Upgrade to Pro — share decks privately, control downloads, hide ads and more …

An Introduction to Graph Theory for Security People Who Can’t 'Math Good'

7eaca7b954a0966ed47bda102a669af9?s=47 Andrew Hay
September 25, 2017

An Introduction to Graph Theory for Security People Who Can’t 'Math Good'

This session aims to gently introduce graph theory and the applied use of graphs for people who, like the speaker, consider themselves lacking the often perceived advanced math, science and computer programming knowledge needed to harness their power. The applied use of graphs will be discussed to help attendees track security threats, build attacker profiles and better understand organizational risk based on introducing new tools, processes or legal requirements.

Attendees may not leave with a Ph.D., but they’ll certainly walk away with a firmer understanding of graph theory and how to construct, deploy and maintain graphs for security and compliance initiatives within their organization.

Learning Objectives:

- Have a firm understanding of graph theory and the applied use of graphs for security tasks
- Track security threats, construct attacker profiles and use graphs to better understand organizational risk
- Walk away with a firmer understanding of graph theory and how to construct, deploy and maintain graphs for security and compliance initiatives within their organization

7eaca7b954a0966ed47bda102a669af9?s=128

Andrew Hay

September 25, 2017
Tweet

Transcript

  1. None
  2. An Introduction to Graph Theory for Security People Who Can’t

    Math Good Andrew Hay, CISSP
  3. Session Overview » A gentle introduction to graph theory »

    Graphs in every day life » Freely available tools » The application of graphs in a security context » Summary & Application
  4. A Gentle Introduction to Graph Theory

  5. If You’re Anything Like Me… » You completely zone out

    when you see something like this source: http://article.sapub.org/10.5923.j.am.20150505.01.html
  6. What Is A Graph? 0 1 2 3 4 5

    A B C
  7. A Graph Is… » A graph is a collection of

    • vertices (i.e. nodes, dots) - where a vertex is an entity which represents some object (e.g. a person, a place, etc.) • edges (i.e. relationships, lines) - where an edge represents the relationship between two vertices source: http://tinkerpop.apache.org/
  8. A Graph Is (continued)… » Diagram above shows a graph

    with two vertices • One with a unique identifier of 1 • Another with a unique identifier of 3 » There is an edge connecting the two with a unique identifier of 9 » It is important to consider that the edge has a direction which goes out from vertex 1 and in to vertex 3 source: http://tinkerpop.apache.org/
  9. A Graph Is (continued)… » To give some meaning to

    this basic structure, vertices and edges can each be given labels to categorize them » You can now see that a vertex 1 is a person and vertex 3 is a software vertex source: http://tinkerpop.apache.org/
  10. A Graph Is (continued)… » They are joined by a

    created edge which allows you to see that a person created software » The label and the id are reserved attributes of vertices and edges, but you can add your own arbitrary properties as well source: http://tinkerpop.apache.org/
  11. What Is A Graph? 0 1 2 3 4 5

    A B C
  12. So…What Is A Graph? Chart Graph Plot 0 1 2

    3 4 5
  13. A Little More Advanced Graph Theory » You’ll often hear

    the words network and graph used interchangeably…and there is nothing wrong with that » If the edges in a network are directed (i.e. pointing in only one direction) the network is called a directed network or a directed graph, sometimes digraph for short » When drawing a directed network, the edges are typically drawn as arrows indicating the direction source: http://mathinsight.org/definition/network
  14. A Little More Advanced Graph Theory » If all edges

    are bidirectional, or undirected, the network is an undirected network (or undirected graph) source: http://mathinsight.org/definition/network
  15. A Little More Advanced Graph Theory » Variations • A

    small undirected network where the nodes and edges have different types, as indicated by their colors and line styles • A small directed network where the edges and nodes have different weights, as indicated by their sizes source: http://mathinsight.org/image/small_undirected_node_edge_types_network source: http://mathinsight.org/image/small_directed_weighted_nodes_edges_network
  16. Graphs In Every Day Life

  17. Graphs in Every Day Life: Internet » Everyone has seen

    a visual representation of the Internet » Often, colors indicate operator of network, country, etc. » Structure determined by sending a storm of IP packets out randomly across the network » Each packet is programmed to self-destruct after a delay, and when this happens, the packet failure notice reports back the path the packet took before it died source: http://mathinsight.org/image/internet_map_jurvetson_2004
  18. Graphs in Every Day Life: TSP » Travelling salesman problem

    (TSP) • "Given a list of cities and the distances between each pair of cities, what is the shortest possible route that visits each city exactly once and returns to the origin city?” source: https://www.mathworks.com/help/optim/examples/travelling-salesman-problem.html
  19. Graphs in Every Day Life: More Examples… » Mapping •

