicly available service in this network. 12:38.500 --> 12:55.540 So attacker can try to exploit the web server using unknown vulnerability or he can have some malicious script on a popular website that a user downloads and that way he can gain access into his workstation. 12:56.280 --> 13:12.420 And using this, he can then take advantage of the access control list which basically allows any network traffic from web server to go to database server or any workstation traffic to go to database server. 13:12.420 --> 13:32.300 And that way the attacker can exploit the SQL injection vulnerability that is present on the database server and then use it to gain persistent access to his command and control center. 13:33.220 --> 13:41.280 So you will see that there are two attack paths in this small network to achieve the same goal. 13:41.300 --> 13:55.380 So imagine a very giant network with tens of thousands of instances and you are asked to perform a penetration test for that network in a limited period of time. 13:55.720 --> 14:10.120 So you need some kind of autonomy or automation in that particular case to be able to have a good coverage in your penetration test. 14:12.400 --> 14:15.040 So we saw this example, but what about it? 14:15.040 --> 14:18.920 Like, how do we basically use this information? 14:19.000 --> 14:42.040 We can do some initial attack analysis based on this example and see that attack is multi-stage and attacker had specific attack vectors for this vulnerability and he went through multiple hosts and he circumvented some of the defenses that were present on the systems to achieve his goal of data exfiltration. 14:44.200 --> 14:55.560 So let's discuss on kind of a philosophical level why AI can be used to hack faster. 14:55.560 --> 15:19.920 So imagine you are going home on a particular day and you decide to take a turn on Arizona Avenue and Main Street and you have been taking this route forever to reach your home, but you encounter a traffic jam on the way. 15:21.480 --> 15:28.020 So you went by your intuition and this got you into a traffic jam. 15:28.020 --> 15:34.020 But if you had a GPS to help you navigate, you could have avoided that jam. 15:34.860 --> 15:48.040 So similarly, as penetration testers, when we try to go after certain vulnerabilities, we have kind of a preset methodology. 15:48.040 --> 15:52.640 So we will go through some authentication issues, authorization issues. 15:52.640 --> 15:57.140 We will see if we can use the user management in some way. 15:57.180 --> 16:02.580 We can try to see if we can get horizontal privilege escalation. 16:02.640 --> 16:05.000 We go after data stores. 16:05.380 --> 16:07.480 We go after application logic. 16:07.480 --> 16:23.940 If it involves the code review, we go through the procedure of code review and use all of that to see like what's the maximum we can get in this penetration test. 16:24.360 --> 16:27.560 But here is the challenge. 16:27.560 --> 16:53.920 Like if you have say 20 hours for a particular assessment, do you think on environment where you have to do pen test on application as well as the cloud part of the backend components, it's very challenging to get a good coverage in that scenario. 16:54.640 --> 17:06.300 So AI and machine learning can act as kind of navigator for us on these assessments. 17:06.300 --> 17:16.280 So we can think of ASAP as kind of AI based GPS to navigate the attack surface. 17:16.280 --> 17:34.820 And it may not work on all kind of unknown vulnerabilities like say data encryption issues, which you identify which is a vulnerability, but it can help us in semi-automating some of the tasks that we may miss out. 17:34.820 --> 17:50.520 So the worst thing would be that there is a very low complexity vulnerability that was present on the system, but you just ran out of time on your pen test and you couldn't exploit that vulnerability. 17:50.520 --> 17:54.360 And later the client finds out, hey, why did you miss it? 17:54.360 --> 17:57.300 So then you are in a tough situation. 17:57.540 --> 18:02.160 So that is another kind of motivation to develop this kind of a system. 18:03.900 --> 18:19.940 So with Americano, we get the information from Stinger and we use these vulnerabilities and software configuration to pass to a first order logic based framework. 18:20.160 --> 18:25.680 And that framework basically generates a multi-stage multi-hop attack graph. 