vaspera 2.5.0

package/dist/compliance/frameworks/mitre-atlas.js

@@ -0,0 +1,686 @@
+/**
+ * MITRE ATLAS Compliance Framework
+ *
+ * Maps security findings to MITRE ATLAS (Adversarial Threat Landscape for
+ * Artificial-Intelligence Systems) techniques. ATLAS provides a knowledge
+ * base of adversary tactics and techniques against AI systems.
+ *
+ * @see https://atlas.mitre.org/
+ * @module compliance/frameworks/mitre-atlas
+ */
+/**
+ * MITRE ATLAS Controls mapped from techniques
+ *
+ * Based on ATLAS Matrix version 4.5 (2024).
+ * Controls are derived from ATLAS techniques and mapped to finding categories.
+ */
+export const MITRE_ATLAS_CONTROLS = [
+    // ============================================================================
+    // Reconnaissance Techniques
+    // ============================================================================
+    {
+        id: "AML.T0000",
+        framework: "MITRE-ATLAS",
+        category: "Reconnaissance",
+        title: "Search for Victim's Publicly Available Research Materials",
+        description: "Adversaries may search for information about victim ML capabilities through research papers, blog posts, and documentation that reveal model architectures or training approaches.",
+        keywords: [
+            "reconnaissance",
+            "public research",
+            "model architecture",
+            "documentation",
+        ],
+        findingCategories: [
+            "sensitive-disclosure",
+        ],
+        severityThreshold: "low",
+    },
+    {
+        id: "AML.T0001",
+        framework: "MITRE-ATLAS",
+        category: "Reconnaissance",
+        title: "Search Public ML Model Repositories",
+        description: "Adversaries may search public model repositories (HuggingFace, GitHub) to find models that can be used as starting points for attacks or to understand target systems.",
+        keywords: [
+            "model repositories",
+            "huggingface",
+            "public models",
+        ],
+        findingCategories: [
+            "supply-chain-vuln",
+        ],
+        severityThreshold: "low",
+    },
+    {
+        id: "AML.T0002",
+        framework: "MITRE-ATLAS",
+        category: "Reconnaissance",
+        title: "Discover ML Model Ontology",
+        description: "Adversaries gather information about an ML model's structure, inputs, outputs, and capabilities through direct or indirect queries.",
+        keywords: [
+            "model ontology",
+            "model structure",
+            "api probing",
+        ],
+        findingCategories: [
+            "model-theft",
+            "sensitive-disclosure",
+        ],
+        severityThreshold: "medium",
+    },
+    // ============================================================================
+    // Resource Development Techniques
+    // ============================================================================
+    {
+        id: "AML.T0010",
+        framework: "MITRE-ATLAS",
+        category: "Resource Development",
+        title: "Acquire Public ML Artifacts",
+        description: "Adversaries may acquire publicly available ML models, datasets, or tools to use in their attacks against victim systems.",
+        keywords: [
+            "public artifacts",
+            "pretrained models",
+            "datasets",
+        ],
+        findingCategories: [
+            "supply-chain-vuln",
+        ],
+        severityThreshold: "low",
+    },
+    {
+        id: "AML.T0011",
+        framework: "MITRE-ATLAS",
+        category: "Resource Development",
+        title: "Develop Adversarial ML Tools",
+        description: "Adversaries develop or acquire tools specifically designed to attack ML systems, including prompt injection frameworks, model extraction tools, or adversarial example generators.",
+        keywords: [
+            "adversarial tools",
+            "attack frameworks",
+            "jailbreak tools",
+        ],
+        findingCategories: [
+            "prompt-injection",
+        ],
+        severityThreshold: "medium",
+    },
+    {
+        id: "AML.T0012",
+        framework: "MITRE-ATLAS",
+        category: "Resource Development",
+        title: "Poison Training Data",
+        description: "Adversaries may poison public or private training datasets to embed backdoors or biases in models trained on that data.",
+        keywords: [
+            "data poisoning",
+            "training data",
+            "backdoors",
+        ],
+        findingCategories: [
+            "training-data-poisoning",
+            "integrity-failure",
+        ],
+        severityThreshold: "critical",
+    },
+    // ============================================================================
+    // Initial Access Techniques
+    // ============================================================================
+    {
+        id: "AML.T0020",
+        framework: "MITRE-ATLAS",
