NetQi

Paper accepted at the 4th International Conferences on Information Security and Cryptology (INSCRYPT 2008). Beijing China.

Abstract

The anticipation game framework is an extension of attack graphs based on game theory. It is used to anticipate and analyze intruder and administrator concurrent interactions with the network.

As attack graph based on model checking, the goal on an anticipation game is to prove that a safety property hold. However using this kind of goal is tedious and error prone on large networks because it assume that the analyst have a prior and complete knowledge of the network critical services.

In this paper we address this issue by introducing a new kind of goal called strategy objectives which is more usable for network security analysis purpose.

To do so we have extended the anticipation games framework with cost and reward. Additionally this extension allows to take into account the financial dimension of attack during the analysis.

We prove that finding the optimal strategy is decidable and only requires a linear memory space. Finally we show that anticipation game with strategy can be used in practice even on large networks by evaluating the performance of our prototype.

file

Using Strategy Objectives for Network Security Analysis (PDF preliminary version)

Bibtex

The paper has been accepted to  the 6th International Symposium on Automated Technology for Verification and Analysis (ATVA’08). Held at Seoul, Korea in October 2008

Abstract

NetQi is a freely available model-checker designed to analyze network incidents such as intrusion. This tool is an implementation of the anticipation game framework, a variant of timed game tailored for network analysis. The main purpose of NetQi is to find, given a network initial state and a set of rules, the best strategy that fulfills player objectives by model-checking the anticipation game and comparing the outcome of each play that fulfills strategy constraints. For instance, it can be used to find the best patching strategy. NetQi has been successfully used to analyze service failure due to hardware, network intrusion, worms and multiple-site intrusion defense cooperation.

Bibtex