18:25.680 --> 18:36.060 And attack graph basically shows that different paths an attacker can take in a network to be able to reach his desired goal. 18:37.980 --> 18:46.000 So if you look at the definition of attack graph, we have some nodes and edges which are a property of a given graph. 18:46.040 --> 18:49.080 There are some fact nodes, NF. 18:49.400 --> 18:57.800 Fact nodes will be something like the existence of vulnerability or the existence of network connections. 18:58.260 --> 19:11.260 And conjunct node are denoted by NC, the disjunct node are denoted by ND and root node, which is basically goal of attack is denoted by NR. 19:13.020 --> 19:24.380 So conjunct node can be something that you can achieve based on your initial exploitation of certain vulnerability. 19:24.380 --> 19:37.360 So you have some fact nodes that you combine with these interaction rules that we provide in first order logic to achieve some other conjunct nodes like exact code. 19:37.360 --> 19:46.060 So suppose there is a vulnerability buffer overflow on web server and the attacker can access the web server. 19:46.060 --> 19:53.120 So if attacker is located on internet, then that can lead to execution of code on web server. 19:54.640 --> 20:02.000 And based on that example, the root node in our case would be to gain a root privilege on database server. 20:04.290 --> 20:07.770 So there are two kinds of edges. 20:07.770 --> 20:15.670 E pre denotes the precondition edge and E post denotes the post condition edge. 20:15.870 --> 20:29.850 So a precondition edge basically combines the fact nodes and conjunct node to show that the next possible state that an attacker can achieve. 20:30.030 --> 20:37.310 And E post means the edges that are triggered if some preconditions are satisfied. 20:37.770 --> 20:45.530 And we have some base initial condition nodes in this attack graph that we can denote using NI. 20:48.900 --> 20:57.300 So to simplify this, we have some advisories that we identify based on the scanning of the network. 20:57.600 --> 21:02.740 We have host configuration information, we have network configuration information. 21:03.080 --> 21:10.040 The principle indicate like who has ownership on which machine. 21:10.600 --> 21:23.940 And we use interaction rules and policies to provide input to this attack graph with reasoning engine, which then generates attack graph for us. 21:27.040 --> 21:40.020 So before going any further, let's look at some information of these Mulwell rules. 21:40.020 --> 21:45.040 Mulwell is basically a reasoning system which encodes this information. 21:45.040 --> 21:54.100 And it's a work by University of Kansas, which we kind of used in our development of the ASAP system. 21:54.100 --> 22:08.500 So advisories show that what kind of vulnerability exists in the network, vulnerability property, host configuration shows that the web server has Apache software, it's running on port 80. 22:08.960 --> 22:10.720 This is the daemon. 22:10.780 --> 22:24.100 Network configuration is basically the access control list, which says that from internet to web server, there is a TCP connection that can be established on port 80. 22:25.360 --> 22:37.040 And principle show that a user has a user account on this PC and there is another system admin, which is kind of a root level account on the web server. 22:37.040 --> 22:50.020 So all these information we can obtain by scanning the network and by obtaining the host configuration information, the network rules. 22:51.060 --> 22:56.640 And then they go through these first order logic rules. 22:56.640 --> 23:19.260 So this is one of the rules, which says that if there is a vulnerability existing on host with vulnerability ID and the vulnerability has a property that it's a remote exploit, and there is a network service corresponding to this host and the attacker has a network access on this host and attacker is malicious, 23:19.680 --> 23:22.300 then this will lead to a code execution. 23:23.380 --> 23:39.460 So these are basically predicates of this rule and this is executed code by attacker on host and gaining of privilege is basically the host condition that is obtained when all these preconditions are satisfied. 23:40.880 --> 23:54.020 And we also use the policies which show the user access on different resources in the system to encode into these interaction rules. 