Attack Graph Research Articles

Quantitative Method for Network Security Situation Based on Attack Prediction

Multistep attack prediction and security situation awareness are two big challenges for network administrators because future is generally unknown. In recent years, many investigations have been made. However, they are not sufficient. To improve the comprehensiveness of prediction, in this paper, we quantitatively convert attack threat into security situation. Actually, two algorithms are proposed, namely, attack prediction algorithm using dynamic Bayesian attack graph and security situation quantification algorithm based on attack prediction. The first algorithm aims to provide more abundant information of future attack behaviors by simulating incremental network penetration. Through timely evaluating the attack capacity of intruder and defense strategies of defender, the likely attack goal, path, and probability and time-cost are predicted dynamically along with the ongoing security events. Furthermore, in combination with the common vulnerability scoring system (CVSS) metric and network assets information, the second algorithm quantifies the concealed attack threat into the surfaced security risk from two levels: host and network. Examples show that our method is feasible and flexible for the attack-defense adversarial network environment, which benefits the administrator to infer the security situation in advance and prerepair the critical compromised hosts to maintain normal network communication.

Research on the Key Technology of the Risk Evaluation of the Network Security Based on the D-S Evidence

In order to carry out real-time evaluation on the network or information system, this paper proposes the D-S evidence attack graph model and its derivative method of incremental real-time evaluation. Based on this, it raises the incremental real-time evaluation method on the basis of the D-S evidence attack graph model, which can be divided into four layers in space of detection, attack, host and the network, and into two phases in time of initialization and real-time updating. This method well restrains the failed and false alarm in the security alarm by using the D-S evidence attack graph model. With perfect functions, it will blend and associate the attack alarm and then carry out credibility calculations of attack and prediction in three layers of node, host and the network in order to further accurately restore the attack scene and predict the attack behavior. Additionally, it can calculate the values of corresponding threats and the final trend of the network security to further identify the situations of security threats in three layers of node, host and the network. Because it is a kind of incremental evaluation method with the same complexity as a linear algorithm and high real-time performance, it can be utilized for a real-time assessment of large-scale network security. In the end, this thesis verifies the accuracy and effectiveness of this method and its features of high performance and expandability.

МЕТОДИКИ И ПРОГРАММНЫЙ КОМПОНЕНТ ОЦЕНКИ РИСКОВ НА ОСНОВЕ ГРАФОВ АТАК ДЛЯ СИСТЕМ УПРАВЛЕНИЯ ИНФОРМАЦИЕЙ И СОБЫТИЯМИ БЕЗОПАСНОСТИ

МЕТОДИКИ И ПРОГРАММНЫЙ КОМПОНЕНТ ОЦЕНКИ РИСКОВ НА ОСНОВЕ ГРАФОВ АТАК ДЛЯ СИСТЕМ УПРАВЛЕНИЯ ИНФОРМАЦИЕЙ И СОБЫТИЯМИ БЕЗОПАСНОСТИ

Attack Graph Generation and Analysis Techniques

As computer networks are emerging in everyday life, network security has become an important issue. Simultaneously, attacks are becoming more sophisticated, making the defense of computer networks increasingly difficult. Attack graph is a modeling tool used in the assessment of security of enterprise networks. Since its introduction a considerable amount of research effort has been spent in the development of theory and practices around the idea of attack graph. This paper presents a consolidated view of major attack graph generation and analysis techniques.

Graph similarity metrics for assessing temporal changes in attack surface of dynamic networks

Assessment of attack surface is a formidable challenge for the present-day dynamic networks. Essentially, attack surface (of a computer network) is a subset of network configuration and vulnerabilities that an adversary can use to compromise the target network in an incremental fashion. There are a large number of metrics available for network security risk assessment. However, they fail to measure temporal variation in the network attack surface. To overcome this problem, we propose graph distance metrics based on the Maximum Common Subgraph (MCS) and Graph Edit Distance (GED). In particular, we make use of classical graph distance metrics to quantify the distance between a pair of successive attack graphs generated for a dynamic network. Since the attack graph is capable of successfully capturing the attack surface of an underlying network, the distance between a pair of consecutive attack graphs (generated over the observed sampling interval) indicates the change in the network attack surface. To validate the efficacy and usability of graph distance metrics proposed in this study, we have tested 11 different metrics on a set of 3 different network models, viz., Flat, External-Internal, and DMZ. Experimental results show that MCS and GED based graph distance metrics successfully capture the temporal variation in the attack surface and also generate an alert about the security events which are responsible for the change. Using such graph distance metrics, we can pinpoint the events that cause a significant change in the network attack surface, locate most dangerous hosts in the network and the effect of increasing vulnerabilities further on these hosts. The advantage of using these metrics is that they scale polynomially with the graphs size and are independent of the graphs topology. It is also evident from the test results that the performance of MCS and GED based metrics is almost similar and hence the computation of one metric is enough to detect temporal variation in the network attack surface. The MCS and GED based graph distance metrics are oblivious to the AND semantic between the initial conditions in the attack graphs. Thus, there is a scope for improving their performance (sensitivity) by considering the AND semantic.

