Attack Graph Research Articles

Cyber attacker’s next action prediction on dynamic real-time behavior model

This paper addresses the critical need for enhanced threat analysis amid escalating cyber threats. Recognizing limitations in current network-level Attack Graphs (AGs), including scalability issues and the challenge of detecting zero-day attacks, we introduce a two-phase approach. Firstly, we dynamically model the attacker’s real-time behavior within the target system, resulting in a minimal AG with action states and their system impact. In the second phase, a Hidden Markov Model (HMM) predicts the next action based on the real-time behavior model, refined through Honeypot data for continuous accuracy. The minimal AG not only predicts but also forecasts the impact of the next action, facilitating robust security decisions. Experimental evaluations using Cowrie Honeypot logs demonstrate its efficacy, outperforming conventional algorithms. This innovative approach significantly advances cyber threat analysis, enhancing security decision-making within a concise framework.

From attack graph analysis to attack function analysis

From attack graph analysis to attack function analysis

SEAG: A novel dynamic security risk assessment method for industrial control systems with consideration of social engineering

The development of information and communication technology and its wide application in industrial control systems (ICSs) has brought a growing number of security risks to ICSs. Quantifying and dynamically assessing the security risks of ICSs is of great significance to protect ICSs from cyber attacks. Current risk assessment methods, however, do not take into account social engineering (SE) attacks and the potential cyber-to-physical risks associated with cyber attacks. To address these issues, we propose a novel method for the dynamic security risk assessment of ICSs, called SEAG. Specifically, the scheme first extends and modifies three metrics in the common vulnerability scoring system to four metrics for objectively calculating the exploit probability of SE. Then, we construct the attack graph by relying on the knowledge graph that integrates three kinds of knowledge including SE knowledge, common vulnerability knowledge, and control system knowledge. In addition, we combine real time attack data that causes system performance loss with the industrial protocol function code attack detected by the intrusion detection system to accurately quantify the potential cyber-to-physical risks associated with cyber attacks. This method allows us to dynamically assess the security risks of ICSs in real time. Finally, the method is verified by one simulation testbed, which shows the effectiveness and accuracy of the proposed method for dynamic quantitative evaluating security risks of ICSs.

Survey: Automatic generation of attack trees and attack graphs

Graphical security models constitute a well-known, user-friendly way to represent the security of a system. These classes of models are used by security experts to identify vulnerabilities and assess the security of a system. The manual construction of these models can be tedious, especially for large enterprises. Consequently, the research community is trying to address this issue by proposing methods for the automatic generation of such models. In this work, we present a survey illustrating the current status of the automatic generation of two popular kinds of graphical security models: Attack Trees and Attack Graphs. The goal of this survey is to present the current methodologies used in the field, compare them, and present the challenges and future directions to the research community.

Hidden target recognition method for high-speed network security threats based on attack graph theory

Instantaneous traffic changes in high-speed networks will interfere with abnormal traffic characteristics, making it difficult to accurately identify hidden targets of security threats. This paper designs a high-speed network security threat hidden target recognition method based on attack graph theory. Using the high-speed network traffic reduction method, under the condition that the network topology remains unchanged, the instantaneous input traffic is reduced according to a certain proportion, and after compressing the flow data scale, the abnormal traffic of the high-speed network is identified through the convolutional recurrent neural network, and the information entropy is used to describe the high-speed network. The abnormal traffic characteristics of the network are used as constraints to design an attack graph of hidden targets of high-speed network security threats, and an attack path discovery method based on multi-heuristic information fusion is designed to extract attack paths of high-speed networks, locate attacking hosts, and identify hidden threat targets. In the experiment, the method can accurately identify the hidden targets of high-speed network security threats, and has better identification ability.

Reinforcement Learning-Based Attack Graph Analysis for Wastewater Treatment Plant

Reinforcement Learning-Based Attack Graph Analysis for Wastewater Treatment Plant

The time for reconstructing the attack graph in DDoS attacks

Despite their frequency, denial-of-service (DoS5) and distributed-denial-of-service (DDoS) attacks are difficult to prevent and trace, thus posing a constant threat. One of the main defense techniques is to identify the source of the attack by reconstructing the attack graph, and then filtering the messages arriving from this source. One of the most common methods for reconstructing the attack graph is Probabilistic Packet Marking (PPM). We focus on edge sampling, which is the most common method. Here, we study the time, in terms of the number of packets, the victim needs to reconstruct the attack graph when there is a single attacker. This random variable plays an important role in the reconstruction algorithm. We mention in passing that the process of reconstructing the attack graph is analogous to a version of the well-known coupon collector's problem (with coupons having distinct probabilities). Thus, the results may be used in other applications of this problem.Our main theoretical results determine the asymptotic distribution and expected value of the reconstruction time. We present simulations, demonstrating that the approximations, obtained for short real-world attack paths, are pretty accurate.