23:55.860 --> 24:03.340 So this will be a logical attack graph of our system that we saw. 24:03.340 --> 24:08.560 You can think of attacker located on internet as this node zero. 24:09.140 --> 24:16.440 Then the node zero interacts with different nodes and these ovals represent the rules. 24:16.800 --> 24:20.940 So like one of this oval will be interaction rule. 24:22.040 --> 24:26.300 And based on that, the attacker progresses to the next privilege node. 24:26.300 --> 24:51.900 So we can think of this as like a root exploit on say Apache web server, then attacker probably gains some other network level access using another host condition of that graph and eventually reaches his goal of gaining root access on a database server by exploiting SQL injection. 24:53.580 --> 25:00.080 So the main brain or AI in this work is Cappuccino. 25:00.240 --> 25:20.580 So what Cappuccino does is it takes the information from attack graph and information about different configurations and vulnerability from this CV search database and log information from the Latte module to create a MDP graph. 25:22.020 --> 25:33.840 So MDP graph can then be used to derive attack plan that we as penetration testers will implement on the network. 25:34.820 --> 25:39.200 So let's see how the states can be extracted from attack graph. 25:39.200 --> 25:52.540 So there were fact nodes which shows that attacker was at internet initially and the next privilege node that he gained was a network access on say another machine FTP. 25:54.160 --> 26:05.140 So there are two things that attacker can do when he is located on internet, either he can take no action or he can exploit this vulnerability. 26:06.420 --> 26:13.100 Let's say the CV ID of this vulnerability is CV 2013 4124. 26:13.100 --> 26:27.660 So these will be the states that we can extract from attack graph to be used in our Markov game or our Markov decision process. 26:28.180 --> 26:44.600 So let's revisit the attack graph and let's see that for this another example, if there are two paths that attacker needs to take to be able to exploit this FTP machine. 26:44.600 --> 26:57.940 So one way he can go about is that he goes from SSH and then tries to exploit the FTP or another way is that he first exploit this web server and goes to FTP. 26:59.740 --> 27:19.120 So the corresponding attack graph for this network will be that attacker has SSH access, there is a SSH vulnerability, he exploits SSH, he gains a root on SSH or the attacker can also go through the exploitation of web server. 27:19.120 --> 27:29.620 So basically he goes through the web server to exploit some vulnerability on web server and then he reaches the FTP server. 27:29.620 --> 27:34.000 So in this graph, there are basically two paths that attacker can take. 27:35.480 --> 27:46.820 So if we are to obtain a Markov decision process from this, basically MDP has some components, state, action, transition and reward. 27:47.580 --> 27:53.900 So state represents the access that an attacker can obtain at any point in the network. 27:53.900 --> 28:00.540 So he can be a user in SSH, if he exploits the vulnerability, he can be a root user on SSH. 28:00.700 --> 28:09.120 If he exploits the web server, he can obtain a root on the web server and eventually he can also obtain a root on FTP. 28:10.460 --> 28:18.500 There are two actions that we use to simplify this Markov decision process. 28:18.500 --> 28:27.500 So in each state, attacker can either choose to take no action or he can choose to exploit the next vulnerability. 28:27.960 --> 28:33.020 And there are some probability values that are associated with these actions. 28:33.020 --> 28:41.120 And these probability values we will explain like how we derive meaningful probability values for the MDP. 28:42.580 --> 28:47.180 And we kind of relate these to the access complexity of the vulnerability. 28:47.180 --> 28:58.540 So if the access complexity is low, then probably it's easier to exploit that vulnerability and there is a higher probability of transitioning to the next state. 29:01.500 --> 29:07.880 And the rewards are the values attacker obtains by being in a particular state. 29:07.880 --> 29:12.100 Say attacker does not want to exploit that vulnerability. 29:12.100 --> 29:15.240 So he will have kind of a low reward. 29:15.240 --> 29:21.760 The reward is that basically he is not detected by say an intrusion detection system. 29:21.760 --> 29:27.420 So that's kind of a reward for him but it's not very big reward. 29:28.380 --> 29:35.760 As compared to if he is able to obtain a root account on one of the external services, that's a high positive reward. 