-
Notifications
You must be signed in to change notification settings - Fork 3
Description
- We want to be able to query for 'patterns' in AttackGraph, LanguageGraph and Model (this issue is for AttackGraph)
- It should be possible to query for a pattern, this means to find certain types of nodes structured in a specified way
- Patterns (for AttackGraph) would be on format "give me a chain of nodes that start with 'nodetype 1 with only parent that is x' and end with 'nodetype 2 with at least one parent and in between there must be a node of type x that has property y'". Think regex.
- Example: In the AttackGraph find redundant/superfluous attack steps like AttemptRead -> successfulRead -> Read (this can be used to combine/compress them)
- Other example: In AttackGraph find nodes with single credentials in the graph (can be used to suggest 2FA)
- Other example: In AttackGraph find paths from Auth->FullAccess
We might also want to be able to combine patterns from different types of graphs (e.g. Auth->FullAccess in AttackGraph where the asset in the ModelInstance is connected to somethingsomething). Keep this in mind during design.
For this issue:
- Design the solution
- Create patterns module for AttackGraph
- Make it possible to query the module to find patterns in AttackGraph and return chain of nodes
- Tests
Metadata
Metadata
Assignees
Labels
enhancementNew feature or requestNew feature or request