DOCSLIB.ORG

Impact Analysis of System and Network Attacks

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Impact Analysis of System and Network Attacks View metadata, citation and similar papers at core.ac.uk brought to you by CORE provided by DigitalCommons@USU Utah State University DigitalCommons@USU All Graduate Theses and Dissertations Graduate Studies 12-2008 Impact Analysis of System and Network Attacks Anupama Biswas Utah State University Follow this and additional works at: https://digitalcommons.usu.edu/etd Part of the Computer Sciences Commons Recommended Citation Biswas, Anupama, "Impact Analysis of System and Network Attacks" (2008). All Graduate Theses and Dissertations. 199. https://digitalcommons.usu.edu/etd/199 This Thesis is brought to you for free and open access by the Graduate Studies at DigitalCommons@USU. It has been accepted for inclusion in All Graduate Theses and Dissertations by an authorized administrator of DigitalCommons@USU. For more information, please contact [email protected]. i IMPACT ANALYSIS OF SYSTEM AND NETWORK ATTACKS by Anupama Biswas A thesis submitted in partial fulfillment of the requirements for the degree of MASTER OF SCIENCE in Computer Science Approved: _______________________ _______________________ Dr. Robert F. Erbacher Dr. Chad Mano Major Professor Committee Member _______________________ _______________________ Dr. Stephen W. Clyde Dr. Byron R. Burnham Committee Member Dean of Graduate Studies UTAH STATE UNIVERSITY Logan, Utah 2008 ii Copyright © Anupama Biswas 2008 All Rights Reserved iii ABSTRACT Impact Analysis of System and Network Attacks by Anupama Biswas, Master of Science Utah State University, 2008 Major Professor: Dr. Robert F. Erbacher Department: Computer Science Systems and networks have been under attack from the time the Internet first came into existence. There is always some uncertainty associated with the impact of the new attacks. Compared to the problem of attack detection, analysis of attack impact has received very little attention. Generalize and forecasting the kind of attack that will hit systems in future is not possible. However, it is possible to predict the behavior of a new attack and, thereby, the impact of the attack. This thesis proposes a method for predicting the impact of a new attack on systems and networks as well as the severity of the impact of the new attack. The prediction is based on the assumption that a future attack will be similar to already existing attacks. The severity of the attack depends on a few specific system/network parameters identified in this thesis. The cumulative effect of an attack is a summation of the behavior of these identified parameters during the attack. The suggested method is based on simulating a selected number of existing attacks, collecting the results of the impact of these attacks, and using them along with attack graphs to automatically detect the impact of a new attack. A formula is proposed for calculating the impact severity percentage, which is calculated as a percentage value of the impact of the known attack. This value will help identify critical points that need special care to ensure the readiness of a network or system to withstand an attack. (144 pages) iv To my parents who are the largest source of motivation and encouragement in my life. v ACKNOWLEDGMENTS My heartfelt thanks to my advisor, Dr. Robert Erbacher, for his constant support and guidance through the course of this research project and for his valuable feedback at every step. I would also like to thank Dr. Chad Mano whose computer security course served as a precursor for my research. My heartfelt thanks to Dr. Stephen Clyde whose object-oriented software development course helped me visualize and generate a lot of innovative ideas for my thesis. A big thank you to Myra Cook whose invaluable feedback helped to make my thesis presentable. I would like to thank the computer science security laboratory members as well as all the USU faculty with whom I have had the pleasure to work with. The entire journey would not have been possible without the prayers and encouragement of my family. Heartfelt thanks to my parents and my sister for believing in me and helping me achieve my dreams. Thanks to all my friends, especially Shalini Rathnavel and Steena Monteiro, for their constant moral support and feedback. Finally, I would like to offer my work at the lotus feet of my spiritual guru, Mata Amritanandmayi, whose blessings and teachings have always guided me through all the difficult times. Anupama Biswas vi CONTENTS Page ABSTRACT....................................................................................................................................iii ACKNOWLEDGMENTS ............................................................................................................... v LIST OF TABLES.........................................................................................................................viii LIST OF FIGURES ........................................................................................................................ix 1 INTRODUCTION..................................................................................................................... 1 1.1 Importance of Analyzing Impact of Novel Attacks ............................................................ 1 1.2 Related Work ...................................................................................................................... 2 2 METHODOLOGY.................................................................................................................... 6 2.1 The Approach Adopted for Impact Analysis....................................................................... 