    Google maps, self-driving cars, etc. • “Hey, Siri, how do I get to 1 Main Street?” » Perception/Attitude Analysis • What hashtags are trending right now? • Which Presidential candidate is being talked about most on which social media platform? » And, of course, security! source: https://datasemantics.files.wordpress.com/2013/12/graph3.png
  20. Freely Available Tools Including clients, databases, and programming modules

  21. Tools: Google Fusion Tables » support.google.com/fusiontables/answer/2566732 ?hl=en – Network Graph

    • Basic network mapping tool • Some useful filter functionality • Lacks the deep customization options and analysis functionality • Can produce insightful visualizations » developers.google.com/fusiontables • Create, update, and delete tables and table data • Issue SQL-like queries
  22. Tools: Graphviz » www.graphviz.org • Open source graph visualization software

    • The Graphviz layout programs take descriptions of graphs in a simple text language, and make diagrams in useful formats - Images, SVG, PDF, Postscript , interactive graph browser • Many useful features for diagrams - options for colors, fonts, tabular node layouts, line styles, hyperlinks, and custom shapes source: http://www.graphviz.org/content/profile
  23. Tools: Visual Investigate Scenarios (VIS) » vis.occrp.org • Designed to

    assist investigative journalists, activists and others in mapping complex business or crime networks • Help investigators understand and explain corruption, organized crime and other wrongdoings and to translate complex narratives into simple, universal visual language • Customizable, dynamic html5 visualization templates • Illustrate entities, networks and complex configurations of data
  24. Tools: Gephi » gephi.org • Desktop tool for performing powerful

    network analysis and creating network visualizations • Described as being like Photoshop™ but for graph data • The user interacts with the representation, manipulate the structures, shapes and colors to reveal hidden patterns • Designed to help data analysts to make hypothesis, intuitively discover patterns, isolate structure singularities or faults during data sourcing source: https://gephi.org/screenshots/
  25. Tools: OpenGraphiti » www.opengraphiti.com • OpenGraphiti is a free and

    open source 3D data visualization engine created by Thibault Reuille of OpenDNS • Designed for data scientists to visualize semantic networks and to work with them • It offers an easy-to-use API with several associated libraries to create custom-made datasets
  26. Tools: Maltego » www.paterva.com/web7/buy/malte go-clients/maltego-ce.php • Maltego CE is the

    community editio • Available for free for everyone after a quick registration • Interactive data mining tool • Renders directed graphs for link analysis • Used in online investigations for finding relationships between pieces of information from various sources located on the Internet source: www.paterva.com
  27. Tools: Maltego (continued…) » www.paterva.com/web7/buy/malte go-clients/casefile.php • CaseFile is Paterva's

    answer to the offline intelligence problem • Allows for analysts to examine links between offline data • Same graphing application as Maltego without the ability to run transforms • CaseFile gives you the ability to quickly add, link and analyze data source: www.paterva.com
  28. Graph Databases: neo4j » neo4j.com • Graph database management system

    developed by Neo Technology, Inc • ACID-compliant transactional database with native graph storage and processing • Implemented in Java • Accessible from software written in other languages using the Cypher Query Language • Exposes a transactional HTTP endpoint source: https://neo4j.com/
  29. Graph Databases: OrientDB » orientdb.com • Open source NoSQL database

    management system • Written in Java • Multi-model database, supporting graph, document, key/value, and object models • Relationships are managed as in graph databases with direct connections between records • Supports schema-less, schema-full, and schema-mixed modes source: http://orientdb.com/orientdb/
  30. Graph Databases: Titan » titan.thinkaurelius.com • Scalable graph database optimized

    for - Storing and querying graphs - Containing hundreds of billions of vertices and edges - Distributed across a multi-machine cluster • Support for various storage backends • Support for global graph data analytics, reporting, and ETL through integration with big data platforms • Native integration with the TinkerPop graph stack source: http://titan.thinkaurelius.com/
  31. Graph Stack: Apache TinkerPop » tinkerpop.apache.org • Open source Graph

    Computing Framework • Goal is to make it easy for developers to create graph applications by providing APIs and tools that simplify their endeavors • Abstraction layer over different graph databases and different graph processors • As an abstraction layer, TinkerPop provides a way to avoid vendor lock-in to a specific database or processor source: https://tinkerpop.apache.org/
  32. Development Modules » NetworkX • networkx.github.io • Package for the

    creation, manipulation, and study of the structure, dynamics, and functions of complex networks » Graph-tool • graph-tool.skewed.de • Manipulation and statistical analysis of graphs » SNAP for Python • snap.stanford.edu/snappy/ • General purpose, high performance system for analysis and manipulation of large networks • Written in C++ and optimized for maximum performance and compact graph representation • Scales to massive networks with hundreds of millions of nodes, and billions of edges
  33. Development Modules » semanticnet • github.com/ThibaultReuille/semanticnet • Small python library

    to create semantic graphs in JSON • Datasets can then be visualized with OpenGraphiti » Plotly for Python • plot.ly/ipython- notebooks/network-graphs • Store position as node attribute data • Add, change, delete nodes, node color, connections, etc.
  34. Development Modules » vis.js • visjs.org • Designed to be

    easy to use, to handle large amounts of dynamic data, and to enable manipulation of and interaction with the data » sigmajs • sigmajs.org • Allows developers to integrate network exploration in rich Web applications » JSNetworkX • jsnetworkx.org • JavaScript port of the NetworkX graph library » Cytoscape.js • js.cytoscape.org • Fully featured graph library written in pure JS • Designed for users first, for both front facing app and developer use cases
  35. The Application Of Graphs In A Security Context

