use of com.ge.verdict.attackdefensecollector.model.ConnectionModel in project VERDICT by ge-high-assurance.
the class AttackDefenseCollector method loadAttacksDefensesFromCsv.
/**
* Load the attacks and defenses from CAPEC.csv and Defenses.csv, respectively.
*
* <p>This is factored out because it is used by both the CSV and VDM approaches.
*
* @param inputDir the STEM output directory
* @param connectionNameMap the map from connection names in the CSV files to the actual
* connection names
* @throws CSVFile.MalformedInputException
* @throws IOException
*/
private void loadAttacksDefensesFromCsv(String inputDir, Map<String, String> connectionNameMap) throws CSVFile.MalformedInputException, IOException {
// Load all the files as CSV
CSVFile capecCsv = new CSVFile(new File(inputDir, "CAPEC.csv"), true, "CompType", "CompInst", "CAPEC", "CAPECDescription", "Confidentiality", "Integrity", "Availability", "LikelihoodOfSuccess");
CSVFile defensesCsv = new CSVFile(new File(inputDir, "Defenses.csv"), true, "CompType", "CompInst", "CAPEC", "Confidentiality", "Integrity", "Availability", "ApplicableDefenseProperties", "ImplProperties", "DAL");
// Load attacks
for (CSVFile.RowData row : capecCsv.getRowDatas()) {
String systemTypeName = row.getCell("CompType");
String systemInstName = row.getCell("CompInst");
String attackName = row.getCell("CAPEC");
String attackDesc = row.getCell("CAPECDescription");
Prob likelihood = Prob.certain();
// Look at all three columns to figure out which one is being used
CIA cia = CIA.fromStrings(row.getCell("Confidentiality"), row.getCell("Integrity"), row.getCell("Availability"));
if ("Connection".equals(systemTypeName)) {
String connectionName = connectionNameMap.get(systemInstName);
for (ConnectionModel connection : connNameToConnectionModelMap.get(connectionName)) {
connection.getAttackable().addAttack(new Attack(connection.getAttackable(), attackName, attackDesc, likelihood, cia));
}
} else {
SystemModel system = getSystem(systemInstName);
system.getAttackable().addAttack(new Attack(system.getAttackable(), attackName, attackDesc, likelihood, cia));
}
}
// Note we don't use implemented property column in csv files if we vdm as input
for (CSVFile.RowData row : defensesCsv.getRowDatas()) {
String systemTypeName = row.getCell("CompType");
String systemInstName = row.getCell("CompInst");
String attackName = row.getCell("CAPEC");
CIA cia = CIA.fromStrings(row.getCell("Confidentiality"), row.getCell("Integrity"), row.getCell("Availability"));
List<String> defenseNames = Arrays.asList(row.getCell("ApplicableDefenseProperties").split(";")).stream().map(name -> name.length() > 0 ? Character.toString(name.charAt(0)).toLowerCase() + name.substring(1) : "").collect(Collectors.toList());
List<String> implProps = Arrays.asList(row.getCell("ImplProperties").split(";"));
List<String> likelihoodStrings = Arrays.asList(row.getCell("DAL").split(";"));
if (defenseNames.size() != implProps.size() || defenseNames.size() != likelihoodStrings.size()) {
throw new RuntimeException("ApplicableDefenseProperties, ImplProperties, and DAL must have same cardinality");
}
List<Defense> defenses = new ArrayList<>();
List<Defense.DefenseLeaf> clause = new ArrayList<>();
if ("Connection".equals(systemTypeName)) {
String connectionName = connectionNameMap.get(systemInstName);
for (ConnectionModel connection : connNameToConnectionModelMap.get(connectionName)) {
Defense defense = connection.getAttackable().getDefenseByAttackAndCia(attackName, cia);
if (defense == null) {
Attack attack = connection.getAttackable().getAttackByNameAndCia(attackName, cia);
if (attack == null) {
throw new RuntimeException("could not find attack: " + attackName + ", " + cia);
}
defense = new Defense(attack);
connection.getAttackable().addDefense(defense);
}
defenses.add(defense);
}
} else {
SystemModel system = getSystem(systemInstName);
Defense defense = system.getAttackable().getDefenseByAttackAndCia(attackName, cia);
if (defense == null) {
Attack attack = system.getAttackable().getAttackByNameAndCia(attackName, cia);
if (attack == null) {
throw new RuntimeException("could not find attack: " + attackName + ", " + cia);
}
defense = new Defense(attack);
system.getAttackable().addDefense(defense);
}
defenses.add(defense);
}
// TODO get defense descriptions from Defenses2NIST?
