csle-attack-profiler 0.5.3__py3-none-any.whl → 0.6.1__py3-none-any.whl

csle_attack_profiler/__version__.py

@@ -1 +1 @@
-__version__ = '0.5.3'
+__version__ = '0.6.1'

csle_attack_profiler/hmm_profiling.py

@@ -1,12 +1,12 @@
+from typing import List, Union, Tuple, Any
+import numpy as np
+import sys
 from csle_common.dao.system_identification.emulation_statistics import EmulationStatistics
 from csle_common.dao.emulation_action.attacker.emulation_attacker_action_id import EmulationAttackerActionId
 from csle_common.dao.emulation_action.attacker.emulation_attacker_action_type import EmulationAttackerActionType
 from csle_common.dao.emulation_action.attacker.emulation_attacker_action_outcome import EmulationAttackerActionOutcome
 from csle_common.dao.emulation_action.attacker.emulation_attacker_action import EmulationAttackerAction
 from csle_attack_profiler.attack_profiler import AttackProfiler
-from typing import List, Union, Tuple, Any
-import numpy as np
-import sys
 
 
 class HMMProfiler:
@@ -20,6 +20,7 @@ class HMMProfiler:
 
         :param statistics: The list of EmulationStatistics objects
         :param model_name: The name of the model
+        :return: None
         """
         self.statistics = statistics
         self.transition_matrix: List[List[float]] = []
@@ -38,11 +39,12 @@ class HMMProfiler:
 
         :param transition_matrix: The transition matrix
         :param states: The list of states of the HMM (format: 'A:attack_name' or
-                       'no_intrusion' based on emulation statistics file)
+                        'no_intrusion' based on emulation statistics file)
         :param metrics: The list of metrics to profile
         :param save: Whether to save the matrices to a file
         :param location: The location to save the matrices, if save = True, e.g "./resources",
-        default is current directory
+                         default is current directory
+        :return: None
         """
         emission_matrix, emission_matrix_observations = self.get_matrices_of_observation(self.statistics,
                                                                                          metric, hidden_states)
@@ -63,7 +65,7 @@ class HMMProfiler:
         Loads the HMM model from the given location.
 
         :param location: The location of the model files, default is current directory
-        :param metric: The data metric to use
+        :return: None
         """
         self.transition_matrix = np.load(f'{location}/transition_matrix.npy')
         self.hidden_states = np.load(f'{location}/hidden_states.npy')
@@ -78,14 +80,14 @@ class HMMProfiler:
         :param sequence: The sequence of observations
         :return: The most likely sequence of states
         """
-        
+
         path = HMMProfiler.viterbi(self.hidden_states, self.start_state_probs,
                                    self.transition_matrix, self.emission_matrix,
                                    sequence, self.emission_matrix_observations)
         profiled_sequence = []
         for i in range(len(path)):
             profiled_sequence.append(self.hidden_states[int(path[i])])
-        
+
         return profiled_sequence
 
     def get_matrices_of_observation(self, statistics: List[EmulationStatistics],
@@ -95,13 +97,14 @@ class HMMProfiler:
 
