SPEAR: Security Posture Evaluation using AI Planner-Reasoning on Attack-Connectivity Hypergraphs

TL;DR

SPEAR is a formal AI planning framework that models network vulnerabilities and configurations to evaluate security postures, suggest defenses, and enable human-in-the-loop analysis for network hardening.

Contribution

It introduces a novel formal framework using AI planning to model attack graphs with incomplete information and provides tool support for security evaluation and scenario analysis.

Findings

Automates conversion of network configs into planning models

Identifies diverse security hardening strategies

Enables systematic exploration of defense options

Abstract

Graph-based frameworks are often used in network hardening to help a cyber defender understand how a network can be attacked and how the best defenses can be deployed. However, incorporating network connectivity parameters in the attack graph, reasoning about the attack graph when we do not have access to complete information, providing system administrator suggestions in an understandable format, and allowing them to do what-if analysis on various scenarios and attacker motives is still missing. We fill this gap by presenting SPEAR, a formal framework with tool support for security posture evaluation and analysis that keeps human-in-the-loop. SPEAR uses the causal formalism of AI planning to model vulnerabilities and configurations in a networked system. It automatically converts network configurations and vulnerability descriptions into planning models expressed in the Planning Domain Definition Language (PDDL). SPEAR identifies a set of diverse security hardening strategies that can be presented in a manner understandable to the domain expert. These allow the administrator to explore the network hardening solution space in a systematic fashion and help evaluate the impact and compare the different solutions.