Security-Oriented Cyber-Physical Risk Assessment for Cyberattacks on Distribution System

With the increasing deployment of advanced sensing and measurement devices, the modern distribution system is evolved into a cyber-physical power distribution system (CPPDS). Due to the extensive application of information and communication technology, CPPDS is prevalently exposed to a wide range of cybersecurity threats. In this paper, a novel security-oriented cyber-physical risk assessment method for CPPDS is proposed. Based on the information model composed of logical nodes, an attack graph of privilege promotion by exploiting the cyber vulnerabilities is constructed. The physical consequence caused by cyberattack is analyzed in detail. By using the Markov decision process (MDP) theory, the cyber-physical risk index (CPRI) is calculated. Furthermore, considering the allocation of the finite defense resource, the modified MDP approach with an attack–defense game is presented. The effectiveness of the proposed method is demonstrated with case studies on a four-feeder IEEE-RTBS test system.

Graphfool: Targeted Label Adversarial Attack on Graph Embedding

Graph embedding learns low-dimensional representations for nodes or edges on the graph, which is widely applied in many real-world applications. Excessive graph mining promotes the research of attack methods on graph embedding. Most attack methods generate perturbations that maximize the deviation of the prediction confidence. They are difficult to accurately misclassify the instances into the target label, and the nonminimized perturbations are more easily detected by defense methods. To address these problems, we propose Graphfool, a novel targeted label adversarial attack on graph embedding. It can generate adversarial graphs to attack graph embedding methods via classification boundary and gradient information in the target graph embedding method. Graphfool first estimates the classification boundaries of different categories. Then, it calculates the minimum perturbation matrix to misclassify the attacked node according to the target classification boundary. Finally, the adjacency matrix is modified according to the maximum absolute value of the perturbation matrix. Extensive experiments demonstrate that Graphfool achieves the state-of-the-art attack performance with minimum perturbations. Besides, the possible defense experiments further prove that the perturbations generated by Graphfool are more imperceptible.

Securing the Future Railway System: Technology Forecast, Security Measures, and Research Demands

The railway industry—traditionally a conservative industry with low adaption speed for innovation—is currently entering its digitization phase. The sector faces a challenge in integrating new technologies and approaches into the employed—often safety-critical—systems. Keeping the systems secure while conforming to the demanding safety norms creates previously unknown problems. In the last decades, the number of attacks on the railway system has increased. Furthermore, with standardized digital technologies, the attack surface will keep growing. Therefore, in this work, we look into the foreseeable future of the railway system and present 21 likely use cases. We analyze these use cases regarding possible threats, rate the severity of these threats, and deduce and rate necessary countermeasures. To this end, we model these use cases and the corresponding threats and countermeasures using Attack Graphs. We use a graphical solution for the risk and security analysis due to advantages over other methods, i.e., table-based solutions, like simplified presentation and an easier understanding of relationships, dependencies, and interactions between various elements. From these Attack Graphs, we extracted 14 commonly recurring attack strategies. After analyzing 49 countermeasures regarding their current maturity and further research and standardization demands, we identified 21 in need of further investigation. This implies that 21 necessary countermeasures to secure these future use cases require further research to apply to railway systems or require standardization. These results will help researchers focus on the necessary research and standardization and railway operators to ensure the security of their systems.

Modeling and assessing load redistribution attacks considering cyber vulnerabilities in power systems

Introduction: Load Redistribution (LR) attacks, as a common form of false data injection attack, have emerged as a significant cybersecurity threat to power system operations by manipulating load buses’ measurements at substations. Existing LR attack methods typically assume that any substation can be equally attacked, contributing to the analysis of LR attacks in power systems. However, the diversity of cyber vulnerabilities in substation communication links implies varying costs associated with falsifying load buses’ measurements. Thus, quantitatively evaluating these costs and analyzing the impact of LR attacks on power systems within cost constraints holds practical significance.Methods: In this paper, we employ a Bayesian attack graph model to characterize the intrusion process through cyber vulnerabilities. The costs of falsifying load buses’ measurements at substations are quantitatively evaluated using the mean time-to-compromise model. Subsequently, from the attacker’s perspective, we propose a bi-level optimization model for LR attacks, considering the mean time to compromise in conjunction with limited attack resources and power flow constraints.Results: Simulations conducted on the IEEE 14-bus system illustrate the influence of cyber vulnerabilities on LR attacks within power systems. Furthermore, we verify that the attack scenario of the existing LR attack model aligns with a case of the proposed bi-level LR attack model when there is sufficient attack time to compromise all communication links.Discussion: The findings of this research demonstrate that the impact of cyber vulnerabilities on LR attacks can be quantified by assessing the attack costs. Effective management of LR attacks can be achieved under cost constraints through optimization methods. These insights contribute to enhancing network security strategies for power systems, mitigating potential threats posed by LR attacks in power system operations.

