Cyberattack Experimentation as Code for Reproducibility and Analyzability
COM3 Level 2
MR21, COM3 02-61
Abstract:
The advanced and covert characteristics of Advanced Persistent Threats (APT) campaigns complicate cyberattack analysis, and the limited, fragmented availability of cyberattack information further impedes understanding. An effective approach is to reproduce incidents in isolated testbeds, thereby enabling systematic observation, comprehensive telemetry, and rigorous validation of defences. Although reproducing cyberattacks avoids dependence on compromised systems, this approach is labor-intensive, inconsistently reproducible, and unable to reflect real-world complexity. To address these limitations, we propose CRADLE, a DSL that systematically encodes cyberattack semantics as code, establishing the foundation for a range of applications in cyberattack analysis.
This thesis advances the understanding of complex cyberattacks by examining them through two complementary perspectives across three studies. The system-level perspective first investigates the reproducibility of the cyberattack based on the attack semantics defined in CRADLE, thereby generating indicators suitable for data-driven cyberattack analysis. We subsequently investigate the applicability of CRADLE for static reasoning about computing infrastructure, with a focus on vulnerability identification and exploitability analysis. From the code-level perspective, we examine code employing contemporary obfuscation techniques to identify malicious behaviors, potentially enabling the incorporation of newly observed patterns into CRADLE as future revisions to its underlying primitives and constraints. As a whole, these perspectives motivate the unification of heterogeneous cyberattack information, materially advancing the rigor and effectiveness of understanding complex cyberattacks.