Cyber Ranges (CR) are strategic assets for cyber security that can be used by a wide range of users and for many purposes including cybersecurity education, testing, and research. The main focus of my research includes: exploring new domains and cross-domain scenarios by studying assets, potential weaknesses and vulnerabilities, and specific attack and defense techniques; investigating new enabling technologies and paradigms by leveraging the Digital Twins paradigm; and studying a new model for Attack Graph within the context of Cyber Ranges.
virtualized environments such as Cyber Ranges, particularly those applied to Industrial Control Systems (ICS) and Internet of Things (IoT) devices, my research has extended into the areas of Penetration Testing and Vulnerability Assessment methodologies. This exploration led to the investigation of Attack Graph-based approaches. These methodologies model the process by which an external attacker sequentially executes attacks to progressively gain privileges in any computer system until achieving their ultimate goal of system compromise. In Section 3, I will discuss a novel Attack Graph model and provide an example scenario to demonstrate its practical application.
Digital Twins are defined as dynamic, virtual replicas of physical systems, continuously
synchronized to mirror the real system’s performance and health status throughout its lifecycle [
A dynamic knowledge graph proves to be an ideal basis for digital twins [
The representation in the form of a Knowledge Graph of an entire environment is advantageous from a security standpoint, because through a unified graph view, it is possible to analyze every possible entry point and study the entire attack surface efectively.
It is therefore a fundamental starting point for subsequent studies and analyses to have a good, robust and well-defined knowledge base.
Hence, the first step in this research project will be to finalize the definition of a model for representing Knowledge Graph-Based Digital Twins. Each individual digital twin can be interconnected to other entities. The relationships between DTs will culminate in a Knowledge Graph, which will serve as the representation of the ultimate Cyber Range.
Historically, the idea behind the development of digital twin was to monitor and manage the
performance of physical systems in the context of Industry 4.0 and smart manufacturing. The
construction of a digital twin for a physical item involves three key aspects: (1) identifying the
components and parameters of the physical product in its real environment, (2) establishing
a link between the physical and virtual versions of the product, and (3) integrating data and
information to bridge the virtual and real worlds [
In the context of cybersecurity, digital twin applications have become increasingly
significant [
Notably, digital twins can also act efectively as honeypots, ofering a proactive strategy for
uncovering attack vectors within a network [
In this context, my research concentrates on addressing cybersecurity challenges in ICSs,
with the goal of developing knowledge-based attack graphs that are also physics-aware. This
approach aims to enable the orchestration of targeted attacks, that extends beyond mere denial
of service [
The ever-evolving capabilities of cyber attackers force security administrators to prioritize the early detection of emerging threats. Targeted cyber attacks commonly progress through multiple stages, spanning from the initial reconnaissance of the network environment to the eventual impact on objectives. Multi-step attacks can be conceptualized using the military kill chain concept. The cyber kill chain conceptualizes attacks as sequences of steps. It assumes that the attacker initially identifies suitable targets, then prepares the necessary deliverables, and subsequently transmits them into the environment. Another threat model is provided by attack graphs, which illustrate the paths taken by attackers through the network. Typically, attackers achieve a series of attack steps, where each step grants them certain privileges on protected assets. During my research, I investigated approaches related to Kill Chain Attack Graphs. I studied the approach proposed by Sadlek et al. [25], which combines the kill chain and the attack graph concepts. It allows representing chains of attacker’s actions divided into kill chain phases. According to their definition a Kill Chain Attack Graph (KCAG) is an ordered triple (, , ) where = (, ) denotes a directed graph with vertices and edges . A set contains kill chain phases, and a function assigns kill chain phases to attack techniques. Whereas Sheyner et al. defined an attack graph as a tuple of states, transitions between the states, an initial state and success states [26]. Ou et al. introduced the concept of a logical attack graph, which is a bipartite directed graph consisting of fact and derivation nodes. Each fact node is labeled with a logical statement represented as a predicate applied to its arguments, whereas each derivation node is labeled with an interaction rule utilized in the derivation step. The edges within a logical attack graph denote a "depends on" relation [27].
In the initial phase of my research, I defined an attack graph as a directed graph = (, ), whose vertices are entities and whose edges denote specific relationships or actions. The vertices in this graph are classified into four categories: • Attacker: This vertex represents the knowledge and control an attacker possesses over an asset, underlining the capabilities and potential strategies at their disposal. • Asset: This refers to any component, be it a system, network, or resource, susceptible to cyber threats. • Vulnerabilities and Properties: This category includes the exploitable weaknesses or characteristics of an asset. • Attack Goals: This specifies the final aims or targets the attacker seeks to accomplish, which could range from compromising data integrity to system disruption or control.
Specifically, an attacker’s control over assets is diferentiated into three levels. Level zero indicates unawareness of the asset’s existence. At level one, the attacker is aware of the asset but lacks any control or capability to breach its security. The highest level identifies the attacker’s ability to violate the asset’s security protocols. Next, we have five asset categories: hosts, processes, individuals, technologies, and data. Properties/Vulnerabilities of assets constitute the third type of vertices. They include information about network services, vulnerable applications, user accounts, etc. A vulnerability can be a known Common Vulnerabilities and Exposures (CVE) or a custom vulnerability/bug present in a host, application code, service misconfiguration, and so on.. Attack goals, the fourth vertex type, denote the attacker’s end targets and feature only incoming edges, indicating their terminal nature within the graph.