6 2.2 Experimentation.................................................................................................................. 7 2.2.1 Simulation Setup.................................................................................................... 7 2.2.2 Simulation of Selected Attacks ............................................................................ 11 2.3 Observations of the Impact of the Simulated Attacks....................................................... 32 3 IMPACT ANALYSIS ALGORITHM AND CALCULATION OF IMPACT SEVERITY PERCENTAGE ................................................................................................... 33 3.1 Function Definition for Mapping Novel Attacks to Simulated Attacks............................ 33 3.1.1 Assumptions. ....................................................................................................... 34 3.1.2 Function Definition.............................................................................................. 34 3.2 Impact Analysis Algorithm ............................................................................................... 36 4 AUTOMATED APPROACH TO IMPACT ANALYSIS FOR SYSTEM AND NETWORK ATTACKS ................................................................................ 38 4.1 Attack Graphs ................................................................................................................... 38 4.2 Representation of Impact Analysis Graph ........................................................................ 39 4.3 Configuration File and Attacker’s Profile......................................................................... 40 4.4 Attack Template................................................................................................................ 41 4.5 Attack Templates for Simulated Attacks........................................................................... 46 5 PROOF OF CONCEPT........................................................................................................... 56 5.1 Description of the Novel Attack ....................................................................................... 56 5.2 Analyzing the Impact of the Attack and Calculating the Impact Severity Percentage .... .57 vii 5.3 Generating an Impact Analysis Graph for the Novel Attack ............................................ 59 6 CONCLUSION AND FUTURE WORK ................................................................................ 62 6.1 Contribution...................................................................................................................... 62 6.2 Future Work ...................................................................................................................... 62 REFERENCES .............................................................................................................................. 64 APPENDICES ............................................................................................................................... 66 Appendix A ............................................................................................................................. 67 Appendix B ........................................................................................................................... 113 Appendix C ........................................................................................................................... 135 viii LIST OF TABLES Table Page 2.1 Command Options for top Command............................................................................... 9 2.2 System Configuration for Attack Simulation.................................................................... 11 2.3 Threshold Values of the System and Network Before the Attack..................................... 13 2.4 Performance Metric Values During Fork Bomb Attack with Login as ‘Root’.................. 13
Load more

Recommended publications
  • Theendokernel: Fast, Secure
    The Endokernel: Fast, Secure, and Programmable Subprocess Virtualization Bumjin Im Fangfei Yang Chia-Che Tsai Michael LeMay Rice University Rice University Texas A&M University Intel Labs Anjo Vahldiek-Oberwagner Nathan Dautenhahn Intel Labs Rice University Abstract Intra-Process Sandbox Multi-Process Commodity applications contain more and more combina- ld/st tions of interacting components (user, application, library, and Process Process Trusted Unsafe system) and exhibit increasingly diverse tradeoffs between iso- Unsafe ld/st lation, performance, and programmability. We argue that the Unsafe challenge of future runtime isolation is best met by embracing syscall()ld/st the multi-principle nature of applications, rethinking process Trusted Trusted read/ architecture for fast and extensible intra-process isolation. We IPC IPC write present, the Endokernel, a new process model and security Operating System architecture that nests an extensible monitor into the standard process for building efficient least-authority abstractions. The Endokernel introduces a new virtual machine abstraction for Figure 1: Problem: intra-process is bypassable because do- representing subprocess authority, which is enforced by an main is opaque to OS, sandbox limits functionality, and inter- efficient self-isolating monitor that maps the abstraction to process is slow and costly to apply. Red indicates limitations. system level objects (processes, threads, files, and signals). We show how the Endokernel Architecture can be used to develop enforces subprocess access control to memory and CPU specialized separation abstractions using an exokernel-like state [10, 17, 24, 25, 75].Unfortunately, these approaches only organization to provide virtual privilege rings, which we use virtualize minimal parts of the CPU and neglect tying their to reorganize and secure NGINX.