+        category: "Initial Access",
+        title: "Supply Chain Compromise",
+        description: "Adversaries may compromise supply chain components including ML frameworks, model repositories, or dependency packages to gain access to target systems.",
+        keywords: [
+            "supply chain",
+            "compromised packages",
+            "malicious dependencies",
+        ],
+        findingCategories: [
+            "supply-chain-vuln",
+            "dependency-vuln",
+            "vulnerable-component",
+        ],
+        severityThreshold: "critical",
+    },
+    {
+        id: "AML.T0021",
+        framework: "MITRE-ATLAS",
+        category: "Initial Access",
+        title: "Publish Poisoned Model",
+        description: "Adversaries publish poisoned or backdoored models to public repositories, hoping targets will download and deploy them.",
+        keywords: [
+            "poisoned model",
+            "backdoored model",
+            "malicious model",
+        ],
+        findingCategories: [
+            "supply-chain-vuln",
+            "training-data-poisoning",
+        ],
+        severityThreshold: "critical",
+    },
+    {
+        id: "AML.T0022",
+        framework: "MITRE-ATLAS",
+        category: "Initial Access",
+        title: "Compromise ML Development Environment",
+        description: "Adversaries compromise ML development environments (notebooks, training pipelines) to inject malicious code or modify models.",
+        keywords: [
+            "development environment",
+            "notebooks",
+            "training pipeline",
+        ],
+        findingCategories: [
+            "code-injection",
+            "integrity-failure",
+        ],
+        severityThreshold: "critical",
+    },
+    // ============================================================================
+    // ML Model Access Techniques
+    // ============================================================================
+    {
+        id: "AML.T0030",
+        framework: "MITRE-ATLAS",
+        category: "ML Model Access",
+        title: "ML API Exploitation",
+        description: "Adversaries exploit APIs that provide access to ML models to perform attacks like model extraction, prompt injection, or data exfiltration.",
+        keywords: [
+            "api exploitation",
+            "model api",
+            "inference api",
+        ],
+        findingCategories: [
+            "prompt-injection",
+            "model-theft",
+            "auth-bypass",
+        ],
+        severityThreshold: "high",
+    },
+    {
+        id: "AML.T0031",
+        framework: "MITRE-ATLAS",
+        category: "ML Model Access",
+        title: "Prompt Injection",
+        description: "Adversaries craft inputs that manipulate an LLM to execute unintended actions, bypass safety controls, or leak sensitive information.",
+        keywords: [
+            "prompt injection",
+            "jailbreak",
+            "instruction override",
+        ],
+        findingCategories: [
+            "prompt-injection",
+            "injection",
+        ],
+        severityThreshold: "critical",
+    },
+    {
+        id: "AML.T0032",
+        framework: "MITRE-ATLAS",
+        category: "ML Model Access",
+        title: "Indirect Prompt Injection",
+        description: "Adversaries inject malicious prompts through external data sources (documents, websites) that the LLM processes, causing it to execute attacker instructions.",
+        keywords: [
+            "indirect injection",
+            "external data",
+            "rag poisoning",
+        ],
+        findingCategories: [
+            "prompt-injection",
+            "insecure-plugin",
+        ],
+        severityThreshold: "critical",
+    },
+    // ============================================================================
+    // Execution Techniques
+    // ============================================================================
+    {
+        id: "AML.T0040",
+        framework: "MITRE-ATLAS",
+        category: "Execution",
+        title: "User Execution of Malicious Prompt",
+        description: "Adversaries trick users into executing malicious prompts that exploit the LLM to perform unauthorized actions.",
+        keywords: [
+            "user execution",
+            "social engineering",
+            "malicious prompt",
+        ],
+        findingCategories: [
+            "prompt-injection",
+        ],
+        severityThreshold: "high",
+    },
+    {
+        id: "AML.T0041",
+        framework: "MITRE-ATLAS",
+        category: "Execution",
+        title: "Unsafe Model Loading",
+        description: "Adversaries exploit unsafe model deserialization to execute arbitrary code when a model file is loaded (pickle, joblib, torch.load).",
+        keywords: [
+            "unsafe loading",
+            "deserialization",
+            "pickle",