29:36.660 --> 29:45.700 So we put this value like a plus five and we use the CVSS score of the vulnerabilities to derive the reward. 29:46.400 --> 29:51.320 So the reward can at any point be between zero and 10. 29:52.580 --> 30:01.020 And if there are uncertainty in the attacker action, this can be considered as a partially observable Markov decision process. 30:01.980 --> 30:11.020 But in this work, we are using the simple Markov decision process to show how we encode this attack information. 30:12.100 --> 30:22.840 And when we solve this Markov decision process using a value iteration solver, we obtain some policies. 30:22.840 --> 30:30.640 So policies are different paths that attacker can take to obtain some of his goals. 30:31.740 --> 30:34.120 And the reward for each path. 30:34.120 --> 30:46.060 So value iteration tries to maximize the value that an attacker can gain by following a particular policy. 30:46.060 --> 30:58.900 So there are two policies, like he can either exploit SSH, then exploit FTP, or he can exploit SSH, then go to web server and then exploit FTP. 30:58.900 --> 31:04.500 So obviously the reward in second policy is higher compared to first policy. 31:04.800 --> 31:06.560 But this is for a simplified network. 31:06.560 --> 31:12.420 We can hand encode these values and solve this Markov decision process. 31:12.420 --> 31:23.380 But as a penetration tester, if you are dealing with a very gigantic network, we would want to encode this information using some of the MDP solvers. 31:25.180 --> 31:32.400 So, as I mentioned, the states are the privilege level of the attacker. 31:33.440 --> 31:44.700 The value for the transition metric, which is basically the probability of transitioning from one state to next state using an action. 31:44.700 --> 31:55.660 So suppose S0 was a state of user access on SSH and S1 is the state of root access on SSH. 31:57.420 --> 32:04.580 And the access complexity of this vulnerability is low. 32:04.580 --> 32:09.960 That means that there is a high probability of transitioning to state S1. 32:09.960 --> 32:32.420 So we encode the value 0.9 for low access complexity, vulnerability 0.6 for medium, and 0.2 for a high access complexity because the vulnerabilities for which access complexity is high, they are obviously difficult to exploit. 32:32.420 --> 32:38.120 So there is a good chance that attacker will stay in state S0 if he tries to take an action. 32:39.140 --> 32:53.680 And the reward value basically for transitioning to state S1, if the CVSS score of the vulnerability is 6.4, that will be the reward that attacker will gain by transitioning to that state. 32:57.580 --> 33:08.700 So as we discussed, the states represent the current privilege level of attacker and the actions are the actions that attacker will take. 33:09.040 --> 33:18.640 And the transition probabilities are the values we derive from the access complexity of each CVSS vulnerability. 33:20.540 --> 33:41.410 And if we encode this information for action exploit SSH in a form of a transition metric, so by taking action exploit SSH, there is a 0.9% probability that attacker will go from state S0 to S1. 33:41.410 --> 33:47.630 So let's consider the rows 0, 1, and 2 and columns 0, 1, and 2. 33:47.630 --> 34:02.150 So S0, S1, which is 0, 1 row and column, will show that there is a 0.9% probability that attacker will transition from S0 to S1 by taking that action. 34:02.150 --> 34:06.130 But that action has no implication on other states. 34:06.130 --> 34:16.750 So if he was in state S1, then exploit SSH doesn't do a whole lot for going to state of S2. 34:16.830 --> 34:21.270 So attacker will remain in state S1 if he takes that action. 34:23.930 --> 34:32.730 So there is a high probability of being in state S1 and S2 if he takes action exploit SSH in S1 and S2. 34:33.670 --> 34:44.250 And the reward, as we discussed, is the values he obtained by the CVSS score of those vulnerabilities. 34:44.250 --> 34:50.850 So if he takes action A in state S, it maps to a real number between 0 and 10. 34:53.730 --> 35:10.430 So as we discussed that taking no action will have a low reward, and exploiting SSH will have a positive reward, which, like if the CVSS score for this vulnerability was 6.4, that will be the reward of being in state S1. 35:10.430 --> 35:16.570 And similarly, the reward of being in state S2 will correspond to the FTP vulnerability. 