Model-Based Attack Planning Strategies for Automated Penetration Testing Exercises

With the advances in cyber-attack techniques, cyber-criminals can easily plan attack scenarios and exploit them quickly. As a result, it is important for network defenders to emulate and understand the attackers' possible attack scenarios in order to effectively thwart them. In automated penetration testing, attack path planning is a crucial task that involves selecting the best attack paths to improve the efficiency and success rate of the penetration testing process. Some attempts have been made to partially automate the aspect of the attack execution using some tools (e.g., Metasploit Framework), however, they lack attack planning strategies and require a human expert to plan and execute such attacks. In this paper, we employ model-based analysis to design attack planning strategies and implement an automated attack execution tool, that will automatically plan and execute attacks by exploiting vulnerabilities (e.g., some found in the AWS Virtual Machine instances) in a network. In addition, we analyze and compare the different attack planning strategies; (1) atomic-based approach, (2) path-based approach, and (3) composite approach, based on the implementations of the attack execution component of the framework while taking into account different network settings and configurations (e.g., number of subnets, attacker's target, etc). We perform experiments on Amazon's Elastic Compute Cloud (EC2) to evaluate the proposed approaches. Our results show that the framework can be used to understand attacks and approaches to defend them. We also show the average time it takes to perform attacks for the different stages.