Skip to content

Add pattern matching module for querying AttackGraph #29

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
4 tasks
mrkickling opened this issue May 14, 2024 · 0 comments · May be fixed by #91
Open
4 tasks

Add pattern matching module for querying AttackGraph #29

mrkickling opened this issue May 14, 2024 · 0 comments · May be fixed by #91
Assignees

Comments

@mrkickling
Copy link
Contributor

  • We want to be able to query for 'patterns' in AttackGraph, LanguageGraph and Model (this issue is for AttackGraph)
  • It should be possible to query for a pattern, this means to find certain types of nodes structured in a specified way
  • Patterns (for AttackGraph) would be on format "give me a chain of nodes that start with 'nodetype 1 with only parent that is x' and end with 'nodetype 2 with at least one parent and in between there must be a node of type x that has property y'". Think regex.
  • Example: In the AttackGraph find redundant/superfluous attack steps like AttemptRead -> successfulRead -> Read (this can be used to combine/compress them)
  • Other example: In AttackGraph find nodes with single credentials in the graph (can be used to suggest 2FA)
  • Other example: In AttackGraph find paths from Auth->FullAccess

We might also want to be able to combine patterns from different types of graphs (e.g. Auth->FullAccess in AttackGraph where the asset in the ModelInstance is connected to somethingsomething). Keep this in mind during design.

For this issue:

  • Design the solution
  • Create patterns module for AttackGraph
  • Make it possible to query the module to find patterns in AttackGraph and return chain of nodes
  • Tests
@mrkickling mrkickling self-assigned this May 20, 2024
@andrewbwm andrewbwm added this to the September-November 2024 milestone Jun 4, 2024
@mrkickling mrkickling linked a pull request Dec 4, 2024 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants