c o m p u t e r s & s e c u r i t y 2 6 ( 2 0 0 7 ) 3 4 9 – 3 6 0

Vulnerability Take Grant (VTG): An efficient approachto analyze network vulnerabilities

Hamid Reza Shahriari*, Rasool Jalili

Network Security Center, Department of Computer Engineering, Sharif University of Technology, Azadi Avenue, Tehran, Iran

a r t i c l e i n f o

Article history:

Received 27 February 2006

Accepted 9 March 2007

Keywords:

Network security

Access control

Vulnerability

Vulnerability analysis

Safety problem

Vulnerability Take-Grant model

Multiphase attack analysis

a b s t r a c t

Modeling and analyzing information system vulnerabilities help predict possible attacks to

computer networks using vulnerabilities information and the network configuration. In

this paper, we propose a comprehensive approach to analyze network vulnerabilities in

order to answer the safety problem focusing on vulnerabilities. The approach which is called

Vulnerability Take Grant (VTG) is a graph-based model consists of subject/objects as nodes

and rights/relations as edges to represent the system protection state. Each node may have

properties including single vulnerabilities such as buffer overflow. We use the new concept

of vulnerability rewriting rule to specify the requirements and consequences of exploiting

vulnerabilities. Analysis of the model is achieved using our bounded polynomial algorithm,

which generates the most permissive graph in order to verify whether a subject can obtain

an access right over an object. The algorithm also finds the likely attack scenarios. Appli-

cability of the approach is investigated by modeling widespread vulnerabilities in their

general patterns. A real network is modeled as a case study in order to examine how an

attacker can gain unauthorized access via exploiting the chain of vulnerabilities. Our expe-

rience shows the efficiency, applicability, and expressiveness in modeling a broader range

of vulnerabilities in our approach in comparison to the previous approaches.

ª 2007 Elsevier Ltd. All rights reserved.

ava i lab le at www.sc ienced i rec t . com

journa l homepage : www.e lsev ie r . com/ loca te /cose

1. Introduction

The goal of vulnerability analysis in computer and network

systems is to analyze vulnerabilities’ dependencies to find

the attack scenarios before malicious attackers find them.

Currently, several tools exist which analyze the single host

vulnerabilities in isolation. However, protecting networks

against attacks requires considering all network vulnerabil-

ities; vulnerabilities inter-dependencies; and the dependency

among services.

Considering individually, a service may provide an accept-

able level of security, but a combination of such services may

lead to subtle attack scenarios. For example, the file transfer

protocol (ftp) and the hypertext transfer protocol (http),

provided simultaneously in the same host, may permit an at-

tacker to write into a web directory using ftp. This causes the

web server to execute a program written by the attacker. Ac-

cordingly, a comprehensive analysis of network vulnerabil-

ities needs consideration of individual hosts as well as their

relationships.

The complexity of analyzing network vulnerabilities in-

creases extremely as the number of hosts and services in-

creases. Manual handling of such complexity is very difficult

or even impossible in the case of current enormous networks.

Accordingly, automated approaches are necessary for vulner-

ability analysis.

Our vulnerability analysis problem is to determine whether

an attacker can obtain unauthorized access to a particular

* Corresponding author. Tel.: þ98 21 66164020.E-mail addresses: shahriari@ce.sharif.edu (H.R. Shahriari), jalili@sharif.edu (R. Jalili).

0167-4048/$ – see front matter ª 2007 Elsevier Ltd. All rights reserved.doi:10.1016/j.cose.2007.03.002

c o m p u t e r s & s e c u r i t y 2 6 ( 2 0 0 7 ) 3 4 9 – 3 6 0350

resource. This is a specific form of the safety problem, which

asks ‘‘Given an initial configuration of a protection system,

can a subject s obtain some access right r over an object o?’’

(Shapiro, 2003). In other words, we focus on determining

whether a set of known vulnerabilities allows a given subject

to acquire some specific set of rights over an object represent-

ing a resource.

Based on the authors’ knowledge, the previous literature

has not explored the safety problem focusing on vulnerabil-

ities. Approaches proposed in Zerkle and Levitt (1996), Dacier

and Deswarte (1994), Ritchey and Ammann (2001), Ramak-

rishnan and Sekar (2002), Shahriari and Jalili (2004), Noel

et al. (2003, 2004), and Noel and Jajodia (2004) analyze network

vulnerabilities from the point of view of the relations among

individual hosts and network configurations. These ap-

proaches mainly use model checking and graph-based tech-

niques to generate and analyze an attack graph; the task has

been done in exponential time. In Ammann et al. (2002) and

Noel et al. (2003), polynomial time approaches have been sug-

gested for the same problem without any specific upper bound

on polynomial degree.

In this paper, we propose a new access control based model

to address the concept of vulnerabilities and their effects on

the system protection state. The model has been motivated

from the Take-Grant protection model; a graph-based access

control model, where subjects and objects are considered as

nodes of a graph, and access rights as well as administrative

rights (Take and Grant) are considered as the edges (Jones

et al., 1976). We also propose a framework to model vulnera-

bilities based on their pre-conditions and post-conditions as

well as an algorithm to analyze the model with bounded poly-

nomial time in the size of the protection system graph. The

proposed algorithm can generate possible attack scenarios.

The applicability of the framework has been shown through

real examples of vulnerabilities. The examples cover a general

form of widespread vulnerabilities such as buffer-overflow

and cross-site scripting.

The remainder of this paper is organized as follows. In Sec-

tion 2, we review previous works on the Take-Grant protection

model and network vulnerability analysis. The outline of our

proposed approach has been presented in Section 3. The detail

of our approach has been presented in Section 4. Section 5 dis-

cusses the applicability of the approach through modeling

broad types of vulnerabilities and their rewriting rules. Sec-

tion 6 presents an algorithm to analyze the model in order

to answer the safety problem considering vulnerabilities. Sec-

tion 7 provides a real case study. The conclusion and future

works have been presented in Section 8.

2. Related work

The Take-Grant protection model was first developed by Jones

et al. (1976) where the safety problem could be solved in linear

time. They provided the necessary and sufficient conditions

under which rights and information could be transferred be-

tween two entities of the protection system and a linear

time algorithm to test those conditions. Applications of the

Take-Grant model to various systems have been explored

separately (Bishop, 1981, 1996; Jones, 1978; Snyder, 1977;

Wu, 1981; Frank and Bishop, 1996). Extending the initial

Take-Grant model also has been experienced by Frank and

Bishop (1996). They proposed a method of extending the

Take-Grant model to add the notion of information or right

flow cost and to find the most likely path. In nearly all previous

works, in addition to decidability, time complexity of the deci-

sion algorithm has been emphasized. Linear time complexity

of the Take-Grant model for safety problem has made it more

attractive than other formal access control models.