         :param statistics: The list of EmulationStatistics objects
         :param metric: The metric to get the emission matrix for
+        :param states: The list of states
         :return: The emission matrix, the list of observations, the list of states
         """
         emission_matrix = []
         attack_observations = {}
         attack_observations_total_counts = {}
         all_keys = set()
-        
+
         for stats in statistics:
             for condition, metric_distribution in stats.conditionals_counts.items():
                 action = condition.split('_')
@@ -115,7 +118,7 @@ class HMMProfiler:
                         # Add the observations of the attack to the dictionary
                         if metric in metric_distribution:
                             attack_observations[action[0]] = metric_distribution[metric]
-                        # Sum the total counts of the observations
+                            # Sum the total counts of the observations
                             attack_observations_total_counts[action[0]] = sum(attack_observations[action[0]].values())
                 # Aggregate the counts from the metric distribution
                 else:
@@ -132,7 +135,7 @@ class HMMProfiler:
                 # Store all possible values for the observation
                 if action[0] in attack_observations:
                     all_keys.update(attack_observations[action[0]])
-        
+
         # Normalize the counts
         for attack, _ in attack_observations.items():
             attack_observations_total_counts[attack] = sum(attack_observations[attack].values())
@@ -186,34 +189,33 @@ class HMMProfiler:
         for state in states:
             if state == 'A:Continue':
                 action = EmulationAttackerAction(id=EmulationAttackerActionId.CONTINUE, name="Continue", cmds=[],
-                                                 type=EmulationAttackerActionType.CONTINUE, descr="CONTINUE", ips=[],
-                                                 index=0, action_outcome=EmulationAttackerActionOutcome.CONTINUE)
+                                                 type=None, descr="CONTINUE", ips=[], index=0, action_outcome='')
                 p = AttackProfiler.get_attack_profile(action)
                 new_states.append(p)
             elif state == 'A:CVE-2015-1427 exploit':
                 action = EmulationAttackerAction(
-                    id=EmulationAttackerActionId.CVE_2015_1427_EXPLOIT, name="CVE-2015-1427 exploit", cmds=[],
+                    id=EmulationAttackerActionId.CVE_2015_1427_EXPLOIT, name="CVE-2015-1427 exploit", cmds=None,
                     type=EmulationAttackerActionType.EXPLOIT,
                     descr="Uses the CVE-2015-1427 vulnerability to "
-                    "get remote code execution and then sets up a SSH backdoor"
-                    "to upgrade the channel", index=-1, ips=[],
+                          "get remote code execution and then sets up a SSH backdoor"
+                          "to upgrade the channel", index=None, ips=[],
                     action_outcome=EmulationAttackerActionOutcome.SHELL_ACCESS)
                 p = AttackProfiler.get_attack_profile(action)
                 new_states.append(p)
             elif state == 'A:DVWA SQL Injection Exploit':
                 action = EmulationAttackerAction(
                     id=EmulationAttackerActionId.DVWA_SQL_INJECTION, name="DVWA SQL Injection Exploit",
-                    cmds=[], type=EmulationAttackerActionType.EXPLOIT,
+                    cmds=None, type=EmulationAttackerActionType.EXPLOIT,
                     descr="Uses the DVWA SQL Injection exploit to extract secret passwords",
-                    index=-1, ips=[], action_outcome=EmulationAttackerActionOutcome.SHELL_ACCESS)
+                    index=None, ips=[], action_outcome=EmulationAttackerActionOutcome.SHELL_ACCESS)
                 p = AttackProfiler.get_attack_profile(action)
                 new_states.append(p)
             elif state == 'A:Install tools':
                 action = EmulationAttackerAction(
-                    id=EmulationAttackerActionId.INSTALL_TOOLS, name="Install tools", cmds=[],
+                    id=EmulationAttackerActionId.INSTALL_TOOLS, name="Install tools", cmds=None,
                     type=EmulationAttackerActionType.POST_EXPLOIT,
                     descr="If taken root on remote machine, installs pentest tools, e.g. nmap",
-                    index=-1, ips=[], action_outcome=EmulationAttackerActionOutcome.PIVOTING)
+                    index=None, ips=[], action_outcome=EmulationAttackerActionOutcome.PIVOTING)
                 p = AttackProfiler.get_attack_profile(action)
                 new_states.append(p)
             elif state == 'A:Network service login':
@@ -221,85 +223,86 @@ class HMMProfiler:
                     id=EmulationAttackerActionId.NETWORK_SERVICE_LOGIN, name="Network service login",
                     cmds=[], type=EmulationAttackerActionType.POST_EXPLOIT,
                     descr="Uses known credentials to login to network services on a server",
-                    index=-1, ips=[], action_outcome=EmulationAttackerActionOutcome.LOGIN)
+                    index=None, ips=None, action_outcome=EmulationAttackerActionOutcome.LOGIN)
                 p = AttackProfiler.get_attack_profile(action)
                 new_states.append(p)
             elif state == 'A:Ping Scan':
                 action = EmulationAttackerAction(
                     id=EmulationAttackerActionId.PING_SCAN_HOST, name="Ping Scan",
-                    cmds=[], type=EmulationAttackerActionType.RECON,
+                    cmds=None, type=EmulationAttackerActionType.RECON,
                     descr="A host discovery scan, it is quick because it only checks of hosts "
-                    "are up with Ping, without scanning the ports.", ips=[], index=-1,
+                          "are up with Ping, without scanning the ports.", ips=None, index=None,
                     action_outcome=EmulationAttackerActionOutcome.INFORMATION_GATHERING, backdoor=False)
                 p = AttackProfiler.get_attack_profile(action)
                 new_states.append(p)
             elif state == 'A:Sambacry Explolit':
                 action = EmulationAttackerAction(
-                    id=EmulationAttackerActionId.SAMBACRY_EXPLOIT, name="Sambacry Explolit", cmds=[],
+                    id=EmulationAttackerActionId.SAMBACRY_EXPLOIT, name="Sambacry Explolit", cmds=None,
                     type=EmulationAttackerActionType.EXPLOIT,
                     descr="Uses the sambacry shell to get remote code execution and then"
-                    "sets up a SSH backdoor to upgrade the channel",