+            "code execution",
+        ],
+        findingCategories: [
+            "code-injection",
+            "supply-chain-vuln",
+        ],
+        severityThreshold: "critical",
+    },
+    {
+        id: "AML.T0042",
+        framework: "MITRE-ATLAS",
+        category: "Execution",
+        title: "Plugin/Tool Abuse",
+        description: "Adversaries abuse LLM plugins or tools to execute unauthorized actions, access sensitive data, or escape the intended sandbox.",
+        keywords: [
+            "plugin abuse",
+            "tool exploitation",
+            "mcp",
+            "function calling",
+        ],
+        findingCategories: [
+            "insecure-plugin",
+            "excessive-agency",
+            "missing-sandbox",
+        ],
+        severityThreshold: "critical",
+    },
+    // ============================================================================
+    // Persistence Techniques
+    // ============================================================================
+    {
+        id: "AML.T0050",
+        framework: "MITRE-ATLAS",
+        category: "Persistence",
+        title: "Poison Fine-Tuning Data",
+        description: "Adversaries poison fine-tuning datasets to embed persistent backdoors or biases that survive model updates.",
+        keywords: [
+            "fine-tuning poisoning",
+            "persistent backdoor",
+            "model corruption",
+        ],
+        findingCategories: [
+            "training-data-poisoning",
+        ],
+        severityThreshold: "critical",
+    },
+    {
+        id: "AML.T0051",
+        framework: "MITRE-ATLAS",
+        category: "Persistence",
+        title: "Inject Persistent System Prompt",
+        description: "Adversaries inject persistent instructions into system prompts or configuration that persist across sessions.",
+        keywords: [
+            "persistent prompt",
+            "system prompt injection",
+            "configuration tampering",
+        ],
+        findingCategories: [
+            "prompt-injection",
+            "manifest-drift",
+        ],
+        severityThreshold: "high",
+    },
+    // ============================================================================
+    // Defense Evasion Techniques
+    // ============================================================================
+    {
+        id: "AML.T0060",
+        framework: "MITRE-ATLAS",
+        category: "Defense Evasion",
+        title: "Evade ML-Based Detection",
+        description: "Adversaries craft inputs to evade ML-based security controls like content filters, spam detectors, or prompt injection classifiers.",
+        keywords: [
+            "detection evasion",
+            "filter bypass",
+            "adversarial examples",
+        ],
+        findingCategories: [
+            "prompt-injection",
+        ],
+        severityThreshold: "high",
+    },
+    {
+        id: "AML.T0061",
+        framework: "MITRE-ATLAS",
+        category: "Defense Evasion",
+        title: "Obfuscate Malicious Prompts",
+        description: "Adversaries obfuscate malicious prompts using encoding, unicode tricks, or semantic variations to bypass detection.",
+        keywords: [
+            "obfuscation",
+            "encoding",
+            "unicode",
+            "homoglyphs",
+        ],
+        findingCategories: [
+            "prompt-injection",
+        ],
+        severityThreshold: "high",
+    },
+    // ============================================================================
+    // Discovery Techniques
+    // ============================================================================
+    {
+        id: "AML.T0070",
+        framework: "MITRE-ATLAS",
+        category: "Discovery",
+        title: "Discover Model Architecture",
+        description: "Adversaries probe the ML system to discover model architecture, hyperparameters, and capabilities through API queries.",
+        keywords: [
+            "model discovery",
+            "architecture probing",
+            "fingerprinting",
+        ],
+        findingCategories: [
+            "model-theft",
+            "sensitive-disclosure",
+        ],
+        severityThreshold: "medium",
+    },
+    {
+        id: "AML.T0071",
+        framework: "MITRE-ATLAS",
+        category: "Discovery",
+        title: "Extract System Prompt",
+        description: "Adversaries craft prompts to extract the system prompt or hidden instructions from an LLM application.",
+        keywords: [
+            "system prompt extraction",
+            "prompt leakage",
+            "instruction disclosure",
+        ],
+        findingCategories: [
+            "prompt-injection",
+            "sensitive-disclosure",
+        ],
+        severityThreshold: "high",
+    },
+    {
+        id: "AML.T0072",
+        framework: "MITRE-ATLAS",
+        category: "Discovery",
+        title: "Enumerate Available Tools",