35:20.290 --> 35:27.430 So bridging it all together, how we arrive at Markov decision process from ATT&CK graph. 35:27.430 --> 35:30.750 So this is the algorithm that I designed. 35:30.750 --> 35:37.910 Basically, you pass the ATT&CK graph to get the nodes, which show the privilege of the attacker in step one. 35:38.270 --> 35:47.150 You find the CVIDs of these vulnerability that lead to this exploitation in step two. 35:47.170 --> 35:52.170 In step three from ATT&CK graph, you fetch the CVSS score of the vulnerabilities. 35:53.110 --> 36:06.850 In step four A, you use the CVSS score to create a reward metric, which show the actions and state transition mapping to a real value. 36:06.850 --> 36:13.850 So basically it will be say a column matrix for different CVSS score. 36:13.930 --> 36:22.910 In state four B, basically you use the access complexity to derive the transition metric. 36:23.530 --> 36:28.890 And you provide all this information to MDP solver. 36:28.990 --> 36:35.950 So the reward metric, the transition metric, the different states and the action. 36:35.950 --> 36:59.250 And we use the PyMDP solver as a solver with the value iteration function to generate an ATT&CK plan, which then we provide to this module PyMetaExploit that executes the ATT&CK plan and shows that how fast is this ATT&CK plan that we obtained. 37:01.010 --> 37:20.030 So for the validation of ATT&CK plan, like if the ATT&CK plan says that first exploit SSH and then FTP, we have MSRPC, which is a daemon of Metasploit, which is running and basically it uses the Python scripts to execute different plans. 37:20.630 --> 37:30.310 And tells us like what is the cost of running different ATT&CK plans, like how much time it took for different ATT&CK plans. 37:31.490 --> 37:46.430 So for MSRPC, you will need to have one of the MSRPC session running on one window and then on another window, you will execute your ATT&CK plan and see how it goes. 37:48.250 --> 37:50.670 So let's look. 37:52.290 --> 37:55.290 Yeah, so let's look at the demo. 37:55.290 --> 37:58.190 So we'll first go to here. 37:59.070 --> 38:11.280 So we can perform port scan to identify the services that are running on the network. 38:11.280 --> 38:17.480 What are the software versions of those services that are present? 38:17.480 --> 38:20.100 It will take some time. 38:20.100 --> 38:30.290 So in that meantime, we will go and check out the vulnerability scan that we have in our network. 38:30.290 --> 38:33.540 Basically, we have like a and 38:40.130 --> 38:50.670 we can see like this scan obtained a lot of vulnerability on a machine that we set up. 38:50.950 --> 39:02.070 There were about 71 vulnerabilities, which were a mixture of critical, high vulnerability 39:05.840 --> 39:08.740 and low vulnerability. 39:08.740 --> 39:16.420 So our ports can reveal some information that we basically need from the Stinger module. 39:17.050 --> 39:37.250 We have the CVE search API, basically, which provides us information on different vulnerability, like if you provide the CVE ID, it tells us the access complexity and CVSS score, which we will later use in Cappuccino. 39:41.750 --> 39:49.830 We have Nessus scanning APIs, which can be used for connecting with the backend 39:53.360 --> 40:11.240 of the Nessus on the provided port and basically check the state of the network scan, basically create policies and see like if the scan is running or not. 40:11.780 --> 40:16.400 We can basically export the scan using these APIs. 40:16.400 --> 40:27.920 One thing is that in latest version of Nessus, I think they have disabled some of these APIs, but if you are using the old version of Nessus, you can use these APIs. 40:27.920 --> 40:39.260 So the scan that we obtained from Nessus, we need to provide as input to the attack graph, which is our Americano module. 40:43.720 --> 40:48.460 And the Nessus scan file we obtained 40:52.340 --> 40:57.600 is this ASAP underscore something dot Nessus. 40:57.600 --> 41:03.220 This will serve as input to the attack graph. 41:05.680 --> 41:11.040 So Malware is a tool which uses this information. 41:11.040 --> 41:22.990 Basically translate the dot Nessus file using Nessus vulnerability translate. 41:24.670 --> 41:38.700 And this will generate a list of interaction rules and another script, which is a graphgen.sh can be used for obtaining the attack graph from this translated information. 41:38.700 --> 41:41.900 So I already have these files. 