Attack Graph Research Articles

In the mind of an insider attacker on cyber‐physical systems and how not being fooled

Insider attacks are one of the most serious threats for cyber-physical systems, they have potentials to inflict destructive damages on physical processes while remaining stealthy. This study dissects several insider attacks by examining their modes of data tampering. To set the scene, a general framework of a cyber-physical system is constructed, a pattern characterising insider attacks is introduced in the form of attack goals, resources, constraints, modes, and attack paths. The conditions under which the attackers can maintain stealthy are examined in both temporal and spatial domains. With the inside knowledge, an attacker can use an attack graph to exploit system vulnerabilities and determine the high impact targets. To demonstrate the effectiveness of this analysis, a cyber-physical system is constructed by using networks and a nuclear process control test facility with ports deliberately left open for attackers. Two attack scenarios are staged, and their characteristics and impacts are examined. This case study demonstrates how an insider attacker might mount an attack by using data tampering and how they can maintain stealthy before major damages are done to the physical system. The significance of this study is to uncover the techniques of insider attackers so that vulnerabilities can be mended.

Network Risk Assessment Based on Baum Welch Algorithm and HMM

With the increasingly extensive applications of the network, the security of internal network of enterprises is facing more and more threats from the outside world, which implies the importance to master the network risk assessment skills. To improve the accuracy is an importent issue. In the big data era, there are various security protection techniques and different types of group data. Meanwhile, Online Social Networks (OSNs) and Social Internet of Things (SIoT) are becoming popular patterns of meeting people and keeping in touch with friends (Jiang et al. ACM Comput Surv 49:10:1–10:35 2016; Shen et al. 2017). Risk assessment, as a bridge between security experts and network administrators, whose accuracy can influence the judgment of administrators to the entire network state. In order to solve this problem, this essay uses the Baum Welch algorithm to optimize the risk assessment process by establishing the HMM model, which can improve the accuracy of the evaluation value. Firstly, behavior of the attacker is described in-depth by the attack graph generated through MulVAL framework. Then, the nodes on the attack path can will be evaluated and the value will be further evaluated by the Bayesian model. Finally, by establishing the hidden Markov model, the corresponding parameters can be defined and the most likely probabilistic state transition sequence can be calculated by using the Viterbi algorithm and Baum Welch algorithm to deduce the attack intent with the highest possibility.

Bayesian attack graphs for platform virtualized infrastructures in clouds

Virtualization security is an important aspect to be carefully addressed while provisioning cloud services. In this paper, we propose a novel model using Bayesian Attack Graphs (BAG) to perform security risk assessment for platform virtualized infrastructures that are used for building cloud services. BAGs are powerful mechanisms that can be used to model the uncertainties inherent in security attacks. We build upon the reference conditional probability tables for the BAG nodes using the reported attacks on virtualized systems from the Common Vulnerabilities and Exposures (CVE) database. We employ Bayesian probabilistic inference techniques on the model presented and showcase the results obtained that can be used by system architects for the risk assessment of such infrastructures. In addition to the probabilistic model, we also present a deterministic approach with security metrics for attack graphs and derive the values for the modeled BAG, which can be used for assessing and comparing with other architectures. The approach described here to draw inferences from the BAG can be employed by system architects to find explanations to critical queries in security design and also to carefully select the countermeasures to be installed. The model can also be used to learn from future a-posteriori evidence data from actual security breaches to provide an efficient risk assessment.

Behavioral and Game-Theoretic Security Investments in Interdependent Systems Modeled by Attack Graphs

In this article, we consider a system consisting of multiple interdependent assets, and a set of defenders, each responsible for securing a subset of the assets against an attacker. The interdependencies between the assets are captured by an attack graph, where an edge from one asset to another indicates that if the former asset is compromised, an attack can be launched on the latter asset. Each edge has an associated probability of successful attack, which can be reduced via security investments by the defenders. In such scenarios, we investigate the security investments that arise under certain features of human decision making that have been identified in behavioral economics. In particular, humans have been shown to perceive probabilities in a nonlinear manner, typically overweighting low probabilities and underweighting high probabilities. We show that suboptimal investments can arise under such weighting in certain network topologies. We also show that pure strategy Nash equilibria exist in settings with multiple (behavioral) defenders, and study the inefficiency of the equilibrium investments by behavioral defenders compared to a centralized socially optimal solution.