Based on the authors’ knowledge, the Take-Grant protec-

tion model has not been used for host or network vulnerability

analysis so far.1 Previous approaches to network vulnerability

analysis mainly focused on model checking and graph-based

techniques whose time complexity was either exponential or

polynomial. Such approaches mainly depend on some off-

the-shelf tools for scanning individual host vulnerabilities.

Vulnerability scanner tools such as System Scanner (Internet

Security Systems) scan hosts to discover vulnerabilities in the

configuration. However, they do not investigate how a combi-

nation of configurations on the same host or among hosts on

the same network can contribute to the vulnerabilities.

The NetKuang system tries to assess beyond host vulnera-

bilities. It is an extension to a previous work on building a rule-

based expert system, namely Kuang (Zerkle and Levitt, 1996).

NetKuang extends the Kuang’s rule-set to include certain

UNIX network security issues, which are undetectable when

analyzing a single host. NetKuang uses a backtrack search al-

gorithm to identify vulnerabilities.

Dacier proposed the concept of privilege graphs. Privilege

graphs are explored to construct an attack state graph, which

represents different ways in which an intruder may reach

a certain goal, such as root access on a host (Dacier and

Deswarte, 1994).

Ritchey and Ammann (2001) used model checking for vul-

nerability analysis of networks via the model checker SMV.

They could obtain only one attack corresponding to an unsafe

state. The experiment was restricted to only specific vulnera-

bilities. However, the model checking approach has been used

in some other researches to analyze network vulnerabilities

(Sheyner et al., 2002; Jha et al., 2002). The model checking

has the scalability problem which some researchers tried to

overcome (Jajodia et al., 2003). Ramakrishnan and Sekar

(2002) used a model checker to analyze a single host system

with respect to combinations of unknown vulnerabilities.

The key issue in their research was checking infinite space

model using model abstraction. Swiler et al. (2001) presented

a method for generating attack graphs by forward exploration.

In (Shahriari and Jalili, 2004), CSP was used to model and

analyze TCP protocol vulnerabilities. In this approach, the

model checker FDR2 was used to verify some simple security

properties and find attack scenarios. CSP has been used widely

in modeling and analyzing security protocols (Ryan and

Schneider, 2001) and verifying intrusion detection systems

(Rohrmair and Lowe, 2003).

Noel et al. presented TVA in Jajodia et al. (2003), Noel et al.

(2003) and investigated it more in Noel et al. (2004) and Noel

and Jajodia (2004). In their approach, exploits are modeled as

1 Bishop has modeled security breach of SETUID programs inUNIX operating system in his Ph.D. thesis (Bishop, 1984).

c o m p u t e r s & s e c u r i t y 2 6 ( 2 0 0 7 ) 3 4 9 – 3 6 0 351

pre/post-conditions and a specific tool has been used to con-

struct the attack graph. Encoding each exploit individually

resulted in a large and complex model.

Logic-based approaches have been considered in Shahriari

and Jalili (2005) and Ou et al. (2005). The more recent approach

named MulVal (Ou et al., 2005) adopts Datalog (which is a sub-

set of Prolog) as the modeling language of elements in the

analysis. The reasoning engine consists of a collection of

Datalog rules capturing the operating system behavior and

the interactions of various components in the network. The

main problem of MulVal is using a backward search algorithm

for determining whether goals can be achieved from the initial

state. In this kind of reasoning, users always need to define

some goal and then the reasoner will check whether the

goal is satisfiable or not.

In our approach, which is based on the access control

model, vulnerabilities of the same type are modeled in a gen-

eral pattern. For example, all buffer overflow vulnerabilities

are treated similarly and encoded in a single model. It reduces

the size of the model and cost of analysis. Accordingly, we

propose an efficient algorithm to analyze the vulnerabilities

in a bounded polynomial time based on the size of protection

graph.

3. Outline of the approach

The proposed approach is composed of three steps. In the first

step, the network configuration and known vulnerabilities are

collected. In the second step, the gathered information is used

to construct the initial model. The last step involves analyzing

the model to capture all the ways through which the rights

can be transferred. Fig. 1 depicts the schematic outline of

our approach.

To construct the model, we need to know the current host

and network configuration of rights, and the set of host and

network vulnerabilities. The former can be derived by exam-

ining the system and network. Many of the latter can be

determined using vulnerabilities databases and host and net-

work analysis tools. The OVAL scanner is a tool developed

based on the Open Vulnerability Assessment Language

(OVAL) (Wojcik et al., 2003), an XML-based language which is

used to formally describe the host configuration vulnerabil-

ities and the required tests to detect them. This standard

has been proposed by MITRE Corporation on which some ma-

jor operating system vendors have reached consensus. As of

writing this paper, the OVAL definitions for Windows, Redhat

Linux, and Sun Solaris operating systems vulnerabilities are

available. The Nessus vulnerability scanner is a powerful

tool which utilizes the NASL language to find the vulnerabil-

ities of network services remotely (Derasion, 2000). The net-

work topology can be captured using several tools, such as

Cheops-ng.

The initial model of the network, called VTG, will be con-

structed based on the vulnerabilities of the hosts and services,

current configuration of rights, and network topology pro-

vided automatically by the abovementioned tools. At the

core of our model are Vulnerability Rewriting Rules, which spec-

ify how exploiting vulnerabilities changes the system protec-

tion state and represents the requirements and consequences

of exploiting a vulnerability. The Analysis engine takes the ini-

tial model and a database of vulnerability rewriting rules as

input and generates transitive closure of accesses in which

all the achievable access rights have been captured. Having

the closured model, checking for unauthorized acquired

rights based on the security policy will be straightforward. In

case of security policy violation, generating the related attack

scenario is also possible through our approach.

4. Vulnerability Take-Grant model

In this section we present the generalized Vulnerability Take-

Grant model. Our approach is based on extending the initial

take-grant model. Some definitions are provided first and

the formal model is presented later on.