Attack Path Selection Optimization with Adaptive Genetic Algorithms

Enterprise network security solution optimization is a complex and challenging problem given the large number of components that are involved. This paper describes our project that has the ultimate goal of providing optimized solutions for enterprise network security. We describe our approach for implementing an optimized security assessment using Genetic Algorithm (GA). Because of the dynamic nature of an enterprise network, all security analysis tools devised for the network need to function in dynamic mode as well. We have incorporated a fuzzy logic controller (FLC) to fine tune the optimization algorithm in run time. The FLC takes into consideration both the exploration and exploitation aspect of the GA. It calculates the appropriate adjustments for the control parameters such as selection and crossover rate. Possible attack paths are then identified and evaluated based on an attack graph representing the network under study. Attack paths that satisfy certain optimization criteria are then selected and presented as possible components of the security solution. We have also carried out a comparative study on the performance of the adaptive GA used in this problem against the conventional GA. The results shows that attack graphs analyzed with the adaptive GA yields significantly better solutions. © 2016 American Scientific Publishers. All rights reserved.

Distributed Attack Graph Generation

Attack graphs show possible paths that an attacker can use to intrude into a target network and gain privileges through series of vulnerability exploits. The computation of attack graphs suffers from the state explosion problem occurring most notably when the number of vulnerabilities in the target network grows large. Parallel computation of attack graphs can be utilized to attenuate this problem. When employed in online network security evaluation, the computation of attack graphs can be triggered with the correlated intrusion alerts received from sensors scattered throughout the target network. In such cases, distributed computation of attack graphs becomes valuable. This article introduces a parallel and distributed memory-based algorithm that builds vulnerability-based attack graphs on a distributed multi-agent platform. A virtual shared memory abstraction is proposed to be used over such a platform, whose memory pages are initialized by partitioning the network reachability information. We demonstrate the feasibility of parallel distributed computation of attack graphs and show that even a small degree of parallelism can effectively speed up the generation process as the problem size grows. We also introduce a rich attack template and network model in order to form chains of vulnerability exploits in attack graphs more precisely.

Analysis of Organizational Vulnerability using Social Network Analysis and Attack Graph

AbstractThe purpose of this paper is to develop an approach to analyze organizational vulnerability caused by its employees. The proposed approach is adapted from general attack graph analysis approach and social network analysis approach. The attack graph, which is relationship graph in this proposed approach, is created from organization’s email logs and virus reports. The relationship graph is analyzed using shortest path analysis to discover all possible attack paths start from risky employees to target employee, and then grouped by path length for further actions based on security policy. The proposed approach was tested using datasets that are limited to only one month with assumption that weight on all edges are equal. This paper suggested further study to improve accuracy of the proposed approach using other mathematical methods such as shortest path analysis with weight or Markov Chains. The proposed approach could also be used by security audit in risk assessment process.

Adaptive Visualization of Complex Networks with FocalPoint

Maintaining situational awareness of a dynamic global computer network that consists of ten to hundreds of thousands of computers is a complex task for cyber administrators and operators looking to understand, plan and conduct operations in real time. Currently, cyber specialists must manually navigate complex networks by continuous cycles of overviews, drilldowns and manually mapping network incidents to mission impact. This is inefficient as manually maneuvering of network data is laborious, induces cognitive overload, and is prone to errors caused by distractive information resulting in important information and impacts not being seen. We are investigating “FocalPoint” an adaptive level of detail (LOD) recommender system tailored for hierarchical network information structures. FocalPoint reasons about contextual information associated with the network, user task, and user cognitive load to tune the presentation of network visualization displays to improve user performance in perception, comprehension and projection of current situational awareness. Our system is applied to two complex information constructs important to dynamic cyber network operations: network maps and attack graphs. The key innovations include: (a) context-aware automatic tailoring of complex network views, (b) multi-resolution hierarchical graph aggregation, (c) incorporation of new computational models for adaptive-decision making on user tasks, cost/benefit utility and human situation awareness, and (d) user interaction techniques to integrate recommendations into the network viewing system. Our aim is to have a direct impact on planning and operations management for complex networks by; overcoming information overload, preventing tunnel vision, reducing cognitive load, and increasing time available to focus on optimum level of details of the global network space and missions.