    [Show full text]
  • Network Design Reference for Avaya Virtual Services Platform 4000 Series
    Network Design Reference for Avaya Virtual Services Platform 4000 Series Release 4.1 NN46251-200 Issue 05.01 January 2015 © 2015 Avaya Inc. applicable number of licenses and units of capacity for which the license is granted will be one (1), unless a different number of All Rights Reserved. licenses or units of capacity is specified in the documentation or other Notice materials available to You. “Software” means computer programs in object code, provided by Avaya or an Avaya Channel Partner, While reasonable efforts have been made to ensure that the whether as stand-alone products, pre-installed on hardware products, information in this document is complete and accurate at the time of and any upgrades, updates, patches, bug fixes, or modified versions printing, Avaya assumes no liability for any errors. Avaya reserves thereto. “Designated Processor” means a single stand-alone the right to make changes and corrections to the information in this computing device. “Server” means a Designated Processor that document without the obligation to notify any person or organization hosts a software application to be accessed by multiple users. of such changes. “Instance” means a single copy of the Software executing at a Documentation disclaimer particular time: (i) on one physical machine; or (ii) on one deployed software virtual machine (“VM”) or similar deployment. “Documentation” means information published by Avaya in varying mediums which may include product information, operating Licence types instructions and performance specifications that Avaya may generally Designated System(s) License (DS). End User may install and use make available to users of its products and Hosted Services.
    [Show full text]
  • Networking Packet Broadcast Storms
    Lesson Learned Networking Packet Broadcast Storms Primary Interest Groups Balancing Authorities (BAs) Generator Operators (GOPs) Reliability Coordinators (RCs) Transmission Operators (TOPs) Transmission Owners (TOs) that own and operate an Energy Management System (EMS) Problem Statement When a second network cable was connected from a voice over internet protocol (VOIP) phone to a network switch lacking proper settings, a packet broadcast storm prevented network communications from functioning, and supervisory control and data acquisition (SCADA) was lost for several hours. Broadcast storm events have also arisen from substation local area network (LAN) issues. Details A conference room was set up for a training class that needed to accommodate multiple PCs. The bridge protocol data unit (BPDU) packet propagation prevention setting was disabled on a port in the conference room in order to place a network switch off of that port. Upon completion of the training, the network switch was removed; however, the BPDU packet propagation setting was inadvertently not restored. As part of a telephone upgrade project, the traditional phone in this conference room was recently replaced by a VOIP phone. Later, an additional network cable was connected to the output port of this VOIP phone into a secondary network jack within the conference room. When the second network cable was connected from a VOIP phone to a network switch lacking proper settings, a switching loop resulted. Spanning tree protocol is normally used to prevent switching loops from propagating broadcast packets continuously until the network capacity is overwhelmed. A broadcast packet storm from the switching loop prevented network communications from functioning and SCADA was lost for several hours.
    [Show full text]
  • Exercises for Portfolio
    Faculty of Computing, Engineering and Technology Module Name: Operating Systems Module Number: CE01000-3 Title of Assessment: Portfolio of exercises Module Learning Outcomes for This Assessment 3. Apply to the solution of a range of problems, the fundamental concepts, principles and algorithms employed in the operation of a multi-user/multi-tasking operating systems. Hand in deadline: Friday 26th November, 2010. Assessment description Selected exercises from the weekly tutorial/practical class exercises are to be included in a portfolio of exercises to be submitted Faculty Office in a folder by the end of week 12 (Friday 26th November 2010). The weekly tutorial/practical exercises that are to be included in the portfolio are specified below. What you are required to do. Write up the selected weekly exercises in Word or other suitable word processor. The answers you submit should be your own work and not the work of any other person. Note the University policy on Plagiarism and Academic Dishonesty - see Breaches in Assessment Regulations: Academic Dishonesty - at http://www.staffs.ac.uk/current/regulations/academic/index.php Marks The marks associated with each selected exercise will be indicated when you are told which exercises are being selected. Week 1. Tutorial questions: 6. How does the distinction between supervisor mode and user mode function as a rudimentary form of protection (security) system? The operating system assures itself a total control of the system by establishing a set of privileged instructions only executable in supervisor mode. In that way the standard user won’t be able to execute these commands, thus the security.