AT-GCN: A DDoS attack path tracing system based on attack traceability knowledge base and GCN

The rapid development of the Internet provides sufficient attack entrances for massive malicious terminals, which makes it extremely challenging to effectively trace the path of DDoS attacks. Traditional solutions mainly trace distributed denial of service (DDoS) attacks by adding tags to data packet headers or querying logs, which increases the cost of tagging. There are also some works that implement attack tracking based on the network-wide perspective and centralized control of SDN, but these methods are difficult to deploy on a large scale. In order to solve this problem, we propose a DDoS attack path tracing system (AT-GCN) based on attack traceability knowledge base and graph convolutional network (GCN). We first propose the construction process of the attack traceability knowledge base, and design the intra-domain attack graph and the traceability algorithm recommendation graph to solve the problems of DDoS attack path traceability and optimal traceability solution recommendation. On this basis, we propose a GCN-based intra-domain attack traceability scheme, and design a subgraph sampling algorithm Tracing-Sample adapted to intra-domain DDoS attack traceability, aiming to efficiently use the graph structure in the knowledge base to reproduce DDoS attack paths. Additionally, we recommend the traceability algorithm based on user-based collaborative filtering (UBCF), and dynamically recommend the best traceability algorithm according to the different requirements of administrators for traceability performance. Compared with other GCN algorithms, the results show that the recall of the AT-GCN system is increased by 7.3% on average, and the FPR is reduced by 5.7% on average at the expense of the memory usage rate. Under different scale topologies, the recall of the AT-GCN system can be stabilized at 95%.

TGPrint: Attack fingerprint classification on encrypted network traffic based graph convolution attention networks

Nowadays, most network traffic is encrypted, which protects user privacy but hides attack traces, further hindering identifying attacks to inspect traffic packages. Machine Learning (ML) methods are widely applied to attack classification on encrypted traffic owing to no need for manual analysis. However, existing studies only concentrate on basic statistical features and cannot obtain the crucial attack behaviors hiding in the encrypted traffic. Worse still, attackers constantly update attack vectors to evade detection, which means outdated features extracted from historical traffic fail to recognize unseen attacks.As a solution, we propose an attack classification approach, attack fingerprint based on graphs of time-window (TGPrint). We first filter normal traffic flows using ML models to eliminate the impact of useless, noisy data for attack classification and maintain suspicious traffic. Then, we create attack graphs to depict interaction behaviors of attack-victim hosts from suspicious traffic containing crucial attack behaviors. Besides, we divide a specific duration for each attack to precisely elaborate attack graphs, where temporal, statistical, and aggregate features are extracted to portray attack behaviors. Finally, we utilize Graph Neural Networks (GNNs) to mine and grasp the crucial behavior patterns from attack graphs to generate fingerprints and classify attacks, even unseen attacks. Extensive experiments are conducted on well-known datasets to verify our approach. It achieves a precision of 99% in attack classification on encrypted traffic, an average higher than other ML methods of 50%. Meanwhile, it classifies unseen attacks with an average accuracy of over 80% and has a strong robustness to false positives.

MAGD: Minimal Attack Graph Generation Dynamically in Cyber Security

Cyber security faces challenges in detecting and mitigating complex attacks. Security solutions have employed Attack Graphs (AGs) for modeling multi-stage attacks, but traditional AGs suffer from scalability issues and may miss new vulnerabilities and attack paths. Also, traditional AGs construct the graph using information about previously known attacks. In this paper, we propose Minimal Attack Graph Generation Dynamically (MAGD), which leverages data from a deception system based on Honeypots to generate a minimal AG dynamically. In this paper, the AG has been constructed from real-time attacker’s behavior data directly. In addition, MAGD specifically focuses on modeling the attacker’s behavior at the host level, in contrast to traditional network-based AGs that encompass all possible attack paths at the network level. MAGD contains three custom algorithms to construct attacker behavior, generate a minimal AG, and continuously update the graph with new attack information. Complexity analyses demonstrate that MAGD’s generation process can accomplish within polynomial time. Our approach offers several advantages over traditional AGs, including the ability to model attackers’ real-time behavior, construct attackers’ action paths in the target host, and detect new vulnerabilities and attack paths in the victim host. Also, MAGD includes information about the effects of the actions in the target system. This information can be used for other security purposes. We demonstrate MAGD’s efficacy through a case study. MAGD provides a more effective way to detect and mitigate cyber threats by utilizing Honeypot data and proposed algorithms.

