Cyber attack and defense emulation agents

Jeong Do Yoo, Eunji Park, Gyungmin Lee, Myung Kil Ahn, Donghwa Kim, Seongyun Seo, Huy Kang Kim

Research output: Contribution to journalArticle

Abstract

As the scale of the system and network grows, IT infrastructure becomes more complex and hard to be managed. Many organizations have a serious problem to manage their system and network security. In addition, vulnerabilities of hardware and software are increasing in number rapidly. In such a complex IT environment, security administrators need more practical and automated threat assessment methods to reduce their manual tasks. Adversary emulation based automated assessment is one of the solutions to solve the aforementioned problems because it helps to discover the attack paths and vulnerabilities to be exploited. However, it is still inefficient to perform the adversary emulation because adversary emulation requires well-designed attack scenarios created by security experts. Besides, a manual-based penetration test cannot be frequently performed. To overcome this limitation, we propose an adversary emulation framework composed of the red team and blue team agent. The red team agent carries out automated attacks based on the automatically generated scenarios by the proposed framework. The blue team agent deploys defense measures to react to the red team agent's attack patterns. To test our framework, we test multiple attack scenarios on remote servers that have various vulnerable software. In the experiment, we show the red team agent can gain an administrator's privilege from the remote side when the blue team agent's intervention is not enabled. The blue team agent can successfully block the red team's incoming attack when enabled. As a result, we show our proposed framework is beneficial to support routine threat assessment from the adversary's perspective. It will be useful for security administrators to make security defense strategy based on the test results.

Original languageEnglish
Article number2140
JournalApplied Sciences (Switzerland)
Volume10
Issue number6
DOIs
Publication statusPublished - 2020 Mar 1

Keywords

  • Adversary emulation
  • Agent modeling
  • Automated agent
  • Blue-teaming
  • Red-teaming

ASJC Scopus subject areas

  • Materials Science(all)
  • Instrumentation
  • Engineering(all)
  • Process Chemistry and Technology
  • Computer Science Applications
  • Fluid Flow and Transfer Processes

Fingerprint Dive into the research topics of 'Cyber attack and defense emulation agents'. Together they form a unique fingerprint.

  • Cite this

    Yoo, J. D., Park, E., Lee, G., Ahn, M. K., Kim, D., Seo, S., & Kim, H. K. (2020). Cyber attack and defense emulation agents. Applied Sciences (Switzerland), 10(6), [2140]. https://doi.org/10.3390/app10062140