Host 1

OVALScanner

OVALScanner

VTG Model

NetworkConfiguration

AnalysisEngine

VulnerabilityRewriting Rules

Database

Checking forViolation

ModelingNetwork

Nessus Scanner

Closure

SecurityPolicy

AttackScenario

Secure

Information Gathering Modeling Analyzing

Host n

Fig. 1 – The outline of the approach.

c o m p u t e r s & s e c u r i t y 2 6 ( 2 0 0 7 ) 3 4 9 – 3 6 0352

4.1. Basic definitions

Definition 1. The computing system can be defined as the

state machine SYS ¼ ðS; S0; s;SA;SUÞ, where S is the set of all

states, S04S is the set of initial states, s4S� S is the set

of state transitions and SA4S and SU4S represent the set of

authorized and unauthorized states, respectively.

The authorized and unauthorized states are specified by

the system security policy. Any security policy should satisfy

some consistency constraints. As an example, each policy

should disjointly partition the system states, i.e. SAWSU ¼ S;

SAXSU ¼ f, and it should be a surjective function. Specifica-

tion of the security policy and its constraints are beyond the

scope of this paper.

Bishop and Bailey (1996) provided a definition for vulnerable

state:

‘‘A vulnerable state is an authorized state from which an

unauthorized state can be reached using authorized state

transitions.’’

In the definition, not only states but also transitions are

classified into authorized and unauthorized ones. We can

simplify this definition by excluding transitions as the

authorized/unauthorized state transitions depend on the

current state of the system. If the transition is unauthorized,

the system is in a (presumably) disallowed state in which

a prohibited action may be taken or would transition to an un-

authorized state, and hence the system is in an unauthorized

state.

Accordingly, a vulnerable state can be defined as follows:

Definition 2. The state s is vulnerable if it is an authorized state

ðs0˛SAÞ and there is an unauthorized state s0ðs0˛SUÞ and transi-

tions s1; s2;.; sk such that s /s1

/ /sk

s0.

Accordingly, vulnerability is defined as characteristics of

a vulnerable state that distinguishes it from all non-vulnera-

ble states.

4.2. The model

In this section, we define the core of our model to analyze vul-

nerabilities. Exploiting most vulnerabilities leads to a change

in access rights of entities in the system protection state.

This requires some conditions to be met, such as having ac-

cess to a server or running a special version of a service on

the server. In other words, the system must be in a vulnerable

state to provide opportunity for the attacker to exploit the vul-

nerability and change the protection state of the system. For

example, the attacker may acquire root access on the running

server, or may stop a service. The new state may also enable

the attacker to make subsequent state transitions leading to

an unauthorized state.

A general model should allow us to represent the precondi-

tions and postconditions of all types of vulnerabilities in it. As

stated earlier, exploiting most vulnerabilities involve the at-

tacker having some access rights over entities of the system

which in turn leads to acquiring additional access rights. But

not all of the vulnerabilities are of the form ‘‘Requires some

rights/Provides some other rights’’. For example, consider

the Ethernet LAN vulnerability that an attacker may sniff the

transmitted data. To exploit this vulnerability, the attacker

and the victim must be connected to the same LAN. The enti-

ties have no right over each other in the latter case. Therefore,

we need a general type of relationship to address them. More-

over, there are a large number of vulnerabilities that require

certain properties to be present for the individual entities.

For example, running Apache server 1.3.12 is a precondition

of the vulnerability CVE-2000-0868 (Mitre Corporation).

Therefore, we should address three general categories of

the preconditions:

� The set of rights of entities over other entities (E ),

� The set of general relations between entities (Er) (i.e. any

relationships between entities other than access rights),

� The set of attributes of individual entities (Aa).

The notions R and r are used for set of access rights and

general relationships, respectively. Other notations are de-

fined more formally as follows:

Definition 3. The set E is the set of tuples ðu;v;SÞju;v˛V;f S4Rgin which the vertex u has some set of rights (S ) over vertex v.

Definition 4. The set Er is the set of tuples ðu; v; LÞju;v˛V;fL4rg in which the vertex u has some set of relationships (L)

with vertex v.

Our proposed model, which is called Vulnerability Take-

Grant (VTG), is a graph based model and is defined as

follows:

Definition 5. The Vulnerability Take-Grant (VTG) model is de-

fined as a tuple VTG ¼ ðV;E;Er;AaÞ, where V is the set of

vertices representing entities, E is the set of rights the

source vertex has over the destination vertex, Er is the

set of relationships between vertices, and Aa : V/2a is

a function associating the attributes to each entity, where

a is the set of all possible attributes of vertices including

vulnerabilities.

It is worth noting that, although we have changed the ini-

tial Take-Grant protection model, its original rewriting rules

are just applicable to the rights (the set R). In other words,

the set of relations between entities is not changed by the orig-

inal rewriting rules.

4.3. Rewriting rules

As the system executes operations and users interact with the

system, the state of the protection system changes. The initial

Take-Grant model has offered four rewriting rules as the exe-

cutable operations: take, grant, create, and remove rules. As we

have extended the initial Take-Grant model, we review the

take and grant rules (t and g stands for special rights take and

grant, respectively):

1. Take rule: Let x, y, and z be three distinct vertices in a pro-

tection graph G0 and let x be a subject. Also let there be an

edge from x to y labeled g with t˛g and g4R, an edge from y

c o m p u t e r s & s e c u r i t y 2 6 ( 2 0 0 7 ) 3 4 9 – 3 6 0 353

to z labeled b, and a4b4R. Then the take rule defines a new

graph G1 by adding an edge to the protection graph from x

to z labeled a. Fig. 2a shows the take rule graphically.

2. Grant rule: Let x, y, and z be three distinct vertices in a pro-

tection graph G0 and let x be a subject. Also, let there be an

edge from x to y labeled g with g˛g and g4R, an edge from x

to z labeled b, and a4b4R. Then the grant rule defines

a new graph G1 by adding an edge to the protection graph

from y to z labeled a. Fig. 2b shows the grant rule

graphically.

Exploiting vulnerabilities changes the system protection

state. However, there is no rewriting rule to address exploiting

the vulnerabilities. We address these changes through vulner-

ability rewriting rules. Each vulnerability rewriting rule checks

the model for presence of the preconditions of a vulnerability

and applies its postconditions to the model.

We make an assumption which seems to be realistic when

we are dealing with vulnerabilities in the real world. Each ex-

ploit involves only one active entity as an attacker, which acts

to gain extra access rights. We call this entity the active vertex.