A Prediction Method of Node Attack Path based on Optimized-AG

An optimization algorithm for reducing the scale of attack graphs and an attack path prediction method are presented herein to cover the difficulty of predicting the attack path in traditional attack graphs. Firstly, a new distance cost attack graph model is generated and converted into a marked attack graph via the algorithm. Secondly, the original attack graph is optimized by introducing an attack distance weight value and a path redundancy coefficient in order to determine the possible attack paths and calculate the cost of path attack behavior. Finally, the preferred attack path is determined based on an evaluation function. According to the experimental results, the above scheme eliminated the path redundancy of attack graphs and achieved comprehensive prediction of attack paths.

A Vulnerability Risk Assessment Method Based on Heterogeneous Information Network

Due to the increasing number of network security vulnerabilities, vulnerability risk assessment must be performed to prioritize the repair of high-risk vulnerabilities. Traditional vulnerability risk assessment is based primarily on the Common Vulnerability Scoring Systems (CVSS) and attack graphs. Nevertheless, the CVSS metrics ignore the impact of the vulnerability on the specific network, which accounts that the identical vulnerability exists in different network environments is assigned repeated values. Additionally, the attack graphs still suffer from scalability and readability issues. To solve the above problems, a ranking method based on the heterogeneous information network is innovatively proposed to assess the vulnerability risk in a specific network. It considers the exploitability of a vulnerability, the impact of a vulnerability on the network components, and the importance of the vulnerable components. First, a heterogeneous information network containing vulnerability and host and the relationships between host and host is constructed to compute the risk score for each vulnerability and implement the ranking process. Second, a model extension method is proposed to adapt to situations in which additional factors related to vulnerability risk assessment need to be considered. Finally, we explore two case studies to compare the proposed method with CVSS and attack graph-based methods. The simulation results show that the proposed method can accurately assess the risk of vulnerabilities in a specific network environment and that it has a lower computational complexity than other methods.

Comparative Analysis of Threat Modeling Methods for Cloud Computing towards Healthcare Security Practice

Healthcare organizations consist of unique activities including collaborating on patients care and emergency care. The sector also accumulates high sensitive multifaceted patients’ data such as text reports, radiology images and pathological slides. The large volume of the data is often stored as Electronic Health Records (EHR) which must be frequently updated while ensuring higher percentage up-time for constant availability of patients’ records. Healthcare as a critical infrastructure also needs highly skilled IT personnel, Information and Communication Technol-ogy (ICT) and infrastructure with regular maintenance culture. Fortunately, cloud computing can provide these necessary services at a lower cost. But with all thees enormous benefits of cloud computing, it is characterized with various information security issues which is not enticing to healthcare. Amid many threat modelling methods, which of them is suitable for identifying cloud related threats towards the adoption of cloud computing for healthcare? This paper compared threat modelling methods to determine their suitability for identifying and managing healthcare related threats in cloud computing. Threat modelling in pervasive computing (TMP) was identified to be suitable and can be combined with Attack Tree (AT), Attack Graph (AG) and Practical Threat Analysis (PTA) or STRIDE (spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege). Also Attack Tree (AT) could be complemented with TMP, AG and STRIDE or PTA. Healthcare IT security professionals can hence rely on these methods in their security practices, to identify cloud related threats for healthcare. Essentially, privacy related threat modeling methods such as LINDDUN framework, need to be included in these synergy of cloud related threat modelling methods towards enhancing security and privacy for healthcare needs.

Bio-inspired security analysis for IoT scenarios

Computer security has recently become more and more important as the world economy dependency from data has kept growing. The complexity of the systems that need to be kept secure calls for new models capable of abstracting the interdependencies among heterogeneous components that cooperate at providing the desired service. A promising approach is attack graph analysis, however, the manual analysis of attack graphs is tedious and error prone. In this paper we propose to apply the metabolic network model to attack graph analysis, using three interacting bio-inspired algorithms: topological analysis, flux balance analysis, and extreme pathway analysis. A developed framework for graph building and simulations as well as an introductory to some IoT scenarios as use cases are also outlined.

