Hybrid Attack Path Enumeration System Based on Reputation Scores

Abstract

As the cyber-attack trends are shifted from the volumetric attacks to the multi-layered attacks, it is more difficult for the IT administrators to find those attack attempts within their system and networks. However, vulnerability assessment is not easy due to the complex connections between multi-layered applications, servers, and networks. There are many security functionalities, but it is hard to apply strong security functionality to every information asset. In many cases, especially low computing power devices, authentication is the only or the first defense mechanism. Also, IT administrators continuously remove security vulnerabilities in applications, operating systems, and networks, but security vulnerabilities are repeatedly found due to the vendor's lack of security development process. To establish practical security defense strategy in the multi-layered network environment, we propose an advanced attack path enumeration methodology based on IT asset's reputations and authentication score. A predictive attack path enumeration based on our proposed method can help to find the best defense plan. We demonstrate our approach by design and implementation of a Hacking response measurement system and case study.