Attack-Defense Graph Generation: Instantiating Incident Response Actions on Attack Graphs

Cyber-attacks are increasing; it is more urgent for organizations to automate their Incident Response (IR) plan process. Attack Graphs (AGs) are used to represent actions followed by an adversary to reach a goal. However, an expert should analyze each possible action and their impact to decide which mitigation actions should be applied to block the attack fulfillment. This paper proposes an approach to generate Attack-Defense Graphs in real-time by instantiating IR actions on a logical AG. The system’s real-time monitoring enables the detection of malicious actions, which leads to the generation of alerts mapped with the AG to deduce the attacker’s location on the system. Our solution can decide where to apply IR actions to mitigate the attack impact. These IR actions are part of playbooks that are generated automatically for the attack. We propose correlating IR actions with the AG fact nodes to choose which IR actions to instantiate on the AG. Therefore, we propose generating predicates for the mitigation actions, which are mapped with the AG predicates. We validate our approach with an industrial use case. An asset is vulnerable to Remote Code Execution (RCE) requiring user credentials that can be obtained through a brute force attack. We show how our approach helps anticipate an adversary’s next step. The countermeasures predicates are instantiated on the AG to prevent the attacker from going further on the system.