Minimizing information security risks based on security threat modeling

The well-elaborated models of information security threats (IST) allow for the optimal development of a protection plan. This plan will be based on current threats and will consider effective countermeasures that increase the level of information security (IS). The threat model is described using different automation methodologies of this process. It is also possible to visualize the structure of complex objects and processes them from the required angle and with sufficient granularity. Constructing various threat implementations as trees or attack graphs (AG) is one of the relevant directions in assessing the level of IS. The creation of a software application for automation and formalization of assessing the information security process of IS assets, and the localization of bottlenecks in the IS protection, is dealt with in the article. A distinctive feature of the application is the use of the Federal Service for Technology and Export Control of Russia (FSTEC of Russia) threat data bank for modeling the attack tree. The developed software application allows you to reduce time, simplify the process of assessing the security of an IS, and also visualizes the threat modeling process. The scope of the developed software product may be small and medium-sized businesses, as well as state-owned enterprises.

A framework for security enhancement in multitenant SDN-based datacentres

Nowadays, there is a rising demand for enterprises to migrate datacentre into public cloud. This transfer has several drivers such as decreasing datacentre operational cost and increasing scalability. Moreover, it motivated cloud providers to construct more multitenant datacentres. On the other hand, cyber attacks against IT infrastructures are becoming sophisticated. In this paper, a framework is proposed to enhance security for software defined network (SDNs)-based multitenant datacentres. A novel mechanism is introduced to only forward suspicious traffic for deep packet inspection (DPI) without affecting any other traffic. Attack graphs are used to specify all possible attack scenarios against datacentre network. Framework proof of concept prototype is implemented using a mixed emulation and simulation environment. A typical multitenant datacentre network topology is used to test and evaluate framework performance. Performance evaluation results show framework feasibility and performance against attacks while not affecting delay sensitive traffic.

SMART: security model adversarial risk-based tool for systems security design evaluation

Abstract As development and deployment of secure systems continue to grow at scale, there is an equal need to evaluate these systems for vulnerabilities and other problems. However, the process of evaluating these designs is complicated and mainly proprietary to the group performing the evaluation. Generally, one follows the generic risk equation of probability and impact. In addition, one should examine the costs related to the adversary and the defender of a system. Without accounting for all of these different aspects, one cannot expect to properly assess the security of a system model or design. This work presents a security model adversarial risk-based tool (SMART) for systems security design evaluation. Our tool reads in a systems security model an attack graph and collects the necessary information for the purpose of determining the best solution based on a calculated security risk represented as a monetary amount. The advantage of the tool is the level of automation provided in the evaluation of security attack trees while providing meaningful metrics that are effortless to compare and contrast.

Factor of Security (FoS): Quantifying the Security Effectiveness of Redundant Smart Grid Subsystems

According to IEC 61850-90-4, most smart grid substations are designed with redundancy in order to improve their availability in case of failures. Redundancy usually takes the form of having multiple subsystems with identical functionality based on the assumption that failures in one subsystem are isolated from other subsystems. However, this is not necessarily true in the case of failures caused by malicious attacks, because attackers can easily reuse their skills and tools across different subsystems under similar configurations. Taking this into consideration, this paper introduces the factor of security (FoS) metrics to quantify the security effectiveness of redundant subsystems in smart grids. Specifically, we first apply the attack graph model to capture various threats in smart grids and substations; we then formally define the FoS metric and the probabilistic FoS metric; finally, we evaluate those metrics under different scenarios through simulations.

An activity theory model for dynamic evolution of attack graph based on improved least square genetic algorithm

Most of the risk assessments of the attack graph are static and have a fixed assessment scenario, which limit the real-time nature of the situation assessment. This paper presents an activity theory model to analyse the contradictions in the attack behaviour. In order to assess the maximum probability path of an attacker and dynamically remain in control for the overall situation, a definition of attacker's benefit (loss/gain) value calculated by contradictory vector is proposed. The attacker's budget is applied as an unbiased amount in the least square genetic algorithm, optimises the fitness function of the genetic algorithm. Experimental results reveal that the improved least square genetic algorithm with unbiased estimator effectuate higher gains owing to the high fit degree of fitness function. With the coming evidence, the maximum probability attack paths get a more accurate and dynamic risk assessment of the situation.

A Multi-Step Attack Detection Model Based on Alerts of Smart Grid Monitoring System

Smart Grid Monitoring System(SGMS) is an important means to protect the security of smart grid. The high volumes of alerts generated by SGMS often confuse managers. Automatically handling alerts and extracting attack events is a critical issue for smart grid. Most of the existing security event analysis methods are designed for Internet, which will not be directly applicable to the power grid for high reliability and low attack tolerance requirements. In this paper, a multi-step attack detection model based on alerts of SGMS is proposed. In this model, an alert graph is constructed by IP correlation, and then transformed into candidate attack chains after being aggregated. Consequently, the candidate preliminary attack chains are pruned and denoised by negative causal correlation and non-cascading events. Finally, attack chains and visual attack graphs are formed. Our proposal model needs a little of priori knowledge while automatically extracting multi-step attack events and demonstrating the trajectories among IPs. The experimental results show the model performs well on China Grid data and DARPA 2000 data set.