// Need to get correct name if connection
String entityName = "Connection".equals(systemTypeName) ? connectionNameMap.get(systemInstName) : systemInstName;
for (int i = 0; i < defenseNames.size(); i++) {
if (!"null".equals(defenseNames.get(i))) {
int dal = -1;
// it will be null if we are not loading from VDM
if (compDefenseToImplDal != null) {
// load DAL from VDM if available
Pair<String, String> pair = new Pair<>(entityName, defenseNames.get(i));
if (compDefenseToImplDal.containsKey(pair)) {
dal = compDefenseToImplDal.get(pair);
} else {
// if there is no binding present, then it is not implemented
dal = 0;
}
}
// this code treats applicable defense and impl defense as separate things
// but we have changed the capitalization so that they should be the same
Optional<Pair<String, Integer>> impl;
if (dal == -1) {
impl = "null".equals(implProps.get(i)) ? Optional.empty() : Optional.of(new Pair<>(implProps.get(i), Integer.parseInt(likelihoodStrings.get(i))));
} else {
impl = dal == 0 ? Optional.empty() : Optional.of(new Pair<>(defenseNames.get(i), dal));
}
clause.add(new Defense.DefenseLeaf(defenseNames.get(i), impl));
}
}
// And there are potentially multiple such rows, forming a DNF
for (Defense defense : defenses) {
defense.addDefenseClause(clause);
}
}
}
use of com.ge.verdict.attackdefensecollector.model.ConnectionModel in project VERDICT by ge-high-assurance.
the class AttackDefenseCollector method performInference.
/**
* Perform inference on the loaded model. Factored out because it is used in both the CSV and
* VDM approaches. Must be called after systems and cyber relations are loaded.
*/
private void performInference() {
int inferenceCounter = 0;
for (SystemModel system : sysNameToSystemModelMap.values()) {
// because we don't want to infer cyber relations for a system with subcomponents
if (system.getCyberRels().isEmpty() && system.getInternalIncomingConnections().isEmpty() && system.getInternalOutgoingConnections().isEmpty()) {
Logger.println("Inferring cyber relations for system " + system.getName());
// anyway because it can't be traced.
for (ConnectionModel outgoing : system.getOutgoingConnections()) {
if (!system.getIncomingConnections().isEmpty()) {
// For each of C, I, A, we have X -> X
for (CIA cia : CIA.values()) {
CyberExpr condition = new CyberOr(system.getIncomingConnections().stream().map(incoming -> new PortConcern(incoming.getDestinationPortName(), cia)).collect(Collectors.toList()));
system.addCyberRel(new CyberRel("_inference" + (inferenceCounter++), condition, new PortConcern(outgoing.getSourcePortName(), cia)));
}
// We also have I -> A
system.addCyberRel(new CyberRel("_inference" + (inferenceCounter++), new CyberOr(system.getIncomingConnections().stream().map(incoming -> new PortConcern(incoming.getDestinationPortName(), CIA.I)).collect(Collectors.toList())), new PortConcern(outgoing.getSourcePortName(), CIA.A)));
}
}
}
}
}
use of com.ge.verdict.attackdefensecollector.model.ConnectionModel in project VERDICT by ge-high-assurance.
the class DependentRules method getComponentDependence.
public static Optional<ADTree> getComponentDependence(SystemModel component, String attackName) {
List<ADTree> paths = new ArrayList<>();
switch(attackName) {
case "CAPEC-21":
for (ConnectionModel connection : component.getIncomingConnections()) {
if ("Untrusted".equals(connection.getAttributes().get("connectionType"))) {
// Vul-CAPEC-21-1
paths.add(new DefenseCondition(connection.getAttackable(), "deviceAuthentication", 1));
}
}
for (ConnectionModel connection : component.getOutgoingConnections()) {
if ("Untrusted".equals(connection.getAttributes().get("connectionType"))) {
// Vul-CAPEC-21-2
paths.add(new DefenseCondition(connection.getAttackable(), "deviceAuthentication", 1));
}
}
return mkRet(component.getAttackable(), attackName, paths);
case "CAPEC-112":
for (ConnectionModel connection : component.getIncomingConnections()) {
// Vul-CAPEC-112-1, Vul-CAPEC-112-3, Vul-CAPEC-112-5
paths.add(new DefenseCondition(connection.getAttackable(), "deviceAuthentication", 1));
// Vul-CAPEC-112-2, Vul-CAPEC-112-4, Vul-CAPEC-112-6
paths.add(new DefenseCondition(connection.getAttackable(), "encryptedTransmission", 1));
}
return mkRet(component.getAttackable(), attackName, paths);
case "CAPEC-114":
for (ConnectionModel connection : component.getIncomingConnections()) {
// Vul-CAPEC-114-1, Vul-CAPEC-114-2, Vul-CAPEC-114-3
paths.add(new DefenseCondition(connection.getAttackable(), "deviceAuthentication", 1));
}
return mkRet(component.getAttackable(), attackName, paths);
case "CAPEC-115":
for (ConnectionModel connection : component.getIncomingConnections()) {
// Vul-CAPEC-115-1, Vul-CAPEC-115-2, Vul-CAPEC-115-3
paths.add(new DefenseCondition(connection.getAttackable(), "deviceAuthentication", 1));
}
return mkRet(component.getAttackable(), attackName, paths);
case "CAPEC-390":
paths.add(new DefenseCondition(component.getAttackable(), "physicalAccessControl", 1));
return mkRet(component.getAttackable(), attackName, paths);
default:
return Optional.empty();
}
}
Aggregations