-                    index=-1, ips=[], action_outcome=EmulationAttackerActionOutcome.SHELL_ACCESS)
+                          "sets up a SSH backdoor to upgrade the channel",
+                    index=None, ips=[], action_outcome=EmulationAttackerActionOutcome.SHELL_ACCESS)
                 p = AttackProfiler.get_attack_profile(action)
                 new_states.append(p)
             elif state == 'A:ShellShock Explolit':
                 action = EmulationAttackerAction(
-                    id=EmulationAttackerActionId.SHELLSHOCK_EXPLOIT, name="ShellShock Exploit",
-                    cmds=[], type=EmulationAttackerActionType.EXPLOIT,
+                    id=EmulationAttackerActionId.SHELLSHOCK_EXPLOIT, name="ShellShock Explolit",
+                    cmds=None, type=EmulationAttackerActionType.EXPLOIT,
                     descr="Uses the Shellshock exploit and curl to do remote code execution and create a backdoor",
-                    index=-1, ips=[], action_outcome=EmulationAttackerActionOutcome.SHELL_ACCESS)
+                    index=None, ips=[], action_outcome=EmulationAttackerActionOutcome.SHELL_ACCESS)
                 p = AttackProfiler.get_attack_profile(action)
                 new_states.append(p)
             elif state == 'A:SSH dictionary attack for username=pw':
                 action = EmulationAttackerAction(
                     id=EmulationAttackerActionId.SSH_SAME_USER_PASS_DICTIONARY_HOST,
-                    name="SSH dictionary attack for username=pw", cmds=[],
-                    type=EmulationAttackerActionType.EXPLOIT, index=-1,
+                    name="SSH dictionary attack for username=pw", cmds=None,
+                    type=EmulationAttackerActionType.EXPLOIT, index=None,
                     descr="A dictionary attack that tries common passwords and usernames for SSH"
-                    "where username=password", ips=[], action_outcome=EmulationAttackerActionOutcome.SHELL_ACCESS)
+                          "where username=password", ips=None,
+                    action_outcome=EmulationAttackerActionOutcome.SHELL_ACCESS)
                 p = AttackProfiler.get_attack_profile(action)
                 new_states.append(p)
             elif state == 'A:FTP dictionary attack for username=pw':
                 action = EmulationAttackerAction(
                     id=EmulationAttackerActionId.FTP_SAME_USER_PASS_DICTIONARY_HOST,
-                    name="FTP dictionary attack for username=pw", cmds=[], type=EmulationAttackerActionType.EXPLOIT,
-                    index=-1, descr="A dictionary attack that tries common passwords and"
-                    "usernames for FTP where username=password", ips=[],
+                    name="FTP dictionary attack for username=pw", cmds=None, type=EmulationAttackerActionType.EXPLOIT,
+                    index=None, descr="A dictionary attack that tries common passwords and"
+                                      "usernames for FTP where username=password", ips=None,
                     action_outcome=EmulationAttackerActionOutcome.SHELL_ACCESS)
                 p = AttackProfiler.get_attack_profile(action)
                 new_states.append(p)
             elif state == 'A:Telnet dictionary attack for username=pw':
                 action = EmulationAttackerAction(
                     id=EmulationAttackerActionId.TELNET_SAME_USER_PASS_DICTIONARY_HOST,
-                    name="Telnet dictionary attack for username=pw", cmds=[],
-                    type=EmulationAttackerActionType.EXPLOIT, index=-1,
+                    name="Telnet dictionary attack for username=pw", cmds=None,
+                    type=EmulationAttackerActionType.EXPLOIT, index=None,
                     descr="A dictionary attack that tries common passwords and usernames for"
-                    "Telnet where username=password", ips=[],
+                          "Telnet where username=password", ips=None,
                     action_outcome=EmulationAttackerActionOutcome.SHELL_ACCESS)
                 p = AttackProfiler.get_attack_profile(action)
                 new_states.append(p)
             elif state == 'A:CVE-2010-0426 exploit':
                 action = EmulationAttackerAction(
                     id=EmulationAttackerActionId.CVE_2010_0426_PRIV_ESC,
-                    name="CVE-2010-0426 exploit", cmds=[], type=EmulationAttackerActionType.PRIVILEGE_ESCALATION,
+                    name="CVE-2010-0426 exploit", cmds=None, type=EmulationAttackerActionType.PRIVILEGE_ESCALATION,
                     descr="Uses the CVE-2010-0426 vulnerability to perform privilege escalation to get root access",
-                    index=-1, ips=[], action_outcome=EmulationAttackerActionOutcome.PRIVILEGE_ESCALATION_ROOT)
+                    index=None, ips=[], action_outcome=EmulationAttackerActionOutcome.PRIVILEGE_ESCALATION_ROOT)
                 p = AttackProfiler.get_attack_profile(action)
                 new_states.append(p)
             elif state == 'A:TCP SYN (Stealth) Scan':
                 action = EmulationAttackerAction(
                     id=EmulationAttackerActionId.TCP_SYN_STEALTH_SCAN_HOST, name="TCP SYN (Stealth) Scan",
-                    cmds=[], type=EmulationAttackerActionType.RECON,
-                    descr="A stealthy and fast TCP SYN scan to detect open TCP ports on the subnet", ips=[],
-                    index=-1, action_outcome=EmulationAttackerActionOutcome.INFORMATION_GATHERING, backdoor=False)
+                    cmds=None, type=EmulationAttackerActionType.RECON,
+                    descr="A stealthy and fast TCP SYN scan to detect open TCP ports on the subnet", ips=None,
+                    index=None, action_outcome=EmulationAttackerActionOutcome.INFORMATION_GATHERING, backdoor=False)
                 p = AttackProfiler.get_attack_profile(action)
                 new_states.append(p)
             elif state == 'ssh backdoor':
                 action = EmulationAttackerAction(
                     id=EmulationAttackerActionId.SSH_BACKDOOR, name="Install SSH backdoor",
-                    cmds=[], type=EmulationAttackerActionType.POST_EXPLOIT,
+                    cmds=None, type=EmulationAttackerActionType.POST_EXPLOIT,
                     descr="If taken root on remote machine, installs a ssh backdoor useful for"
-                    "upgrading telnetor weaker channels", index=-1, ips=[],
+                          "upgrading telnetor weaker channels", index=None, ips=[],
                     action_outcome=EmulationAttackerActionOutcome.PIVOTING, alt_cmds=None, backdoor=True)
                 p = AttackProfiler.get_attack_profile(action)
                 new_states.append(p)
@@ -307,7 +310,7 @@ class HMMProfiler:
                 new_states.append(state)
 
