Innovative Security Solutions: Gaetano Perrone Tutor Simon Pietro Romano
Gaetano Perrone, a PhD holder in Information Technology, is the co-founder of SecSI and has a background in Computer Science Engineering. He has worked on projects like AI platforms for ethical hacking and security automation. His contributions include software development of a collaborative ethical hacking platform and an AI engine for suggesting actions during hacking sessions.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
Gaetano Perrone Tutor: Simon Pietro Romano XXXIV Cycle - I year presentation SecSI: Security Solutions for Innovation
Background Computer Science Engineering degree in 2017 Docker Security Playground: A microservices-based platform for the study of Network Security scenarios Security Consultant in NTT Data (2017 - 2018) Today PhD in Information Technology and Electrical Engineering Cofounder of SecSI Gaetano Perrone 2
Context 1. AI Platform aimed at supporting the penetration tester during Ethical Hacking sessions In collaboration with NTT Data Combine Vulnerability Assessment and Penetration Testing techniques by using AI Focus on Web Applications Artificial Intelligence for WAPT DSP improvements Drag and Drop Interface Hack Tools 2. Security Automation & Virtualization Gaetano Perrone 3
Contribution (1 of 2) Software Development of Ch4pt3r: Collaborative Ethical Hacking Platform for Penetration Tester A complete model and implementation of Web Application Penetration Test Hacking Goals and Web Attacks 1. Based on OWASP Testing Guide and Penetration Test reports Web Attack classification 2. AI Models Design and Development Suggest users best actions to perform in order to detect vulnerabilities Focused on Reninforcement Learning and Natural Language Processing techniques 1. 2. Gaetano Perrone 4
AI Engine to detect best actions User A.I. Assistant Application 1 1 DESIGN S0 S1 S2 2 2 SF 3 3 For the chosen HackingGoal, the AI Assistant will suggest all possible actions that the user may pursue, ordered by estimated efficacy From the current state, the AI Assistant will suggest all possible actions that the user may pursue, ordered by estimated efficacy THE PROCESS IS REPEATED UNTIL The user finds himself in another node User starts the session and chooses HackingGoal The user reaches the final state where he needs to take a decision PROCESS FINAL STATE The application records the outcome of the Hacking Session User chooses any action to be pursued among all suggested actions User chooses any action to be pursued among all suggested actions The application moves the user towards the next step in the Hacking Session by following the path designed by the choosen action and records the choice The application moves the user towards the next step in the Hacking Session by following the path designed by the choosen action and records the choice The AI Assistant updates its scores associated to each action s efficacy with the data collected from the new session Gaetano Perrone 5
NLP to detect valid HTTP requests Gaetano Perrone 6
Ch4PT3r Architecture Virtual Security Analyst The pentester connects to the application and performs a Hacking Session AI Engine: suggests the pentester the best action for each step in the Hacking Session suggested on the basis of historical data Hacktuator: the hacker armed arm , it offers an API to obtain observations from the environment and to send Hacking actions Gaetano Perrone 7
Contribution (2 of 2): DSP improvements Drag and Drop Interface Improve virtual security network scenarios design phase Hack Tools oneline feature A complete subset of security tools to improve enhance and simulation experience Gaetano Perrone 8
Next Years Formalize our results Hacking Goals concept formalization Comparison with other attack classifications (CAPEC: Common Attack Platform and Enumeration Classification) Evaluation phase Testbed design for XSS and SQLi models Compare our results with current state of art detection techniques Reproducibility of experiments by using DSP Improve Docker network by using virtual network technologies Integrate experiment models in our platform Gaetano Perrone 9
Thanks for the attention! Gaetano Perrone 10