Case Studies of Network Defense with Attack Graph Games

The increasing complexity of securing modern computer networks makes decision support systems an important tool for administrators. A challenge many existing tools fail to address is that attackers react strategically to new security measures, adapting their behaviors in response. Game theory provides a methodology for making decisions that takes into account these reactions, rather than assuming static attackers. The authors present an overview of how game theory can be used to inform one type of security decision: how to optimally place honeypots in a network. They demonstrate this approach on a realistic case study and present initial validation results based on a study comparing their approach with human decision makers.

Towards scalable security analysis using multi-layered security models

Security models, such as an attack graph (AG), are widely adopted to assess the security of networked systems, such as utilizing various security metrics and providing a cost-effective network hardening solution. There are various methods of generating these models, but the scalability problem exists for single-layered graph-based security models when analyzing all possible attack paths. To address this problem, we propose to use a multi-layer hierarchical attack representation model (HARM) that models various components in the networked system in different layers to reduce the computational complexity. First, we formulate key questions that need to be answered to assess the scalability of security models. Second, we formally define the multi-layer HARM. Last, we conduct experiments to show the scalability of security models. Our experimental results show that using the HARM can improve the scalability of assessing the security of the networked system significantly in comparison to the single-layered security models in various network scenarios.

Data Reduction in Intrusion Alert Correlation

Network intrusion detection sensors are usually built around low level models of network traffic. This means that their output is of a similarly low level and as a consequence, is difficult to analyze. Intrusion alert correlation is the task of automating some of this analysis by grouping related alerts together. Attack graphs provide an intuitive model for such analysis. Unfortunately alert flooding attacks can still cause a loss of service on sensors, and when performing attack graph correlation, there can be a large number of extraneous alerts included in the output graph. This obscures the fine structure of genuine attacks and makes them more difficult for human operators to discern. This paper explores modified correlation algorithms which attempt to minimize the impact of this attack.

Security Optimization of Dynamic Networks with Probabilistic Graph Modeling and Linear Programming

Securing the networks of large organizations is technically challenging due to the complex configurations and constraints. Managing these networks requires rigorous and comprehensive analysis tools. A network administrator needs to identify vulnerable configurations, as well as tools for hardening the networks. Such networks usually have dynamic and fluidic structures, thus one may have incomplete information about the connectivity and availability of hosts. In this paper, we address the problem of statically performing a rigorous assessment of a set of network security defense strategies with the goal of reducing the probability of a successful large-scale attack in a dynamically changing and complex network architecture. We describe a probabilistic graph model and algorithms for analyzing the security of complex networks with the ultimate goal of reducing the probability of successful attacks. Our model naturally utilizes a scalable state-of-the-art optimization technique called sequential linear programming that is extensively applied and studied in various engineering problems. In comparison to related solutions on attack graphs, our probabilistic model provides mechanisms for expressing uncertainties in network configurations, which is not reported elsewhere. We have performed comprehensive experimental validation with real-world network configuration data of a sizable organization.

Satisfiability Degree Analysis and Deductive Reasoning

There are many situations that common logic models aren't capable of representing, so nonclassical logic systems have emerged to compensate for their inability to express uncertainty. This article introduces the satisfiability degree for propositional logic. It's a new means of describing the extent to which a proposition is satisfied, and it employs deterministic logic rather than probabilistic or fuzzy logic. The independent formula-pair and incompatible formula-pair of the propositions are discussed. Some properties of the satisfiability degree are given with a conditional satisfiability degree. The weighted satisfiability degree is defined and the properties are proven. Deductive reasoning methods based on the satisfiability degree are established. The formula reasoning and semantic checking are given by the conditional satisfiability degree. Finally, calculations of the satisfiability degree for the circuit logic diagram and Bayesian attack graphs are given.

Attack Graph-Based Approach For Enterprise Networks Security Analysis

Network administrators are always faced with numerous challenges of identifying threats and in retrospect, securing the organization’s network. The classical approach of identifying the vulnerability in the network is by using commercially developed tools that do not take into cognisance vulnerability interaction between network elements and their behavioral pattern.Therefore, network administrators have to take a hollistic methods to identify vulnerability interrelationships to be captured by an attack graph which will help in identifying all possible ways an attacker would have access to critical resources. The objective therefore is to design an attack graph–based approach for analyzing security vulnerabilities in enterprise networks, implement and evaluate performance of the approach. This work proposes an attack graph network security analyser based. The attack graph directly illustrates logical dependencies among attack goals and configuration information. In the attack graph, a node in the graph is a logical statement and an edge in the graph is represented by causality relation between network configurations and an attacker’s potential privileges. The benchmark is just a collection of Datalog tuples representing the configuration of the synthesized networks, the graph generation CPU time was compared to Sheyner attack graph toolkit. The result in the graph shows the comparison of the graph builder CPU time for the case of a fully connected network and 5 vulnerabilities per host which shows Sheyner’s tools grows exponentially.Some important contributions of this work include establishing an attack graph–based approach for enterprise networks security analysis that can capture generic security interactions and specify security relevant configuration information.