Now we define the vulnerability rewriting rule:

Definition 6. A vulnerability rewriting rule is defined as a tuple

VRR ¼ ðGpre; f ;vAÞ, where Gpre is the graph identifying the vul-

nerability precondition; f is a function mapping the vulnerable

state to the destination state; and vA represents the active ver-

tex which utilizes the vulnerability.

In fact, the subgraph Gpre denotes the vulnerability pattern

which is considered as the precondition of the vulnerability in

our model. To be able to exploit the vulnerability, the graph G

should contain an isomorph subgraph to Gpre. Accordingly, an

exploit can be defined as an instance of the vulnerability re-

writing rule which is applied to a specific subgraph of graph

G. It is defined more formally as follows:

Definition 7. Let G is a VTG graph representing the current

protection state of the system. An exploit is defined as a tuple

e ¼ ðG;VRRv;uAÞwhere VRRv is the vulnerability rewriting rule

applying on G, and uA is the vertex representing the system

entity which corresponds the active vertex of VRRv.

In fact, an exploit is an instance of vulnerability rewriting

rule in a vulnerable state.

x

y

z

ty

z

t

x

y z

g

y z

x

xg

(a)

(b)

Fig. 2 – (a) Take rewriting rule and (b) grant rewriting rule.

5. Applicability of the model

Here we show how real-world vulnerabilities can be modeled

using our approach. As stated before, exploiting most vulner-

abilities causes the protection state of the system to be al-

tered. Thus, exploiting vulnerabilities is addressed in our

model by vulnerability rewriting rules. In fact the vulnerability

rewriting rules represent the transitions which are caused by

the vulnerability exploitation. We model some well-known

and realistic vulnerabilities in operating systems and web ap-

plications as rewriting rules in order to demonstrate the appli-

cability of our approach.

First we present a model of program executions in UNIX,

and then the common vulnerabilities in the program execu-

tion are modeled.

Example 1. (SETUID programs in UNIX) In the UNIX environ-

ment, the commands or programs are normally executed

with permissions of the user who invoked the command,

but an SETUID program is executed with the privilege of the

user who owns it. Fig. 3 shows two examples presenting the

model of command execution in the UNIX operating system.

Fig. 3a shows the execution of a regular program (copy) by

the user u. The regular rights (E ) are shown by solid edges

and the relationships (Er) are shown by dashed edges. Al-

though the owner of the copy program is root, this program

has access neither to file 1 nor to device1.

In Fig. 3b mount is executed as an SETUID program by user u.

The user u has no direct access to file1 and device1, but as the

program mount is a SETUID program whose owner is the user

root, it can access both file1 and device1. This fact is represented

in the model by assigning a t (take) right from mount to root.

t

r,w

u

root

mount

file1

r,w

r,w

file2

device 1

own

r,w

u

root

copy

file1

r,w

r,w

file2

device 1

own(a)

(b)

t

x

x

copy is regular program and user uexecutes it with its permissions

mount is a setuid program and user u executes it by root permissions.

Fig. 3 – Modeling execution of programs in UNIX: (a)

a regular program and (b) a SETUID program.

c o m p u t e r s & s e c u r i t y 2 6 ( 2 0 0 7 ) 3 4 9 – 3 6 0354

Applying the take rule enables the mount program to acquire

r and w rights over file1 and device1, respectively.

Example 2. (Buffer-overflow vulnerabilities) Buffer overflow vul-

nerabilities are reported to be the most exploited ones among

network attacks (SANS Research Center). We model all vulner-

abilities of this type by a single rewriting rule.

CVE-2000-0128 is a buffer-overflow vulnerability in Linux

mount and umount programs allowing local users to gain root

privileges via a long relative pathname (Hansman and Hunt,

2005; Mitre Corporation). As Fig. 4 shows, if the mount program

has this vulnerability, then the user u can gain the root privi-

leges. The user u can access file1 only indirectly through mount.

Nevertheless, the user u can exploit the buffer-overflow vulner-

ability in mount and gets the root privileges. This is shown by

adding a take (t) edge from u to the root vertex. Applying the

take rule, the user u obtains the rights read and write over file1.

We can model the buffer-overflow vulnerability rewriting

rule as following:

VRRbof ¼�

Gbof ; fbof ;vA

�;

where

Gbof ¼ ðV;E;Er;AaÞ¼ ðfðX;YÞg; fðX;Y; xÞg;B; fðY; fVULN ¼ BOFgÞgÞ;

and

fbofðV;E;Er;AaÞ ¼ ðV;EWfðX;Y; tÞg;Er;AaÞ;

and

vA ¼ X

t

r, wu root

mount{Vuln=BOF}

file1

own

x

t

r,wu root

mount{Vuln=BOF}

file1

own

x

t

t

r,wu root

mount{Vuln=BOF}

file1

own

x

t

r,w

[Exploiting BOF vulnerability]

[Applying Take rule two times]

(a)

(b)

(c)

t

Fig. 4 – (a) Mount is a SETUID program and has the buffer-

overflow vulnerability, (b) The user u gains the take right

over root account by exploiting the buffer-overflow and (c)

The user u gains the r and w rights over file1 by applying

Take rule.

where X and Y are nodes representing the attacker and vul-

nerable process, respectively. This rule implies that if Y has

a buffer-overflow vulnerability and X has x (execute) right

over Y, then it can exploit and acquire t right over Y.

Example 3. (Cross-site scripting vulnerabilities) Cross-site script-

ing vulnerabilities are a large group of vulnerabilities which

have increasingly populated in web applications. A cross-site

scripting vulnerability (CSS) comes from the failure of a web ap-

plication to validate user input before returning it to the client’s

web-browser. The essence of cross-site scripting is that an

intruder causes a legitimate web server to send a page to a -

victim’s browser That page contains a malicious scriptor HTML

codes of the intruder’s choice. The malicious script runs with

the privileges of a legitimate script originating from the legiti-

mate web server. Consequently, the attacker may access pri-

vate data on the client such as cookies, data files, or may

access restricted web sites on behalf of the victim (Hansman

and Hunt, 2005; CERT Advisory; Isamil et al., 2004). We refer

to this type of CSS as Server-CCS, as the vulnerability is due to

a fault in the web server. For example, the vulnerabilities

CVE-2002-0075 and CVE-2002-0682 are of this type (Mitre Cor-

poration). In other cases, the client browser itself has a vulner-

ability, which allows attacker to run a script within the browser

and access the private data. We refer to this type of CSS as

Client-CSS. CVE-2002-1187 is an example of client-CSS vulnera-

bility. Fig. 5 shows an example of the Server-CCS vulnerability,

in which the malicious attacker Eve has changed certain web

pages on the webserver to include malicious scripts. This can

be easily done in sites allowing users to send feedback or take

part in an auction. When user u browses a link referring to

the malicious page, the malicious script is executed on the cli-

ent, and Eve can access the information belonging to u. Because

the cooperation of u is needed for this vulnerability to be

exploited, we show its affect by adding an edge from u to Eve

labeled g (stands for grant). Applying the grant rule, Eve can

acquire u’s access rights, such as r and w, on the private file doc.