  36. Scenario: Incident Response The Application Of Graphs In A Security

    Context
  37. Scenario: Incident Response » “We had a data breach, what

    was taken, and who was involved?” Mary Rahim Stu SSN CC
  38. Scenario: Incident Response Mary Rahim Stu SSN CC » “We

    had a data breach, what was taken, and who was involved?”
  39. Scenario: Incident Response Stu SSN CC HTTP Proxy upload download

    » “We had a data breach, what was taken, and who was involved?”
  40. Scenario: Incident Response Stu SSN CC HTTP Proxy upload download

    » “We had a data breach, what was taken, and who was involved?”
  41. Scenario: Incident Response » What would this look like in

    a tool? » Using Google’s experimental Fusion Tables we can easily graph this » Easy to show links, directionality, and node colors
  42. Scenario: Incident Response » Type by Name shows who has

    interacted with what data
  43. Scenario: Incident Response » Action by Name shows who has

    performed what actions
  44. Scenario: Actor Tracking The Application Of Graphs In A Security

    Context
  45. Scenario: Actor Tracking » “New Phishing Campaign Targets South-East Asia”*

    • http://www.minerva-labs.com/post/new-phishing- campaign-targets-south-east-asia » Malware variant that was distributed via phishing emails in south-east Asia. » The binary mimicked Navicat and had multiple info- stealing capabilities - and possibly a later stage POS oriented module. * source: https://app.threatconnect.com/auth/incident/incident.xhtml?incident=3440670
  46. Scenario: Actor Tracking » Let’s load the indicators of compromise

    (IOC) from the blog post into a tool » This time, we’ll use Maltego Community Edition (CE) source: www.paterva.com
  47. Scenario: Actor Tracking » Add the various elements that you

    want to track • Hashes • Domains • IP addresses • Email addresses • etc.
  48. Scenario: Actor Tracking » Use the transforms to enrich the

    data • VirusTotal Public • ThreatCrowd • PassiveTotal - Get Passive DNS with Time - Get Whois Details - Whois Search by Email Address » Avoid running “All Transforms”
  49. Scenario: Actor Tracking » asdf

  50. Scenario: Actor Tracking » Zooming in we can see interesting

    associations…like how the malware hashes are being recognized
  51. Scenario: Actor Tracking » Zooming in we can see interesting

    associations…like how the domains are associated with the same registrant email address
  52. Scenario: Actor Tracking » Zooming in we can see interesting

    associations…like how the domains are associated with the same and IP address
  53. Scenario: Actor Tracking » We can also enrich the data

    with…all of the other domains registered using that email address
  54. Scenario: Actor Tracking » As you can imagine, this can

    quickly get out of hand…
  55. General Suggestions » Just because you CAN graph or run

    a transform on something… » Consider using only the data you need for a particular task or project » If you want to experiment with different transforms, data points, nodes, edges, etc…
  56. General Suggestions » Just because you CAN graph or run

    a transform on something… » Consider using only the data you need for a particular task or project » If you want to experiment with different transforms, data points, nodes, edges, etc… USE A NEW GRAPH AND DON’T TINKER WITH THE MAIN ONE
  57. Summary & Application

  58. Summary » The general application of graph theory doesn’t require

    an advanced degree in mathematics • Especially once you know the basics » The connection of related information (read: nodes & edges) helps represent the data • Both visually and programmatically » There are a growing number of tools to help create graph associations, store graph data, and programmatically traverse and modify said data • Pick what works best for you and your environment source: https://en.wikipedia.org/wiki/Travelling_salesman_problem
  59. Apply What You Have Learned Today » Next week you

    should: • Take a look at the various free tools and see which one(s) resonate » In the first three months following this presentation you should: • Begin graphing connections for a simple project (e.g. threat actor tracking) • Use your graph project to teach your team or peers the value » Within six months you should: • Have a firm grasp of your own graph project • Look to introduce graph relationships, where applicable, to current security projects
  60. Thank You, Questions? » Andrew Hay, CISSP » Co-Founder &

    CTO, LEO Cyber Security • email: andrew.hay@leocybersecurity.com • mobile: +1.415.940.9660 • twitter: @andrewsmhay • linkedin: http://www.linkedin.com/in/andrewhay • schedule a meeting: https://ahay.acuityscheduling.com
  61. None