    [Show full text]
  • Understanding Linux Internetworking
    White Paper by David Davis, ActualTech Media Understanding Linux Internetworking In this Paper Introduction Layer 2 vs. Layer 3 Internetworking................ 2 The Internet: the largest internetwork ever created. In fact, the Layer 2 Internetworking on term Internet (with a capital I) is just a shortened version of the Linux Systems ............................................... 3 term internetwork, which means multiple networks connected Bridging ......................................................... 3 together. Most companies create some form of internetwork when they connect their local-area network (LAN) to a wide area Spanning Tree ............................................... 4 network (WAN). For IP packets to be delivered from one Layer 3 Internetworking View on network to another network, IP routing is used — typically in Linux Systems ............................................... 5 conjunction with dynamic routing protocols such as OSPF or BGP. You c an e as i l y use Linux as an internetworking device and Neighbor Table .............................................. 5 connect hosts together on local networks and connect local IP Routing ..................................................... 6 networks together and to the Internet. Virtual LANs (VLANs) ..................................... 7 Here’s what you’ll learn in this paper: Overlay Networks with VXLAN ....................... 9 • The differences between layer 2 and layer 3 internetworking In Summary ................................................. 10 • How to configure IP routing and bridging in Linux Appendix A: The Basics of TCP/IP Addresses ....................................... 11 • How to configure advanced Linux internetworking, such as VLANs, VXLAN, and network packet filtering Appendix B: The OSI Model......................... 12 To create an internetwork, you need to understand layer 2 and layer 3 internetworking, MAC addresses, bridging, routing, ACLs, VLANs, and VXLAN. We’ve got a lot to cover, so let’s get started! Understanding Linux Internetworking 1 Layer 2 vs.
    [Show full text]
  • A Universal Framework for (Nearly) Arbitrary Dynamic Languages Shad Sterling Georgia State University
    Georgia State University ScholarWorks @ Georgia State University Undergraduate Honors Theses Honors College 5-2013 A Universal Framework for (nearly) Arbitrary Dynamic Languages Shad Sterling Georgia State University Follow this and additional works at: https://scholarworks.gsu.edu/honors_theses Recommended Citation Sterling, Shad, "A Universal Framework for (nearly) Arbitrary Dynamic Languages." Thesis, Georgia State University, 2013. https://scholarworks.gsu.edu/honors_theses/12 This Thesis is brought to you for free and open access by the Honors College at ScholarWorks @ Georgia State University. It has been accepted for inclusion in Undergraduate Honors Theses by an authorized administrator of ScholarWorks @ Georgia State University. For more information, please contact [email protected]. A UNIVERSAL FRAMEWORK FOR (NEARLY) ARBITRARY DYNAMIC LANGUAGES (A THEORETICAL STEP TOWARD UNIFYING DYNAMIC LANGUAGE FRAMEWORKS AND OPERATING SYSTEMS) by SHAD STERLING Under the DireCtion of Rajshekhar Sunderraman ABSTRACT Today's dynamiC language systems have grown to include features that resemble features of operating systems. It may be possible to improve on both by unifying a language system with an operating system. Complete unifiCation does not appear possible in the near-term, so an intermediate system is desCribed. This intermediate system uses a common call graph to allow Components in arbitrary languages to interaCt as easily as components in the same language. Potential benefits of such a system include signifiCant improvements in interoperability,
    [Show full text]
  • Web Management Guide
    Web Management Guide Digital Data Communications GmbH. http://www.level1.com Web Management Guide GTP-2871 28-Port L3 Lite Managed Gigabit PoE Switch GTP-5271 52-Port L3 Lite Managed Gigabit PoE Switch How to Use This Guide This guide includes detailed information on the switch software, including how to operate and use the management functions of the switch. To deploy this switch effectively and ensure trouble-free operation, you should first read the relevant sections in this guide so that you are familiar with all of its software features. Who Should Read This guide is for network administrators who are responsible for operating and this Guide? maintaining network equipment. The guide assumes a basic working knowledge of LANs (Local Area Networks), the Internet Protocol (IP), and Simple Network Management Protocol (SNMP). How this Guide This guide provides detailed information about the switch’s key features. It also is Organized describes the switch’s web browser interface. For information on the command line interface refer to the CLI Reference Guide. The guide includes these sections: u Section I “Web Configuration” — Includes all management options available through the web browser interface. Related This guide focuses on switch software configuration through the web browser. Documentation For information on how to manage the switch through the command line interface, see the following guide: CLI Reference Guide Note: For a description of how to initialize the switch for management access via the CLI, web interface or SNMP, refer to “Initial Switch Configuration” in the CLI Reference Guide. Conventions The following conventions are used throughout this guide to show information: Note: Emphasizes important information or calls your attention to related features or instructions.
