Automated Exploit Chain Modeling and Analysis

Abstract

We describe early-stage research and tool development efforts to formally model and analyze exploit chains. These are sequences of exploits carefully crafted by an attacker to achieve an elaborate end-goal, such as an escalation of privileges of the executing thread. In this work, we are taking a systematic approach to constructing formal models of exploit chains in the form of finite-state machines, which are then converted into constraint-based semantic representations or timed automata, in order to analyze chains against metrics such as effectiveness, ease of reproduction, and stability under system variations.