Skip to content

Add pattern matching module for querying AttackGraph #29

@mrkickling

Description

@mrkickling
  • We want to be able to query for 'patterns' in AttackGraph, LanguageGraph and Model (this issue is for AttackGraph)
  • It should be possible to query for a pattern, this means to find certain types of nodes structured in a specified way
  • Patterns (for AttackGraph) would be on format "give me a chain of nodes that start with 'nodetype 1 with only parent that is x' and end with 'nodetype 2 with at least one parent and in between there must be a node of type x that has property y'". Think regex.
  • Example: In the AttackGraph find redundant/superfluous attack steps like AttemptRead -> successfulRead -> Read (this can be used to combine/compress them)
  • Other example: In AttackGraph find nodes with single credentials in the graph (can be used to suggest 2FA)
  • Other example: In AttackGraph find paths from Auth->FullAccess

We might also want to be able to combine patterns from different types of graphs (e.g. Auth->FullAccess in AttackGraph where the asset in the ModelInstance is connected to somethingsomething). Keep this in mind during design.

For this issue:

  • Design the solution
  • Create patterns module for AttackGraph
  • Make it possible to query the module to find patterns in AttackGraph and return chain of nodes
  • Tests

Metadata

Metadata

Assignees

Labels

enhancementNew feature or request

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions