Technical Upgrades to and Enhancements of a System Vulnerability Analysis Tool Based on the Blackboard Architecture

TL;DR

This paper discusses enhancements to the SONARR vulnerability analysis tool, including new functionalities and in-memory processing, demonstrating performance improvements and outlining future development directions for analyzing complex mission-critical systems.

Contribution

The paper introduces new features and in-memory processing capabilities to the SONARR tool, improving its efficiency in analyzing system vulnerabilities without offline testing.

Findings

Performance improvements with in-memory processing

Effective analysis of complex mission-critical systems

Potential for further enhancements like multithreading and additional metrics

Abstract

A system vulnerability analysis technique (SVAT) for the analysis of complex mission critical systems (CMCS) that cannot be taken offline or subjected to the risks posed by traditional penetration testing was previously developed. This system uses path-based analysis of vulnerabilities to identify potential threats to system security. Generalization logic building on the Blackboard Architecture's rule-fact paradigm was implemented in this system, the software for operation and network attack results review (SONARR). This paper presents an overview of additional functionality that has been added to this tool and the experimentation that was conducted to analyze their efficacy and the performance benefits of the new in-memory processing capabilities of the SONARR algorithm. The results of the performance tests and their relation to networks' architecture are discussed. The paper concludes with a discussion of avenues of future work, including the implementation of multithreading, additional analysis metrics like confidentiality, integrity, and availability, and improved heuristic development.