+        description: "Adversaries enumerate available tools, plugins, or functions that the LLM can invoke to identify attack vectors.",
+        keywords: [
+            "tool enumeration",
+            "plugin discovery",
+            "capability mapping",
+        ],
+        findingCategories: [
+            "sensitive-disclosure",
+            "insecure-plugin",
+        ],
+        severityThreshold: "medium",
+    },
+    // ============================================================================
+    // Collection Techniques
+    // ============================================================================
+    {
+        id: "AML.T0080",
+        framework: "MITRE-ATLAS",
+        category: "Collection",
+        title: "Data from ML Model",
+        description: "Adversaries extract training data, memorized information, or sensitive data from ML models through carefully crafted queries.",
+        keywords: [
+            "data extraction",
+            "memorization",
+            "training data leakage",
+        ],
+        findingCategories: [
+            "sensitive-disclosure",
+            "pii-exposure",
+        ],
+        severityThreshold: "high",
+    },
+    {
+        id: "AML.T0081",
+        framework: "MITRE-ATLAS",
+        category: "Collection",
+        title: "Credential Harvesting via LLM",
+        description: "Adversaries use the LLM to access or reveal credentials, API keys, or authentication tokens.",
+        keywords: [
+            "credential harvesting",
+            "api key extraction",
+            "secret disclosure",
+        ],
+        findingCategories: [
+            "hardcoded-secret",
+            "credential-overscoped",
+            "exfil-path",
+        ],
+        severityThreshold: "critical",
+    },
+    // ============================================================================
+    // ML Attack Staging Techniques
+    // ============================================================================
+    {
+        id: "AML.T0090",
+        framework: "MITRE-ATLAS",
+        category: "ML Attack Staging",
+        title: "Create Proxy Model",
+        description: "Adversaries create a proxy/substitute model that mimics the target model's behavior for developing attacks offline.",
+        keywords: [
+            "proxy model",
+            "substitute model",
+            "model cloning",
+        ],
+        findingCategories: [
+            "model-theft",
+        ],
+        severityThreshold: "medium",
+    },
+    {
+        id: "AML.T0091",
+        framework: "MITRE-ATLAS",
+        category: "ML Attack Staging",
+        title: "Generate Adversarial Examples",
+        description: "Adversaries generate inputs specifically crafted to cause the model to produce incorrect or malicious outputs.",
+        keywords: [
+            "adversarial examples",
+            "perturbations",
+            "attack generation",
+        ],
+        findingCategories: [
+            "prompt-injection",
+        ],
+        severityThreshold: "high",
+    },
+    // ============================================================================
+    // Exfiltration Techniques
+    // ============================================================================
+    {
+        id: "AML.T0100",
+        framework: "MITRE-ATLAS",
+        category: "Exfiltration",
+        title: "Model Extraction",
+        description: "Adversaries extract a copy of the ML model through repeated queries, allowing them to steal intellectual property or prepare offline attacks.",
+        keywords: [
+            "model extraction",
+            "model stealing",
+            "api abuse",
+        ],
+        findingCategories: [
+            "model-theft",
+        ],
+        severityThreshold: "critical",
+    },
+    {
+        id: "AML.T0101",
+        framework: "MITRE-ATLAS",
+        category: "Exfiltration",
+        title: "Exfiltrate Data via Model Output",
+        description: "Adversaries use the model as a covert channel to exfiltrate sensitive data by encoding it in model outputs.",
+        keywords: [
+            "data exfiltration",
+            "covert channel",
+            "output encoding",
+        ],
+        findingCategories: [
+            "exfil-path",
+            "sensitive-disclosure",
+        ],
+        severityThreshold: "critical",
+    },
+    {
+        id: "AML.T0102",
+        framework: "MITRE-ATLAS",
+        category: "Exfiltration",
+        title: "Exfiltrate via Tool Call",
+        description: "Adversaries use LLM tool/function calls to exfiltrate data to external systems through authorized network channels.",
+        keywords: [
+            "tool exfiltration",
+            "function call abuse",
+            "data theft",
+        ],
+        findingCategories: [
+            "exfil-path",
+            "insecure-plugin",
+        ],
+        severityThreshold: "critical",