Furthermore, we have the following types of edges: 1. Edges connecting the first and second vertex types representing steps in the attack progression. 2. Edges linking the second vertex type back to the first (or to an attack goal) illustrate the control level an attacker acquires over an asset post-attack, as part of the attack sequence. 3. Edges from the third to the second vertex type, labeled "hasProperty," associate an asset with its properties or vulnerabilities.
An instance of a possible attack graph is depicted in Figure 1. In this example scenario, a server exposes a web application on port 80. At the first step (0), the attacker does not have knowledge of the services the server is exposing. After a reconnaissance phase, the attacker identifies the presence of a web server and initiates an analysis and testing phase on it (1). At the end of this phase, he has gained further knowledge and discovered that there is a "PDF Converter" functionality on the web server with a known CVE, which allows "remote command injection" and thus a reverse shell on the server. Consequently, by exploiting the CVE (2), the attacker gains access to a reverse shell and achieves Arbitrary Code Execution on the remote server (G). The model introduced aims to provide a comprehensive perspective on the specific attacker’ strategies and processes over a scenario described by means of knowledge-graph.
The domain of Cyber Ranges within the cybersecurity landscape covers a vast range of challenges that can be approached from various perspectives. Currently, there is a lack of comprehensive Knowledge Graph-based models capable of representing any cyber-physical system or object as a Digital Twin. Many existing solutions are not suitable to specific devices such as Industrial Control Systems and IoT devices. Hence, the primary foundational step of this research involves ifnalizing the definition of the general model for representing Digital Twins. Additionally by proposing a new model for Attack Graph within the CR context, this research contributes to advancing the eficacy and versatility of cyber defense strategies. My definition of the attack graph has made it possible to represent threats intuitively and to clearly outline the potential phases of a cyber attack.
This work was partially supported by project SERICS (PE00000014) under the MUR National Recovery and Resilience Plan funded by the European Union – NextGenerationEU. [14] G. Greco, F. Lupia, F. Scarcello, Structural tractability of shapley and banzhaf values in allocation games, in: Proceedings of the Twenty-Fourth International Joint Conference on Artificial Intelligence, IJCAI 2015, Buenos Aires, Argentina, July 25-31, 2015, AAAI Press, 2015, pp. 547–553. [15] S. Saraeian, B. Shirazi, Process mining-based anomaly detection of additive manufacturing process activities using a game theory modeling approach, Computers & Industrial Engineering 146 (2020) 106584. [16] M. Ianni, E. Masciari, Scout: Security by computing outliers on activity logs, Computers & Security 132 (2023) 103355. URL: https://www.sciencedirect.com/science/article/pii/ S0167404823002651. doi:https://doi.org/10.1016/j.cose.2023.103355. [17] G. Greco, A. Guzzo, F. Lupia, L. Pontieri, Process Discovery under Precedence Constraints,
ACM Trans. Knowl. Discov. Data 9 (2015) 32:1–32:39. [18] M. L. Bernardi, M. Cimitile, F. M. Maggi, Data-aware process discovery for malware detection: an empirical study, Mach. Learn. 112 (2023) 1171–1199. [19] C. Greco, M. Ianni, A. Guzzo, G. Fortino, Explaining binary obfuscation, in: 2023 IEEE International Conference on Cyber Security and Resilience (CSR), 2023, pp. 22–27. doi:10. 1109/CSR57506.2023.10224825. [20] F. Lupia, A. Mendicelli, A. Ribichini, F. Scarcello, M. Schaerf, Computing the Shapley value in allocation problems: approximations and bounds, with an application to the Italian VQR research assessment program, J. Exp. Theor. Artif. Intell. 30 (2018) 505–524. [21] G. Greco, F. Lupia, F. Scarcello, The tractability of the shapley value over bounded treewidth matching games, in: Proceedings of the Twenty-Sixth International Joint Conference on Artificial Intelligence, IJCAI 2017, Melbourne, Australia, August 19-25, 2017, ijcai.org, 2017, pp. 1046–1052. URL: https://doi.org/10.24963/ijcai.2017/145. doi:10.24963/IJCAI. 2017/145. [22] F. Buccafurri, V. De Angelis, M. F. Idone, C. Labrini, A protocol for anonymous short communications in social networks and its application to proximity-based services, Online Social Networks and Media 31 (2022) 100221. URL: https://www.sciencedirect.com/science/article/ pii/S2468696422000258. doi:https://doi.org/10.1016/j.osnem.2022.100221. [23] F. Buccafurri, V. De Angelis, M. F. Idone, C. Labrini, S. Lazzaro, Achieving sender anonymity in tor against the global passive adversary, Applied Sciences 12 (2022). URL: https://www. mdpi.com/2076-3417/12/1/137. doi:10.3390/app12010137. [24] F. Buccafurri, V. de Angelis, S. Lazzaro, Mqtt-a: A broker-bridging p2p architecture to achieve anonymity in mqtt, IEEE Internet of Things Journal 10 (2023) 15443–15463. doi:10.1109/JIOT.2023.3264019. [25] L. Sadlek, P. Celeda, D. Tovarnak, Identification of attack paths using kill chain and attack graphs, in: NOMS 2022-2022 IEEE/IFIP Network Operations and Management Symposium, IEEE, 2022. [26] O. Sheyner, J. Haines, S. Jha, R. Lippmann, J. M. Wing, Automated generation and analysis of attack graphs, in: Proceedings 2002 IEEE Symposium on Security and Privacy, IEEE, 2002, pp. 273–284. [27] X. Ou, W. F. Boyer, M. A. McQueen, A scalable approach to attack graph generation, in: Proceedings of the 13th ACM Conference on Computer and Communications Security, CCS ’06, Association for Computing Machinery, New York, NY, USA, 2006, p. 336–345.