41:41.900 --> 41:51.460 So you will need to set up Nessus and XSB if you want to use the Americano module and I have the details in the readme file. 41:54.330 --> 42:17.540 So we run the malware module and the attack graph that we obtained, it has some nodes edges, which show the information about the network services, the different vulnerabilities that are present on this network, the interaction rules. 42:19.080 --> 42:27.440 If we check the visual representation, it will look something like this, like the attacker was initially on internet. 42:27.500 --> 42:40.460 Then he used some rules of access control list, which allowed the access to a particular port to have direct access on another machine. 42:41.560 --> 42:44.040 In the network, so he can network access. 42:44.040 --> 42:50.920 Then he used some other vulnerability to mount a remote exploit on one of the server programs. 42:50.920 --> 42:59.500 So this information is represented using a dot file. 42:59.500 --> 43:08.780 And we can obviously use some D3 libraries to improve the visualization, but this is how the attack graph will look like. 43:09.690 --> 43:20.640 So now we use this attack graph and we provide this information to the MDP solver, 43:23.860 --> 43:27.040 which is present in our Cappuccino module. 43:38.390 --> 43:48.370 So the attack graph parser basically parses the attack graph, obtains the information about the access complexity from the CV search. 43:48.370 --> 44:04.290 It checks the predecessor and successor nodes of the network, obtains the attributes that I described in the state transition. 44:04.470 --> 44:14.730 And basically it encodes this information in form of a Markov decision process. 44:15.650 --> 44:29.070 So if you run this code, basically the edge information will tell us if you are transitioning between two edges. 44:29.070 --> 44:39.230 So let's see, between 1007 and 994, the edge has labeled CV 2011-04-11. 44:39.230 --> 44:55.950 And then we will use this information to obtain the access complexity of that particular vulnerability from the attack graph and encode it in form of like a reward metric. 44:55.950 --> 45:06.830 Then the value iteration algorithm will learn the attack policy that is beneficial for the pentester in this case. 45:06.830 --> 45:22.610 I took a subset of the entire graph to run the value iteration algorithm and it tells us that taking action of exploit, so zero represents no action and one represents the exploit action. 45:22.710 --> 45:29.130 So in this state, taking a particular action will be beneficial for the attacker. 45:30.470 --> 45:39.910 So it will take some time to basically run the value iteration solver and it will give you a attack plan. 45:46.930 --> 45:53.270 We use the attack plan validator to basically validate the plan of attack. 45:53.270 --> 46:02.830 So we use the attack plan to exploit FTP and another SSH vulnerability. 46:02.830 --> 46:07.350 And basically you can see we obtained two shells in this case. 46:08.610 --> 46:13.890 And it took 0.35 seconds to complete. 46:14.130 --> 46:28.690 And basically using this attack plan validation, we can validate how much time it took for our attack plan to be finalized. 46:31.430 --> 46:44.030 So basically for the attack plan validation to work, you should have the MSF RPC daemon running in one shell, one session and you need to execute your attack plan in another session. 46:46.090 --> 47:06.550 So in summary, the threat landscape is very complex and ever-growing and the autonomous pen testing solution, like the one that we have used in ASAP, can help us navigate through this complex attack surface. 47:07.270 --> 47:13.790 And it is effort towards the generation of autonomous attack plans and their validation. 47:15.170 --> 47:37.910 So that is another module that we still have in progress and in future our plan is to use the log information to validate these attack plans and possibly also work for some kind of report generation tool, which help us generate the report on how these validation was performed for individual exploits. 47:43.060 --> 47:46.440 So thank you everyone for attending my talk. 47:46.440 --> 47:52.640 The source code is posted on the GitHub repo, the link which you can see. 47:52.640 --> 47:59.320 And if you want to contact me, here is my contact information. 47:59.460 --> 48:11.980 I appreciate the organizers of Red Team Village to give me a chance to speak at this year's Def Con Red Team Village and have fun, everyone.