+    },
+    // ============================================================================
+    // Impact Techniques
+    // ============================================================================
+    {
+        id: "AML.T0110",
+        framework: "MITRE-ATLAS",
+        category: "Impact",
+        title: "Denial of ML Service",
+        description: "Adversaries cause denial of service by exhausting ML system resources through crafted queries or adversarial inputs.",
+        keywords: [
+            "denial of service",
+            "resource exhaustion",
+            "model dos",
+        ],
+        findingCategories: [
+            "model-denial-of-service",
+            "resource-exhaustion",
+        ],
+        severityThreshold: "high",
+    },
+    {
+        id: "AML.T0111",
+        framework: "MITRE-ATLAS",
+        category: "Impact",
+        title: "Manipulate Model Output",
+        description: "Adversaries manipulate model outputs to cause incorrect decisions, spread misinformation, or cause harm to downstream systems.",
+        keywords: [
+            "output manipulation",
+            "misinformation",
+            "incorrect decisions",
+        ],
+        findingCategories: [
+            "insecure-output",
+            "prompt-injection",
+        ],
+        severityThreshold: "high",
+    },
+    {
+        id: "AML.T0112",
+        framework: "MITRE-ATLAS",
+        category: "Impact",
+        title: "Erode Trust in ML System",
+        description: "Adversaries cause the ML system to produce outputs that erode user trust through hallucinations, biased responses, or harmful content.",
+        keywords: [
+            "trust erosion",
+            "reputation damage",
+            "harmful content",
+        ],
+        findingCategories: [
+            "overreliance",
+            "insecure-output",
+        ],
+        severityThreshold: "medium",
+    },
+];
+/**
+ * Get all MITRE ATLAS controls
+ */
+export function getMITREATLASControls() {
+    return MITRE_ATLAS_CONTROLS;
+}
+/**
+ * Get MITRE ATLAS control by technique ID
+ */
+export function getMITREATLASControlById(id) {
+    return MITRE_ATLAS_CONTROLS.find((c) => c.id === id);
+}
+/**
+ * Get MITRE ATLAS controls by tactic
+ */
+export function getMITREATLASControlsByTactic(tactic) {
+    return MITRE_ATLAS_CONTROLS.filter((c) => c.category === tactic);
+}
+/**
+ * Get all MITRE ATLAS tactics
+ */
+export function getMITREATLASTactics() {
+    return [
+        "Reconnaissance",
+        "Resource Development",
+        "Initial Access",
+        "ML Model Access",
+        "Execution",
+        "Persistence",
+        "Defense Evasion",
+        "Discovery",
+        "Collection",
+        "ML Attack Staging",
+        "Exfiltration",
+        "Impact",
+    ];
+}
+/**
+ * Get mitigations for a specific technique
+ */
+export function getMitigationsForTechnique(techniqueId) {
+    const mitigations = {
+        "AML.T0031": [
+            "Implement prompt injection detection",
+            "Use privilege separation for system vs user prompts",
+            "Apply output filtering and validation",
+            "Use allowlisting for tool invocations",
+        ],
+        "AML.T0032": [
+            "Sanitize all external data before processing",
+            "Implement content security policies",
+            "Use data provenance tracking",
+            "Apply sandboxing for document processing",
+        ],
+        "AML.T0042": [
+            "Apply principle of least privilege to tools",
+            "Implement tool sandboxing",
+            "Require explicit user confirmation for sensitive actions",
+            "Monitor and log all tool invocations",
+        ],
+        "AML.T0100": [
+            "Implement rate limiting on model APIs",
+            "Use query obfuscation techniques",
+            "Monitor for model extraction patterns",
+            "Apply watermarking to model outputs",
+        ],
+        "AML.T0102": [
+            "Implement egress filtering for tool network access",
+            "Use data loss prevention controls",
+            "Monitor tool call patterns for anomalies",
+            "Apply network segmentation",
+        ],
+    };
+    return mitigations[techniqueId] || [
+        "Implement defense-in-depth controls",
+        "Monitor for suspicious activity",
+        "Apply least privilege principles",
+    ];
+}
+/**
+ * Map MITRE ATLAS technique to ATT&CK techniques
+ */
+export const ATLAS_TO_ATTACK_MAPPING = {
+    "AML.T0020": ["T1195"], // Supply Chain Compromise
+    "AML.T0022": ["T1059"], // Command Execution
+    "AML.T0041": ["T1059.006"], // Python Execution
+    "AML.T0081": ["T1552"], // Credentials in Files
+    "AML.T0100": ["T1048"], // Exfiltration Over Alternative Protocol
+    "AML.T0110": ["T1499"], // Endpoint Denial of Service
+};
+//# sourceMappingURL=mitre-atlas.js.map