    [Show full text]
  • (Rapid) Spanning Tree Protocol
    STP – Spanning Tree Protocol indigoo.com STP & RSTP (RAPID) SPANNING TREE PROTOCOL DESCRIPTION OF STP AND RSTP, PROTOCOLS FOR LOOP FREE LAN TOPOLOGIES Peter R. Egli INDIGOO.COM1/57 © Peter R. Egli 2015 Rev. 1.60 STP – Spanning Tree Protocol indigoo.com Contents 1. Goal of STP: Loop-free topology for Ethernet networks 2. STP standards overview 3. IEEE 802.1D STP protocol 4. IEEE 802.1w RSTP Rapid STP 5. IEEE 802.1Q CST Common Spanning Tree 6. Cisco PVST+ and PVRST+ 7. IEEE 802.1s MST Multiple Spanning Tree Protocol 8. STP Pros and Cons 2/57 © Peter R. Egli 2015 Rev. 1.60 STP – Spanning Tree Protocol indigoo.com 1. Goal of STP: Loop-free topology for Ethernet networks Ethernet bridges (or switches) must forward unknown unicast and broadcast Ethernet frames to all physical ports. Therefore Ethernet networks require a loop-free topology, otherwise more and more broadcast and unknown unicast frames would swamp the network (creation of frame duplicates resulting in a broadcast storm). Unknown unicast frame: Frame with a target Ethernet address that is not yet known by the receiving bridge. Broadcast frame: Ethernet frame with a broadcast target Ethernet address, e.g. for protocols such as ARP or BOOTP / DHCP. Broadcast Ethernet frames and unknown unicast frames circle forever in an Ethernet network with loops. 3/57 © Peter R. Egli 2015 Rev. 1.60 STP – Spanning Tree Protocol indigoo.com 2. STP standards overview: A number of different STP ‘standards’ and protocols evolved over time. Standard Description Abbreviation Spanning Tree Protocol • Loop prevention. IEEE 802.1D • Automatic reconfiguration of tree in case of topology changes (e.g.
    [Show full text]
  • Principles of Operating Systems Name (Print): Fall 2019 Seat: SEAT Final
    Principles of Operating Systems Name (Print): Fall 2019 Seat: SEAT Final Left person: 12/13/2019 Right person: Time Limit: 8:00am { 10:00pm • Don't forget to write your name on this exam. • This is an open book, open notes exam. But no online or in-class chatting. • Ask us if something is confusing. • Organize your work, in a reasonably neat and coherent way, in the space provided. Work scattered all over the page without a clear ordering will receive very little credit. • Mysterious or unsupported answers will not receive full credit. A correct answer, unsupported by explanation will receive no credit; an incorrect answer supported by substan- tially correct explanations might still receive partial credit. • If you need more space, use the back of the pages; clearly indicate when you have done this. • Don't forget to write your name on this exam. Problem Points Score 1 10 2 15 3 15 4 15 5 17 6 15 7 4 Total: 91 Principles of Operating Systems Final - Page 2 of 12 1. Operating system interface (a) (10 points) Write code for a simple program that implements the following pipeline: cat main.c | grep "main" | wc I.e., you program should start several new processes. One for the cat main.c command, one for grep main, and one for wc. These processes should be connected with pipes that cat main.c redirects its output into the grep "main" program, which itself redirects its output to the wc. forked pid:811 forked pid:812 fork failed, pid:-1 Principles of Operating Systems Final - Page 3 of 12 2.