         return new_states
-   
+
     def calculate_initial_states(self, transition_matrix: List[List[float]]) -> List[float]:
         """
         Calculates the initial states probabilities based on the transition matrix.
@@ -315,7 +318,6 @@ class HMMProfiler:
         1 / (# of states)
 
         :param transition_matrix: The transition matrix
-
         :return: The start states probabilities
         """
         start_states = []
@@ -338,7 +340,6 @@ class HMMProfiler:
         :param emission_matrix: The emission matrix
         :param obs: The observation sequence
         :param emissions_list: The list of possible observations
-
         :return: The most likely sequence of hidden states
         """
         # Convert the emissions list to a numpy array, to use the where function
@@ -401,23 +402,21 @@ class HMMProfiler:
         generated based on emission matrix and transition matrix. The length of this intrusion
         sequence is given by the intrusion_length parameter.
 
-        :param P_obs: The emission matrix
-        :param P_states: The transition matrix
-        :param states: The list of states
-        :param observations: The list of observations
         :param intrusion_length: The length of the intrusion
-        :param initial_state: The initial state
+        :param initial_state_index: The index of the initial state
+        :param seed: The seed for the random number generator
         return: The sequence of states and observations
         """
+
         P_obs = self.emission_matrix
         P_states = self.transition_matrix
         states = self.hidden_states
         observations = self.emission_matrix_observations
+
         if seed:
             np.random.seed(seed)
         obs_len = len(observations)
         states_len = len(states)
-
         # Return the geometric distribution of the initial state
         dist = np.random.geometric(p=P_states[initial_state_index][0], size=1000)
         T_i = round(sum(dist) / len(dist))
@@ -425,25 +424,25 @@ class HMMProfiler:
         state_seq = [states[initial_state_index]] * T_i
         obs_seq = []
         for i in range(T_i):
-
             o_i = np.random.choice(obs_len, p=P_obs[initial_state_index])
             obs_seq.append(observations[o_i])
 
         recon_states_sum = np.sum(P_states[initial_state_index][1:])
         recon_states = P_states[initial_state_index][1:] / recon_states_sum
 
