26 lines
5.6 KiB
TeX
26 lines
5.6 KiB
TeX
\TUchapter{CONCLUSIONS AND FUTURE WORKS}
|
|
\TUsection{Conclusions}
|
|
This thesis presented various extensions to an attack graph generator, RAGE, to allow for a broader range of utilities. In order to reduce the complexity required for network model and exploit file creations, Sections \ref{sec:compops} and \ref{sec:relops} discussed the implementation of relational and compound operators. Both implementations simplify the amount of manual enumeration and manual specifications of asset qualities, and this simplifies precondition checks to singular lines. In addition, these implementations reduce the complexity required for synchronous firing exploit creations by avoiding the need for (for instance) time flags and enumeration of time all time instances. These sections also allow for more complex attack modeling, since broad sweeps and generic $<$ or $>$ checks can be performed. Due to the intermediate database storage feature presented in Section \ref{sec:db-stor}, very large attack or compliance graphs can be generated without concern of absolute memory consumption, assuming very large storage solutions are in place. Section \ref{sec:PW} discusses the path walking feature, which is able to split attack and compliance graphs into subgraphs that can be used to simplify the analysis process by examining only smaller portions or focus areas of a network at a time.
|
|
|
|
Chapter \ref{ch:Sync-Fire} presents the synchronous firing feature, which is successfully able to reduce the state space and runtime of the generation process when assets have inseparable features. This feature does not lose any substantive information from a network and its resulting graph; the graph is able to remain exhaustive and still capture all necessary information. The results are promising, and greater reductions are expected when a greater number of assets share inseparable features, as discussed in Section \ref{sec:FW}.
|
|
|
|
Chapter \ref{ch:MPI} presented two approaches for utilizing MPI for extension to the distributed computing platform space. One approach was a task parallelism approach discussed in Section \ref{sec:MPI-Tasking}, and promising results were observed when the generation of each state increased in computation requirements. The second approach was a data parallelism approach discussed in Section \ref{sec:MPI_Subgraphing}. While results were not promising for this approach, future works can be conducted to optimize and avoid the difficulties of duplicate work and communication overhead.
|
|
|
|
Throughout this thesis and its works, RAGE has demonstrated its extensions to support compliance graph generation. Section \ref{sec:CG-alter} discussed the alterations required for attack graph generators to support compliance graphs, and example compliance graphs have been generated in the results seen in Sections \ref{sec:Sync-Results}, \ref{sec:Tasking-Results}, and \ref{sec:Subgraphing-Results}.
|
|
|
|
\TUsection{Future Work} \label{sec:FW}
|
|
There are multiple avenues that future works and research can be conducted. One such investigation involves examining the effect of the synchronous firing feature with more assets belonging to groups. As the number of assets with inseparable features increases, more permutations consisting of unattainable states in a graph would exist. Since more assets can devolve and grow increasingly out of sync, the reduction rate when using the synchronous firing feature is likely to increase.
|
|
|
|
Another avenue is to improve and further test the MPI Tasking approach discussed in Section \ref{sec:MPI-Tasking}. One improvement approach involves blending OpenMP and MPI. For Task 2 specifically, an example diagram was created that displays a possible approach at leveraging both OpenMP and MPI, and this can be seen in Figure \ref{fig:OMP_MPI_Blend}. Similar techniques could likely be implemented for Task 1, and other techniques could be devised for these tasks and for Tasks 3, 4, and 5. Further testing can be conducted to examine the effectiveness of MPI Tasking when generating large networks with many applicable exploits at any given state. This would allow Task 2 to have a greater workload, where increased speedups are likely to be attained over the serial approach.
|
|
|
|
\begin{figure}[htp]
|
|
\includegraphics[width=\linewidth]{"./Chapter5_img/MPI-OpenMP-Blend.PNG"}
|
|
\vspace{.2truein} \centerline{}
|
|
\caption{Possible Method for Blending MPI and OpenMP for Task 2 of the MPI Tasking Approach}
|
|
\label{fig:Subg_base}
|
|
\end{figure}
|
|
|
|
Many research avenues exist for the MPI Subgraphing approach seen in Section \ref{sec:MPI_Subgraphing}. The results collected in this work were not promising, and many alterations can be attempted. Duplicate states are the primary problem point of this approach, and using a DHT increased the communication cost to a large degree. Alternate methods for addressing this issue can be devised. While it did not improve the results in this work, parameter tuning with this approach can be performed in regards to the depth limit value and the metric for when a worker node does not have a queue marker. This work used a random metric, but more intelligent strategies could be devised.
|
|
|
|
Drastic results are not likely to occur, but various MPI parameter tunings can be performed for both the MPI Tasking and Subgraphing approaches. For instance, this work utilized the parameters for binding to and mapping by NUMA. This is seemingly the most common approach, and MPI balances the workload of NUMA nodes automatically when these parameters are used. Many other options exists for these parameters, and many other parameters exist that can be examined. In addition, comparisons between OpenMPI, MPICH, and MVAPICH can be conducted to see if there is any noticeable, consistent improvement.
|