MulVAL: a logic-based network security analyzer

摘要: To determine the security impact software vulnerabilities have on a particular network, one must consider interactions among multiple network elements. For vulnerability analysis tool to be useful in practice, two features are crucial. First, model used able automatically integrate formal specifications from bug-reporting community. Second, scale networks with thousands of machines. We show how achieve these goals by presenting MulVAL, an end-to-end framework and reasoning system that conducts multihost, multistage network. MulVAL adopts Datalog as modeling language for elements (bug specification, configuration description, rules, operating-system permission privilege model, etc.). We easily leverage existing vulnerability-database scanning tools expressing their output feeding it our engine. Once information is collected, can performed seconds implemented Red Hat Linux platform. Our reason about 84% bugs reported OVAL, definition language. tested real hundreds users. The detected policy violation caused administrators took remediation measures.