-        intrusion_start_state = np.random.choice(states_len - 1, p=recon_states)
+        intrusion_start_state = np.random.choice(states_len - 1, p=recon_states) + 1
         intrusion_start_observation = np.random.choice(obs_len, p=P_obs[intrusion_start_state])
         state_seq.append(states[intrusion_start_state])
         obs_seq.append(observations[intrusion_start_observation])
 
         s_i = intrusion_start_state
-        for i in range(intrusion_length):
+        if intrusion_length == 1:
+            return state_seq, obs_seq
+        for i in range(intrusion_length - 1):
             # si ~ Ps(si | si-1)
             s_i = np.random.choice(states_len, p=P_states[s_i])
             # oi ~ Po(oi | si)
             o_i = np.random.choice(obs_len, p=P_obs[s_i])
             state_seq.append(states[s_i])
             obs_seq.append(observations[o_i])
-        
         return state_seq, obs_seq

{csle_attack_profiler-0.5.3.dist-info → csle_attack_profiler-0.6.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: csle-attack-profiler
-Version: 0.5.3
+Version: 0.6.1
 Summary: Library with MITRE attack profiler for CSLE
 Author: Bength Pappila
 Author-email: brpa@kth.se
@@ -15,8 +15,8 @@ Classifier: Programming Language :: Python :: 3.9
 Classifier: Intended Audience :: Science/Research
 Requires-Python: >=3.8
 Requires-Dist: mitreattack-python ==2.0.14
-Requires-Dist: csle-base ==0.5.3
-Requires-Dist: csle-common ==0.5.3
+Requires-Dist: csle-base ==0.6.1
+Requires-Dist: csle-common ==0.6.1
 Provides-Extra: testing
 Requires-Dist: pytest >=6.0 ; extra == 'testing'
 Requires-Dist: pytest-cov >=2.0 ; extra == 'testing'

csle_attack_profiler-0.6.1.dist-info/RECORD

@@ -0,0 +1,8 @@
+csle_attack_profiler/__init__.py,sha256=C7_gE0lIQJ8Wh2jgU8C8P_xyvq76bKTf0gm8bGYhMBk,37
+csle_attack_profiler/__version__.py,sha256=gd3s3RotD0_KL90Tua-YkOr60Jm2C2_wvlEhAT08068,22
+csle_attack_profiler/attack_profiler.py,sha256=bYqSeItJkhswronvIRFPyvf1rtvUKEWPPF4K2t1JVqE,10535
+csle_attack_profiler/hmm_profiling.py,sha256=cHE2wImgBJ3xwW33S0JcTwsiccstijR9uRMeBPXIT18,24167
+csle_attack_profiler-0.6.1.dist-info/METADATA,sha256=qcoiNvO6GxPrQRxB9P9IiaIxwR46ZKAIRu2nDd0_svA,2006
+csle_attack_profiler-0.6.1.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92
+csle_attack_profiler-0.6.1.dist-info/top_level.txt,sha256=OuI4zvPo3MQYLQ7Dqm32oM0V8rNdwHe9tjtngx2KVtA,21
+csle_attack_profiler-0.6.1.dist-info/RECORD,,

csle_attack_profiler-0.5.3.dist-info/RECORD

@@ -1,8 +0,0 @@
-csle_attack_profiler/__init__.py,sha256=C7_gE0lIQJ8Wh2jgU8C8P_xyvq76bKTf0gm8bGYhMBk,37
-csle_attack_profiler/__version__.py,sha256=TFkACo7SKbVpSQl32OCSCNmy1zVX-jsQX6dAXMbWmkU,22
-csle_attack_profiler/attack_profiler.py,sha256=bYqSeItJkhswronvIRFPyvf1rtvUKEWPPF4K2t1JVqE,10535
-csle_attack_profiler/hmm_profiling.py,sha256=6xlvv3Q84E47AYEwH1c89-oAaJb89XJXcNnmS-aO9qg,24128
-csle_attack_profiler-0.5.3.dist-info/METADATA,sha256=KebzwlqGaKxWGL2WM3jG_wBXEu5lx7Pvi2EPd_A1PaM,2006
-csle_attack_profiler-0.5.3.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92
-csle_attack_profiler-0.5.3.dist-info/top_level.txt,sha256=OuI4zvPo3MQYLQ7Dqm32oM0V8rNdwHe9tjtngx2KVtA,21
-csle_attack_profiler-0.5.3.dist-info/RECORD,,