From Sands to Mansions: Towards Automated Cyberattack Emulation with Classical Planning and Large Language Models
Fuente:
arXiv
Guardado en:
| Autores principales: | , , , , , , |
|---|---|
| Formato: | Preprint |
| Publicado: |
2024
|
| Materias: | |
| Acceso en línea: | |
| Etiquetas: |
Agregar Etiqueta
Sin Etiquetas, Sea el primero en etiquetar este registro!
|
| _version_ | 1866908813685161984 |
|---|---|
| author | Wang, Lingzhi Li, Zhenyuan Jiang, Yi Wang, Zhengkai Shen, Xiangmin Ruan, Wei Chen, Yan |
| author_facet | Wang, Lingzhi Li, Zhenyuan Jiang, Yi Wang, Zhengkai Shen, Xiangmin Ruan, Wei Chen, Yan |
| contents | Evolving attacker capabilities demand realistic and continuously updated cyberattack emulation for threat-informed defense and security benchmarking. Towards automated attack emulation, this paper defines modular attack actions and a linking model to organize and chain heterogeneous attack tools into causality-preserving cyberattacks. Building on this foundation, we introduce Aurora: an automated cyberattack emulation system powered by symbolic planning and large language models (LLMs). Aurora crafts actionable, causality-preserving attack chains tailored to Cyber Threat Intelligence (CTI) reports and target environments, and automatically executes these emulations. Using Aurora, we generated an extensive cyberattack emulation dataset from 250 attack reports, 15 times larger than the leading expert-crafted dataset. Our evaluation shows that Aurora significantly outperforms existing methods in creating actionable, diverse, and realistic attack chains. We release the dataset and use it to evaluate three state-of-the-art intrusion detection systems, whose performance differed notably from results on older datasets, highlighting the need for up-to-date, automated attack emulation. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2407_16928 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | From Sands to Mansions: Towards Automated Cyberattack Emulation with Classical Planning and Large Language Models Wang, Lingzhi Li, Zhenyuan Jiang, Yi Wang, Zhengkai Shen, Xiangmin Ruan, Wei Chen, Yan Cryptography and Security Evolving attacker capabilities demand realistic and continuously updated cyberattack emulation for threat-informed defense and security benchmarking. Towards automated attack emulation, this paper defines modular attack actions and a linking model to organize and chain heterogeneous attack tools into causality-preserving cyberattacks. Building on this foundation, we introduce Aurora: an automated cyberattack emulation system powered by symbolic planning and large language models (LLMs). Aurora crafts actionable, causality-preserving attack chains tailored to Cyber Threat Intelligence (CTI) reports and target environments, and automatically executes these emulations. Using Aurora, we generated an extensive cyberattack emulation dataset from 250 attack reports, 15 times larger than the leading expert-crafted dataset. Our evaluation shows that Aurora significantly outperforms existing methods in creating actionable, diverse, and realistic attack chains. We release the dataset and use it to evaluate three state-of-the-art intrusion detection systems, whose performance differed notably from results on older datasets, highlighting the need for up-to-date, automated attack emulation. |
| title | From Sands to Mansions: Towards Automated Cyberattack Emulation with Classical Planning and Large Language Models |
| topic | Cryptography and Security |
| url | https://arxiv.org/abs/2407.16928 |