Interdicting attack graphs to protect organizations from cyber attacks: A bi-level defender–attacker model

Today's organizations are inherently open and connected, sharing knowledge and ideas in order to remain innovative. As a result, these organizations are also more vulnerable to information theft through different forms of security breaches caused by hackers and competitors. One way of understanding the vulnerability of an information system is to build and analyze the attack graph of that system. The attack graph of an information system contains all the paths that can be used to penetrate the system in order to breach critical assets. Although existing literature provides an abundance of attack graph generation algorithms, more methods are required to help analyze the attack graphs. In this paper, we study how best to deploy security countermeasures to protect an organization by analyzing the vulnerability of the organization through the use of its attack graph. In particular, we present an approach to find an optimal affordable subset of arcs, called an interdiction plan, on an attack graph that should be protected from attack to minimize the loss due to security breaches. We formulate this problem as a bi-level mixed-integer linear program and develop an exact algorithm to solve it. Experiments show that the algorithm is able to solve relatively large problems. Two heuristic methods, one with and the other without a heuristic to solve the master problem and both limiting the master problem branch-and-bound tree to only one node solve the large problems remarkably well. Experiments also reveal that the quality of an interdiction plan is relatively insensitive with respect to the error in the estimate of the attacker's budget, and that the breach loss drops sharply at the beginning, then levels off before finally dropping sharply again with increases in the security budget.

A website security risk assessment method based on the I-BAG model

In order to protect the website and assess the security risk of website, a novel website security risk assessment method is proposed based on the improved Bayesian attack graph (I-BAG) model. First, the Improved Bayesian attack graph model is established, which takes attack benefits and threat factors into consideration. Compared with the existing attack graph models, it can better describe the website's security risk. Then, the improved Bayesian attack graph is constructed with optimized website attack graph, attack benefit nodes, threat factor nodes and the local conditional probability distribution of each node, which is calculated accordingly. Finally, website's attack probability and risk value are calculated on the level of nodes, hosts and the whole website separately. The experimental results demonstrate that the risk evaluating method based on I-BAG model proposed is a effective way for assessing the website security risk.

Security Assessment Based on Attack Graphs and Open Standards for Computer Networks with Mobile Components

The paper suggests an automatized approach to risk assessment for wireless networks. The approachis based on attack graphs and open standards for security data representation, open databases of attackpatterns and vulnerabilities. The suggested approach extends a technique to risk assessment ofcomputer networks suggested by the authors earlier to consider mobile networks. The paper analyzesthe features of attacks against mobile devices and wireless connection channels. On the base of thisanalysis an approach to attack feature consideration in the process of attack graph generation is developed.A technique of calculation of risk assessment metrics is suggested. Generation of an attackgraph and calculation of risks is demonstrated on a sample network with mobile components.

Research of Automatic Recognition Double Layers Intrusion Intention Algorithm Based on Attack Graph

The determination of network equipment weaknesses and the discovery of intrusion intention is one of the difficulties that troubled network security management personnel. Based on previous studies, further proposed a double attack graph based on domainequipment. By the underlying network topology data collected and analyzed, using Bayesian theory to complete the quantify for the double attack graph and generation strategy in minimal power key set, with the cost of calculation of key equipment in the automatic recognition network topology, we provide an important basis for network maintenance. Experimental results show that the measure of using quantitative domainequipment double attack graph to recognize the intrusion intention is not only effective and feasible, but also has the feature of easy promotion.

A taxonomy for attack graph generation and usage in network security

Attack graphs model possible paths that a potential attacker can use to intrude into a target network. They can be used in determining both proactive and reactive security measures. Attack graph generation is a process that includes vulnerability information processing, collecting network topology and application information, determining reachability conditions among network hosts, and applying the core graph building algorithm. This article introduces a classification scheme for a systematical study of the methods applied in each phase of the attack graph generation process, including the usage of attack graphs for network security. The related works in the literature are stated based on the proposed classification scheme and contributive ideas about potential challenges and open issues for attack graph generation and usage are provided.