Abordagem de inteligência de fontes abertas com mapas auto-organizáveis de kohonen e processamento de linguagem natural para execução automática de dorks

Abstract

To protect the information located on the Internet, the Information Security area has a process to test the security of web pages, called Intrusion Test or Pentest. In its initial phase, the test performs searches on Web pages to gather or obtain the maximum information available to support other phases of the process, or even, find some vulnerabilities. This phase is called Open Source Intelligence (OSINT). A practice for OSINT used in Pentest is Google Hacking, which works using strings called Dorks. Google Hacking can be performed in two ways: manual and automatic, and the first has a longer duration than the second. One way to improve Pentest performance is to make it automatic with the application of Artificial Intelligence (AI) techniques, such as Kohonen's Self-Organizing Maps (SOM), a type of artificial neural network used to generate clusters, and Natural Language Processing (PLN), a subarea of AI responsible for making computers able to interpret and develop content in human language. So, the objective of this work was to develop an Open Source Intelligence Approach with Kohonen's Self-Organizing Maps and Natural Language Processing for automatic execution of Dorks to improve the performance of the Google Hacking practice. The selected database was the Google Hacking Database (GHDB), containing 4,211 Dorks and 4 attributes. The approach proposed in this work was developed in 10 phases: preparing the environment to run OSINT, defining the OSINT scope, selecting the Dorks base, selecting and evaluating the OSINT tools, pre-processing the Dorks base, transforming the Dorks base, application of SOM in the Dorks base, analysis of results, addition of new information in the Dorks database and validation of the automatic execution of Dorks. The results obtained revealed a better performance of the proposed approach when automatically executing the Dorks base compared to manual execution. It was concluded, then, that Open Source Intelligence Approach with Kohonen's Self-Organizing Maps and Natural Language Processing can be applied in the automatic execution of Dorks.