    [Show full text]
  • Network Storm Testing
    NETWORK STORM TESTING VERIFYING THE ROBUSTNESS OF CONTROL SYSTEM COMMUNICATIONS In this white paper, we discuss a stress situation that can impact communication and redundancy of networked control systems. How can this situation arise, and why should we test for it? Furthermore, we look into what we recommend, how control systems should be tested to avoid that their communication is impacted by network overload. 1/7 INTRODUCTION Let us start with a citation from a senior engineer with A normal Ethernet switch forwards broadcast and the major E&P company of Norway: multicast traffic on all its ports. Other (up- or down- link) switches receiving these broadcast or multicast “Be a demanding customer, prior to FAT, messages, will again forward them to all their ports and apply traffic generator packets on network so on. In an Ethernet network, any looped packet might remain on the network forever. A network storm, i.e. a segments to full bandwidth. Peer to Peer, network stress situation can arise in various ways and multicast and broadcast packets. Graceful can cause a Denial of Service (DoS) in the worst case. reconnect after storm or need for restart?” Probably, the most common reason for a network – Sr. IT Security Engineer, Statoil ASA storm is cabling problems, in particular if a cable loop But what is an unexpected network overload, or net- is present. Other factors contributing to a network work storm situation actually? A network storm can be stress situation are: compared to a room full of people talking loudly and making a conversation between 2 individuals impos- Poor network management and monitoring; sible.
    [Show full text]
  • Pakedge SK-8-EP User Guide
    SX-8-EP Enterprise-AV, Smart Managed Switches User Guide This device complies with Part 15 of the FCC Rules. Operation is subject to the following two conditions: 1. This device may not cause harmful interference. 2. This device must accept any interference received, including interference that may cause undesired operation. NOTE: This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment generates, uses and can radiate radio frequency energy and, if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one of the following measures: Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Connect the equipment into an outlet on a circuit different from that to which the receiver is connected. Consult the dealer or an experienced radio/TV technician for help. WARNING: Any changes or modifications not expressly approved by the party responsible for compliance could void the user's authority to operate this equipment. WARNING: TO PREVENT FIRE OR SHOCK HAZARD, DO NOT EXPOSE THIS PRODUCT TO RAIN OR MOISTURE. THE UNIT MUST NOT BE EXPOSED TO DRIPPING OR SPLASHING WATER.
    [Show full text]
  • Computer Viruses and Malware Advances in Information Security
    Computer Viruses and Malware Advances in Information Security Sushil Jajodia Consulting Editor Center for Secure Information Systems George Mason University Fairfax, VA 22030-4444 email: [email protected] The goals of the Springer International Series on ADVANCES IN INFORMATION SECURITY are, one, to establish the state of the art of, and set the course for future research in information security and, two, to serve as a central reference source for advanced and timely topics in information security research and development. The scope of this series includes all aspects of computer and network security and related areas such as fault tolerance and software assurance. ADVANCES IN INFORMATION SECURITY aims to publish thorough and cohesive overviews of specific topics in information security, as well as works that are larger in scope or that contain more detailed background information than can be accommodated in shorter survey articles. The series also serves as a forum for topics that may not have reached a level of maturity to warrant a comprehensive textbook treatment. Researchers, as well as developers, are encouraged to contact Professor Sushil Jajodia with ideas for books under this series. Additional tities in the series: HOP INTEGRITY IN THE INTERNET by Chin-Tser Huang and Mohamed G. Gouda; ISBN-10: 0-387-22426-3 PRIVACY PRESERVING DATA MINING by Jaideep Vaidya, Chris Clifton and Michael Zhu; ISBN-10: 0-387- 25886-8 BIOMETRIC USER AUTHENTICATION FOR IT SECURITY: From Fundamentals to Handwriting by Claus Vielhauer; ISBN-10: 0-387-26194-X IMPACTS AND RISK ASSESSMENT OF TECHNOLOGY FOR INTERNET SECURITY.'Enabled Information Small-Medium Enterprises (TEISMES) by Charles A.
    [Show full text]