An activity theory model for dynamic evolution of attack graph based on improved least square genetic algorithm

Most of the risk assessments of the attack graph are static and have a fixed assessment scenario, which limit the real-time nature of the situation assessment. This paper presents an activity theory model to analyse the contradictions in the attack behaviour. In order to assess the maximum probability path of an attacker and dynamically remain in control for the overall situation, a definition of attacker's benefit (loss/gain) value calculated by contradictory vector is proposed. The attacker's budget is applied as an unbiased amount in the least square genetic algorithm, optimises the fitness function of the genetic algorithm. Experimental results reveal that the improved least square genetic algorithm with unbiased estimator effectuate higher gains owing to the high fit degree of fitness function. With the coming evidence, the maximum probability attack paths get a more accurate and dynamic risk assessment of the situation.

Survey of Attack Graph Analysis Methods from the Perspective of Data and Knowledge Processing

Attack graph can simulate the possible paths used by attackers to invade the network. By using the attack graph, the administrator can evaluate the security of the network and analyze and predict the behavior of the attacker. Although there are many research studies on attack graph, there is no systematic survey for the related analysis methods. This paper firstly introduces the basic concepts, generation methods, and computing tasks of the attack graph, and then, several kinds of analysis methods of attack graph, namely, graph-based method, Bayesian network-based method, Markov model-based method, cost optimization method, and uncertainty analysis method, are described in detail. Finally, comparative study of the methods and future work are provided. We believe that this work would help the research community to understand the attack graph analysis method systematically.

Attack Graph Implementation and Visualization for Cyber Physical Systems

Cyber-attacks threaten the safety of cyber physical systems (CPSs) as a result of the existence of weaknesses in the multiple structural units constituting them. In this paper, three cyber physical systems case studies of a pressurized water nuclear power plant (NPP), an industrial control system (ICS), and a vehicular network system (VNS) are examined, formally presented, and implemented utilizing Architecture Analysis and Design Language, determining system design, links, weaknesses, resources, potential attack instances, and their pre-and post-conditions. Then, the developed plant models are checked with a security property using JKind model checker embedded software. The attack graphs causing plants disruptions for the three applications are graphically visualized using a new graphical user interface (GUI) windows application.

Automatic Hybrid Attack Graph (AHAG) Generation for Complex Engineering Systems

Complex Engineering Systems are subject to cyber-attacks due to inherited vulnerabilities in the underlying entities constituting them. System Resiliency is determined by its ability to return to a normal state under attacks. In order to analyze the resiliency under various attacks compromising the system, a new concept of Hybrid Attack Graph (HAG) is introduced. A HAG is a graph that captures the evolution of both logical and real values of system parameters under attack and recovery actions. The HAG is generated automatically and visualized using Java based tools. The results are illustrated through a communication network example.

Network Security Risk Assessment based on Critical Attack Graph Evaluation

Network Security Risk Assessment based on Critical Attack Graph Evaluation

Security modelling and assessment of modern networks using time independent Graphical Security Models

Graphical Security Models (GSMs), such as an Attack Graph, are used to assess the security of networks, but they are often limited to assess the security of the given network state (i.e., a snapshot at the current time). To address this issue, we develop a GSM named Time-independent Hierarchical Attack Representation Model (TI-HARM), which analyses the security of multiple network states combined taking into account the time duration of each network state and the visibility of the network components (e.g., hosts and edges). Also, we develop a new security rating system for dynamic networks to evaluate the changing security posture. Lastly, we present an approach that utilises the functionalities of the TI-HARM to compute global optimal defence solutions for dynamic networks. Our experimental results show that the TI-HARM can model and analyse the security of multiple states of dynamic networks, which the existing GSMs mostly assumed that it is static. Also, we found that the TI-HARM can be used to effectively compute the global optimal security solutions compared to existing models that only focus on local optimal solutions. Therefore, our proposed approach could be used to aid security administrators to understand the security posture of dynamic networks better and be able to enhance the security taking into account multiple changes in dynamic networks.