Emulacija automatiziranih napadača u kibernetičkoj sigurnosti

master's thesis

• Title (english): Emulation of Automated Attackers in Cybersecurity
• Author: Hrvoje Fabris
• Mentor: Stjepan Groš (mentor)
• Committee member: Stjepan Groš (predsjednik povjerenstva)
• Committee member: Marin Golub (član povjerenstva)
• Committee member: Leonardo Jelenković (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2021-07-14, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing

Abstract

Provođenje sigurnosnih testiranja je važno za održavanje sigurnosti sustava unutar organizacije. Sigurnosna testiranja zahtijevaju resurse i angažman stručnjaka zbog čega se testiranja pokušavaju automatizirati. Prilikom izrade automatiziranog napadača potrebno je voditi računa o njegovom znanju, mogućnostima koje ima na raspolaganju i strategiji kojom želi ostvariti svoj cilj. U sklopu ovog rada napravljen je program koji modelira IT sustav i simulira kibernetički napad na taj sustav. Napravljene su različite napadačke strategije koje utječu na odabir radnje koju će napadač izvršiti tijekom napada. Provodeći niz testiranja došlo se do rezultata da napadači koji slučajno odabiru radnje ostvaruju najslabije rezultate, a najbolje rezultate napadači ostvaruju kada zaposlenici unutar sustava provode radnje s različitim vjerojatnostima. Na kraju je dan prijedlog mogućeg poboljšanja sustava.

Abstract (english)

Security testing is an important part of assessing system security inside the organization. Factors such as cost and personnel are the reason why the security testing is being automated. Automated cyber attacker should be aware of its knowledge, capabilities it can execute and strategy it uses to reach his goal. A program which simulates IT system and attack on that system is also part of this paper. Different strategies which choose attackers action to execute were also made. Based on a series of tests, attacker which randomly chooses his action performed the worst, and the attacker had better results when the employees in the system performed their actions with different probability. At the end possible improvements directions were given.

• Keywords: Automatizacija napadača; emulacija napada
• Keywords (english): Cyber attack emulation; automated attackers
• Language: croatian
• URN:NBN: urn:nbn:hr:168:217726
• Study programme: Title: Computing; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra inženjer/inženjerka računarstva (magistar/magistra inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2023-01-13 12:12:12