We can model the cross-site scripting vulnerability rewrit-

ing rule as following:

VRRcss ¼�Gcss; fcss;vA

�;

where

Gcss ¼ ðV;E;Er;AaÞ ¼ ðfðX;Y;WÞg; fðX;W; xÞ; ðY;W; xÞg;B;fðW; fVULN ¼ CSSgÞgÞ;

and

fcssðV;E;Er;AaÞ ¼ ðV;EWfðY;X; gÞg;Er;AaÞ;

and

vA ¼ X

where X, Y, and W are nodes representing attacker, legitimate

client, and web server, respectively. This rule implies that if W

has a CSS vulnerability, and X and Y have x right over W, then

the right g is added from Y to X.

Example 4. (Weak password vulnerability) The weak password

vulnerability (which we refer to as WP hereafter) arises

when a user account with a weak password is defined on

c o m p u t e r s & s e c u r i t y 2 6 ( 2 0 0 7 ) 3 4 9 – 3 6 0 355

a host M and the host provides the login service to its

users. Assume that a user has an account U on host M

and he/she has chosen a weak password for the account.

Also assume this host provides the login service through

process P. Having access to the login service, the attacker

A can guess U’s password and obtain all the privileges of

user account U.

Fig. 6 presents the password cracking rewriting rule which

demonstrates how exploiting the WP vulnerability results in

a change in access rights. The preconditions of this rule

have been depicted in Fig. 6a. Fig. 6b shows how the attacker

obtains the new access right t over user account a after

exploiting WP vulnerability. We use the attribute {Vuln¼WP}

to represent it. Also we add the attribute {Srv¼ Login} to the

attributes of vertex P to show the login service provided by

process P.

Based on above discussion, we can model the weak pass-

word vulnerability rewriting rule as following:

VRRwp ¼�

Gwp; fwp;vA

�;

where

Gwp ¼ ðV;E;Er;AaÞ ¼ ðffðA;P;W;UÞg; fðA; P; xÞg;fðM;P; fhostsgÞ; ðM;U; fhostsgÞg; fðP; fSrv ¼ LogingÞ;ðU; fVuln ¼WPgÞggÞ;

r,w

Webserver

Eveu

doc

{Vuln=CSS}

[Exploiting CSS vulnerability]

r,w

Webserver

doc

{Vuln=CSS}

g

u

r,w

doc

{Vuln=CSS}

g

u

[Applying Grant rule]

r,w

Webserver

(a)

(b)

(c)

x x

x x

x x

Eve

Eve

Fig. 5 – Server cross-site scripting vulnerability (Server-CSS).

and

fwpðV;E;Er;AaÞ ¼ ðV;EWfðA;Y; tÞg;Er;AaÞ;

and

va ¼ A

6. Analysis

In this section we present our approach to analyzing the

model. Our analysis is based on the following question:

‘‘Is it possible for attacker A to achieve access right r over y

or not?’’

Rights in the Take-Grant protection model can be trans-

ferred either cooperatively or unilaterally. It is also the case

in application of this model in vulnerability analysis. The at-

tacker can exploit some vulnerabilities unilaterally; however,

exploiting other vulnerabilities require cooperation of other

subjects of the system which grant their rights either unknow-

ingly or intentionally. In this section, we consider the capability

of an attacker to acquire rightswithout cooperation of other en-

tities. To be precise, we are interested in the following question:

‘‘Can attacker A achieve access right r over y unilaterally?’’

Grant rules are useless when we focus on unilateral transfor-

mation ofrights. Our mean of unilateral transformationofrights

can be defined more formally in VTG by the predicate can$access:

Definition 8. The predicate can$access (a, x, y, VTG0) is true for

the right a and two vertices x (as subject) and y, if there exist

x

M

A PU

{Vuln=WP}{Srv=Login}

x

M

A P

U

{Vuln=WP}

{Srv=Login}

t

[Cracking the password of account u]

(a)

(b)

host

s

hosts

hosts

host

s

Fig. 6 – Exploiting the weak password vulnerability. (a) The

account u has a weak password vulnerability and (b) the

attacker A exploits the WP vulnerability and gains a take

right over account u.

c o m p u t e r s & s e c u r i t y 2 6 ( 2 0 0 7 ) 3 4 9 – 3 6 0356

protection graphs VTG1,., VTGn such that VTG0w*VTGn using

only take and vulnerability rewriting rules, and in VTGn there

is an edge from x to y labeled a.

The definition allows the attacker to use only take and vul-

nerability rewriting rules which transfer the rights unilater-

ally. To answer can$access, we construct VTG’s closure

regarding de jure and vulnerability rewriting rules. First we

define the concept of closure:

Definition 9. Let A be the set of rewriting rules. We define GA

as the closure of graph G regarding A, if all possible rules of A

have been applied in GA and no more rewriting rules can be

applied in it.

The initial state of VTG graph is changed by both de jure

and vulnerability rewriting rules. Let Gdejure be the closure of

G regarding de jure rewriting rules (which only contains the

take rewriting rule based on the unilateral analysis) and GVRR

be the closure of G regarding vulnerability rewriting rules.

Only one set of rules has been applied in each of these clo-

sures. However, it maybe possible to apply the rewriting rules

of the other closure after constructing one closure. Fig. 7

shows an example of how one can exploit a previously consid-

ered vulnerability through a vulnerability rewriting rule after

applying a de jure rewriting rule.

The closures include all the possible ways through which

the rights could be transferred using the related vulnerability

rewriting rules. The attacker may exploit some sequences of

the vulnerabilities to reach its final goal.

To capture all the possible attack paths, a complete closure

is needed. The following algorithm constructs the complete

closure of G:

The correctness and time complexity of Gen_Complete_

Closure algorithm is dealt in Theorem 1.

Theorem 1. Gen_Complete_Closure constructs the complete closure

of G correctly in Oðn2k þ nkþ3Þ, where n is the number of vertices of

G, and k is the maximum number of nodes in the vulnerabilities pre-

graphs.

Algorithm Gen_Complete_Closure (G)

1 Let list F initially contain all ordered pairs of the from (e, r) where e

denotes edges labeled t, and r denotes its associated right

2 While (! IsEmpty(F ))

//applying all possible de jure rules

3 While (!IsEmpty(F ))

4 Let (e, r)¼ head(F )

5 For each take rule applicable through e

6 Apply the rule on G and add the resulting edge and its associated

right to F, if it has not been inserted yet.

7 Delete (e, r) from F

//applying all possible VRRs

8 for all rw ˛ VRR

9 pattern¼ FindPattern(G, rw, Gpre) // find Gpre-isomorph in G

10 Apply all exploits of the form exp¼ (G, rw, uA) where uA ˛ pattern

11 if exp involves addition of edges like e0 labeled r0 to G then

12 Add all such pairs ðe0; r0Þ to F, If they haven’t been inserted yet.

Proof. At first, we prove that lines 2–7 construct Gidejure given

the input graph Gi at the beginning of the ith round of the al-

gorithm. We should prove that the algorithm adds all possi-

ble edges and rights and also no multiple edges exist

between vertices. Let L¼ {(R1,r1), (R2,r2),.,(Rm,rm)} be a se-

quence of applied rules leading to a correct Gidejure closure,

where R and r stand for a related set of rights and rules, re-

spectively. Assume there are some pairs in L whose rights

are not produced by our algorithm and let (Rk, rk),

1 � k � m, be the first such ordered pair appearing in L. We

define rights t and a in Fig. 2a the basic rights of the take

rule. The basic rights of rk should have been already added

to graph by one of the rules r1 to rk�1, if they were not pres-

ent in the initial graph G. The similar conditions hold for our

algorithm as well; thus, the basic rights of rk have been added

to F (or they had been existed at first) and should be consid-

ered by the algorithm which leads in addition of Rk and con-

tradicts the initial assumption that Rk has not been added by

Gen_Complete_Closure algorithm. Moreover, the condition of

line 6 in the algorithm ensures that no ordered pair will be

added to F repeatedly.

At each round of the algorithm, lines 8–12 consider all the

vulnerability rewriting rules and apply all the possible ones

and append all the newly added rights to list F. The algorithm

terminates when no item has remained in list F. Let jVj be the

maximum number of vulnerabilities and k represents the

maximum number of vertices in graph Gpre of a vulnerability

rewriting rule. We first prove that after at most

nðn� 1k� 1 Þðk� 1Þ!jVj times of executing the external loop, all

the possible rewriting rules have been applied and lines 8–12

do not change the graph anymore. This result is based on

the fact that every active vertex of G participates only once

in a given exploit of the form exp¼ (G, rw, uA) because after

that uA has achieved all the desired rights it could achieve

by applying this rule. It is easy to see that the number of all

possible vulnerability rewriting rules is no more than

nðn� 1k� 1 Þðk� 1Þ!jVj, so if the algorithm applies only one vul-

nerability rewriting rule in each round of the loop at worst,

after at most nðn� 1k� 1 Þðk� 1Þ!jVj times of loop execution all

the rules of this type have been applied.

Now we compute the time complexity of each internal

loop. Lines 2–7 consider each edge of the list F for applying

possible take rewriting rules. The test of line 5 takes O(n).

At each moment, there are O(n2) elements in list F. Thus

time complexity of the first internal loop is O(n3). Notice

that checking the condition of line 6 can be done in O(1) by

using the graph data structure instead of exploring the list

F because the edges and their associated rights are added to

G as well as F. Lines 8–12 consider all the applicable rewriting

rules and apply these rules if possible. The time complexity

of FindPattern and applying the rewriting rule in it is Oð knÞ.

Therefore, the time complexity of the second loop is Oð knÞ con-

sidering that the number of vulnerabilities, jVj, and the maxi-

mum number of vertices in rewriting rule pattern graph, k,

are constant. Thus, the time complexity of the whole algorithm

is Oðn2k þ n3Þ ,

Having a complete closure, it is clear that we can answer the

safety problem introduced at the beginning of this section in

O(1). Therefore the following theorem holds:

c o m p u t e r s & s e c u r i t y 2 6 ( 2 0 0 7 ) 3 4 9 – 3 6 0 357

m

{Srv=Login}

hosts

P

hosts

A

Q {Vuln=BoF}

V {Vuln=WP}x

t

x

x

t

m

{Srv=Login}

hosts

P

hosts

Q {Vuln=BoF}

V {Vuln=WP}x

x

*

Fig. 7 – Applying a de jure rule between two vulnerability rewriting rules. Initially, A cannot exploit BoF vulnerability of Q,

because it has not the x right over Q, but after exploiting weak password vulnerability of V, and applying a take rule, it

acquires the x right over Q, and it is now able to exploit BOF vulnerability of Q.

Theorem 2. Let A be the union of the de jure and vulnerability re-

writing rules. We can construct GA in polynomial time and answer

the safety problem in constant time. ,

It is worth of noting that the initial cost of constructing the

complete closure will be paid once and the attacker’s capabil-

ity to access the network resources can be verified in constant

time afterwards. Moreover, the algorithm can be modified to

generate attack path. The attack path can be tracked by assign-

ing text labels to rights when applying rewriting rules. The

assigned text describes how the vulnerabilities are exploited

or the de jure rules are applied as well as the subjects and ob-

jects involved in the rules. Fig. 8 depicts how a new label can

be generated from two previously generated ones. Assume

that rights p and q have been already added by rewriting rules

and text labels Label ( p) and Label (q) contain the attack sce-

narios which lead to the addition of these rights respectively.

Also, assume we can now apply a new rewriting rule and ob-

tain the new right r. The associated text label of r, Label (r), can

be of the following form:

LabelðrÞ ¼n

LabelðpÞ;LabelðqÞ;

‘‘having access rights p and q;

we can apply rewriting rule x and achieve right r

‘‘o

Subsequently, Label(r) contains the complete attack sce-

nario acquiring right r.

7. Case study

In this section, we represent the application of Vulnerability

Take-Grant model and the acquired results in vulnerability

analysis of a typical network. Besides the previously intro-

duced rewriting rules, we need some general rules to analyze

the real world vulnerabilities. For example, each user’s access

r

Label(p)

p

Label(q)

q

Label(r)

Fig. 8 – Generating attack scenario labels.

rights are a subset of the root’s access rights. This fact can be

shown in the VTG model as a set of take edges drawn from

the root user-account to other user accounts defined on the

same host.

Fig. 9 depicts a local network, where the attacker (Eve) is

placed outside the network. The firewall configuration allows

remote users to have access to web and mail services. Eve’s

goal is to gain access to Bob’s files hosted on Saman. On the

machine NSC, the HTTP and SMTP services are listening to

the associated ports. These services are running with the

user privileges apache and root, respectively. Moreover, SSH

and RPC services are running on the machine FileServer with

the user privilege root, and SMB service is running on Saman

with the same user privilege.

Using the Nessus and OVAL scanners, we found that the

services HTTP on NSC, SMB on Saman and RPC on FileServer

have buffer overflow vulnerability. Moreover, we found that

the user account root on the machine FileServer suffers from

weak password vulnerability and the user Bob has added the

account manager from machine FileServer to its .rhosts file.

The VTG model of network is represented in Fig. 10. To

avoid congestion, unnecessary relations between hosts are ig-

nored in the figure.

By using the complete closure algorithm (Gen_Complete_

Closure) described in the previous section and applying the

rewriting rules on the above VTG graph, GA is acquired.

Some part of GA is depicted in Fig. 11.

As mentioned above, the Eve’s goal is to access Bob’s file on

the Saman. Eve is allowed to access Bob’s file if and only if

there is an edge from Eve to Bob in GA including right r in its

set of access rights. The attack path which brings the Eve to

Bob’s file is shown in a dotted line in Fig. 11. We can obtain

the attack path by using the previously described technique.

One possible attack scenario is as follows:

1. Eve exploits the HTTP buffer overflow vulnerability on the

machine NSC and gains the user privilege apache on this

machine.

2. Now Eve has access to SSH service on machine FileServer

and can try to guess root password.

3. After finding the root password, Eve has all the rights of user

account manager on machine FileServer.

4. Pretending to be manager, Eve acquires Bob’s access rights

on machine Saman.

5. Consequently, Eve reaches its final goal which is having

access to file1 on machine Saman.

c o m p u t e r s & s e c u r i t y 2 6 ( 2 0 0 7 ) 3 4 9 – 3 6 0358

Fig. 9 – Case study network topology.

8. Conclusions and future works

In this paper, we introduced a new method for network vener-

ability analysis, which was motivated from Take-Grant

protection model. This method affords the possibility of

representing the protection state of a network with a formal

model. We demonstrated how different types of vulnerabil-

ities could be represented in our model if an appropriate level

of abstraction is selected. The attacker’s capability to access

the resources of network can be analyzed by the model. We

also introduced the complete closure concept to address all

the possible ways of exploiting vulnerabilities and presented

an algorithm to construct the complete closure graph in Oðn2k þnkþ3Þ where k is a constant value representing the maximum

number of nodes in a vulnerability pre-graph. Having com-

plete closure, the safety problem could be answered in constant

time. Besides analyzing vulnerabilities, the proposed method

could generate possible attack scenarios. Using the model

and its analysis method, network designers and administra-

tors can predict possible attacks to their network resources,

just by providing the network configuration information.

Such information consists of the hosts’ vulnerabilities and

the network topology which can be detected using off-

the-shelf scanning tools as described in Section 3.

It is possible to use the model for more comprehensive anal-

ysis. Answering questions such as finding the critical vulnerable

path, the shortest path to accessing a right and minimum cost path of

accessing rights (considering the possibilities or difficulties of

exploiting different vulnerabilities) can represent further ap-

plications of Vulnerability Take-Grant model in the vulnerabil-

ity analysis. Reducing the time complexity of the analysis can

be considered as well. The proposed algorithm constructs the

complete closure in bounded polynomial time and answers

to safety problem in constant time. Considering the similarity

of de jure and vulnerability rewriting rules, it may be possible

to analyze the vulnerabilities by an algorithm just like can$steal

(Jones et al., 1976) in linear time. The nature of Take-Grant

Evex

hosts

hostshosts

root

apacheowns

http

smtp

NSCDevil

ssh

rpc

root

{Vuln=BoF}

{Vuln=WP}

smb

file1

Saman

{Vuln=BoF}

manager

root

rBob

x

x

x

{Vuln=BoF}

{Vuln=rhost}

g

t

t

t

FileServer

t

hosts

owns

owns

owns

owns

hosts

hostshosts

hosts

hosts hosts

hosts

hosts

x

{Srv=Login}

Fig. 10 – VTG model of NSC network and the Attacker on Devil machine.

c o m p u t e r s & s e c u r i t y 2 6 ( 2 0 0 7 ) 3 4 9 – 3 6 0 359

Evex

hosts

hostshosts

root

apacheowns

http

smtp

NSC

Devil

ssh

rpc

root

smb

file1

Saman

manager

root

rBob

x

x

xg

t

t

t

FileServer

t

hosts

owns

owns

owns

owns

hosts

hostshosts

hosts

hosts hosts

hosts

hosts

x

t

r

ttt

r

hosts

t

Fig. 11 – Part of GA for the case study network.

model makes it most suitable for analyzing the vulnerabilities

based on changes in access rights. Moreover, it is interesting to

generalize this method for analyzing vulnerabilities based on

a proper high-level category of vulnerabilities and their pre-

conditions and postconditions. Having the abstract category

of vulnerabilities, it is possible to explore the safety problem

regarding vulnerabilities more theoretically.

Acknowledgments

The authors are grateful to Reza Sadoddin for his valuable

comments and constant cooperation on finalizing this paper.

The authors also acknowledge the comments of Matt Bishop

on the draft version of this paper and his guides about future

directions.

r e f e r e n c e s

Ammann P, Wijesekera D, Kaushik S. Scalable, graph-basednetwork vulnerability analysis. In: Proceedings of nineth ACMconference on computer and communications security,Washington, DC; November 2002.

Bishop M. Hierarchical take-grant protection systems. In:Proceedings of 8th symposium on operating systemsprincipals; December 1981. p. 107–23.

Bishop M. Practical Take-Grant systems: do they exist? Ph.D.thesis, Department of Computer Sciences, Purdue University,West Lafayette, IN 47097; May 1984.

Bishop M. Conspiracy and information flow in the Take-Grantprotection model. Journal of Computer Security 1996;4(4):331–60.

Bishop M, Bailey D. A critical analysis of vulnerabilitytaxonomies. Technical report CSE-96-11. Department ofComputer Science, University of California at Davis;September 1996.

CERT Advisory CA-2000–02. Malicious HTML tags embedded inclient web requests [online]. Available from: <http://www.cert.org/advisories/CA-2000-02.html>.

Cheops-ng, the network swiss army knife [online]. Availablefrom: <http://cheops-ng.sourceforge.net/>.

Dacier M, Deswarte Y. Privilege graph: an extension to the typedaccess matrix model. Proceedings of third Europeansymposium on research in computer security (ESORICS 94),(Brighton, UK). Lecture Notes in Computer Science: ComputerSecurity 1994;875:319–34 [Springer-Verlag].

Derasion R. The Nessus attack scripting language reference guide[online]. Available from: <http://www.nessus.org>; 2000.

Frank J, Bishop M. Extending the Take-Grant protection system.Technical Report. Department of Computer Science,University of California at Davis; 1996.

Hansman S, Hunt R. A taxonomy of network and computerattacks. Journal of Computer Security 2005;24(1):31–43.

Internet Security Systems. System Scanner information [online].Available from: <http://www.iss.net>.

Isamil O, Etoh M, Kadobayashi Y. A proposal and implementationof automatic detection/collection system for cross-sitescripting vulnerability. In: Proceedings of the 18thinternational conference on advanced informationnetworking and application (AINA’04); 2004.

Jones A, Lipton R, Snyder L. A linear time algorithm fordeciding security. In: Proceedings of 17th annualsymposium on the foundations of computer science;October 1976. p. 33–41.

Jones A. Protection mechanism models: their usefulness,Foundations of secure computing. New York City, NY:Academic Press; 1978. p. 237–54.

Jha S, Sheyner O, Wing J. Two formal analyses of attack graphs.In: Proceedings of 15th IEEE computer security foundationsworkshop, Nova Scotia, Canada; June 2002.

c o m p u t e r s & s e c u r i t y 2 6 ( 2 0 0 7 ) 3 4 9 – 3 6 0360

Jajodia S, Noel S, O’Berry B. Topological analysis of network attackvulnerability. In: Kumar V, Srivastava J, Lazarevic A, editors.Managing cyber threats: issues, approaches and challenges.Kluwer Academic Publisher; 2003.

Mitre Corporation. Common vulnerabilities and exposuredatabase [online]. Available from: <http://cve.mitre.org/>.

Noel S, Jajodia S, O’Berry B, Jacobs M. Efficient minimum-costnetwork hardening via exploit dependency graphs. In:Proceedings of the 19th annual computer security applicationsconference, Las Vegas, Nevada; December 2003.

Noel S, Jajodia S. Managing attack graph complexity throughvisual hierarchical aggregation. In: Proceedings of the ACMCCS workshop on visualization and data mining for computersecurity, Fairfax, Virginia; October 2004.

Noel S, Robertson E, Jajodia S. Correlating intrusion eventsand building attack scenarios through attack graphdistances. In: Proceedings of the 20th annual computersecurity applications conference, Tucson, Arizona;December 2004.

Ou X, Govindavajhala S, Appel AW. MulVal: a logic-based networksecurity analyzer. In: Proceedings of 14th USENIX SecuritySymposium; 2005. p. 113–28.

Ritchey RW, Ammann P. Using model checking to analyzenetwork vulnerabilities. In: Proceedings of IEEE symposium onsecurity and privacy; May 2001. p. 156–65.

Ryan P, Schneider S. Modeling and analysis of Security protocols:a CSP approach. Addison-Wesley; 2001.

Ramakrishnan CR, Sekar R. Model-based analysis of configurationvulnerabilities. Journal of Computer Security 2002;10(1/2):189–209.

Rohrmair G, Lowe G. Using data-independence in the analysisof intrusion detection systems. In: Workshop on issuesin the theory of security (WITS’03), Warsaw, Poland; April2003.

Snyder L. On the synthesis and analysis of protection systems. In:Proceedings of sixth symposium on operating systemsprincipals; November 1977. p. 141–50.

Swiler L, Phillips C, Ellis D, Chakerian S. Computer attackgraph generation tool. In: Proceedings of DARPAinformation survivability conference & exposition II; June2001.

Sheyner O, Haines J, Jha S, Lippmann R, Wing J. Automatedgeneration and analysis of attack graphs. In: Proceedingsof IEEE Symposium on Security and Privacy, Oakland, CA;2002.

Shapiro JS. The practical application of a decidable access controlmodel. Technical Report SRL-2003–04. John HopkinsUniversity; 2003.

SANS Research Center. The SANS top 20 Internet securityvulnerabilities [online]. Available from: <http://www.sans.org/top20/>.

Shahriari HR, Jalili R. Using CSP to model and analyze transmissioncontrol vulnerabilities within the broadcast network. In:Proceedings of the IEEE international networking andcommunication conference (INCC’2004); June 2004. p. 42–7.

Shahriari HR, Jalili R. Modeling and analyzing networkvulnerabilities via a logic-based approach. In: Proceedings ofsecond international symposium of telecommunications (IST2005), September 10–12; 2005. p. 13–8.

Wu M. Hierarchical protection systems. In: Proceedings of 1981symposium on security and privacy; April 1981. p. 113–23.

Wojcik M, Bergeron T, Wittbold T, Roberge R. Introduction toOVAL: A new language to determine the presence of softwarevulnerabilities [online]. Available from: <http://oval.mitre.org/documents/docs03/intro/intro.html>; November 2003.

Zerkle D, Levitt K. NetKuang – a multi-host configurationvulnerability checker. In: Proceedings of the sixth USENIXUNIX security symposium, San Jose, CA; 1996.

Hamid Reza Shahriari received his M.Sc. inComputer Science from Amir-Kabir Univer-sity of Technology, Tehran, Iran, in 2000.He is currently a Ph.D. student in ComputerScience in Sharif University of Technology,working on his thesis on vulnerability analy-sis of computer networks. His research inter-ests are Information Security and FormalMethods in Security.

Rasool Jalili received his Ph.D. in ComputerScience from The University of Sydney, Aus-tralia in 1995. He then joined, as an assistantprofessor, the Department of Computer Engi-neering, Sharif University of Technology,Tehran, Iran, where he is doing research inthe areas of Distributed Systems and Infor-mation Security.