Critical Attacks Set Identification in Attack Graphs for Computer and SCADA/ICS Networks

Supervisory control and data acquisition/industrial control systems (SCADA/ICSs) networks are becoming more vulnerable to attacks that exploit the interdependence of security weaknesses at the atomic level to compromise system-level security. Attack graphs are an effective approach to depict these complex attack scenarios, assisting security administrators in determining how to best safeguard their systems. However, due to time and financial constraints, it is frequently not possible to address all atomic-level flaws at the same time. In this article, we propose a method for automatically detecting a minimal set of critical attacks that, when defended against, render the system secure. Finding a minimal label cut is typically an NP-complete problem. However, we propose a linear complexity approximation that uses the attack graph’s strongly connected components (SCCs) to create a simplified version of the graph in the form of a tree over the SCCs. Then, we perform an iterative backward search over this tree to find a set of backward-reachable SCCs, as well as their outward edges and labels, in order to find a cut of the tree with the fewest labels, which is a critical attack set. We put our proposed method to the test on real-world case studies, such as IT and SCADA networks for a cyber–physical system for water treatment, and outperformed previous state-of-the-art algorithms in terms of approximation accuracy and/or computational speed. Our solution provides security administrators with a practical and efficient method for prioritizing efforts to address vulnerabilities in SCADA/ICS networks.

Optimal monitoring and attack detection of networks modeled by Bayesian attack graphs

Early attack detection is essential to ensure the security of complex networks, especially those in critical infrastructures. This is particularly crucial in networks with multi-stage attacks, where multiple nodes are connected to external sources, through which attacks could enter and quickly spread to other network elements. Bayesian attack graphs (BAGs) are powerful models for security risk assessment and mitigation in complex networks, which provide the probabilistic model of attackers’ behavior and attack progression in the network. Most attack detection techniques developed for BAGs rely on the assumption that network compromises will be detected through routine monitoring, which is unrealistic given the ever-growing complexity of threats. This paper derives the optimal minimum mean square error (MMSE) attack detection and monitoring policy for the most general form of BAGs. By exploiting the structure of BAGs and their partial and imperfect monitoring capacity, the proposed detection policy achieves the MMSE optimality possible only for linear-Gaussian state space models using Kalman filtering. An adaptive resource monitoring policy is also introduced for monitoring nodes if the expected predictive error exceeds a user-defined value. Exact and efficient matrix-form computations of the proposed policies are provided, and their high performance is demonstrated in terms of the accuracy of attack detection and the most efficient use of available resources using synthetic Bayesian attack graphs with different topologies.

Attack Graph Model for Cyber-Physical Power Systems Using Hybrid Deep Learning

Electrical power grids are vulnerable to cyber attacks, as seen in Ukraine in 2015 and 2016. However, existing attack detection methods are limited. Most of them are based on power system measurement anomalies that occur when an attack is successfully executed at the later stages of the cyber kill chain. In contrast, the attacks on the Ukrainian power grid show the importance of system-wide, early-stage attack detection through communication-based anomalies. Therefore, in this paper, we propose a novel method for online cyber attack situational awareness that enhances the power grid resilience. It supports power system operators in the identification and localization of active attack locations in Operational Technology (OT) networks in near real-time. The proposed method employs a hybrid deep learning model of Graph Convolutional Long Short-Term Memory (GC-LSTM) and a deep convolutional network for time series classification-based anomaly detection. It is implemented as a combination of software defined networking, anomaly detection in communication throughput, and a novel attack graph model. Results indicate that the proposed method can identify active attack locations, e.g., within substations, control center, and wide area network, with an accuracy above 96%. Hence, it outperforms existing state-of-the-art deep learning-based time series classification methods.

Deep Reinforcement Learning for Intelligent Penetration Testing Path Design

Penetration testing is an important method to evaluate the security degree of a network system. The importance of penetration testing attack path planning lies in its ability to simulate attacker behavior, identify vulnerabilities, reduce potential losses, and continuously improve security strategies. By systematically simulating various attack scenarios, it enables proactive risk assessment and the development of robust security measures. To address the problems of inaccurate path prediction and difficult convergence in the training process of attack path planning, an algorithm which combines attack graph tools (i.e., MulVAL, multi-stage vulnerability analysis language) and the double deep Q network is proposed. This algorithm first constructs an attack tree, searches paths in the attack graph, and then builds a transfer matrix based on depth-first search to obtain all reachable paths in the target system. Finally, the optimal path for target system attack path planning is obtained by using the deep double Q network (DDQN) algorithm. The MulVAL double deep Q network(MDDQN) algorithm is tested in different scale penetration testing environments. The experimental results show that, compared with the traditional deep Q network (DQN) algorithm, the MDDQN algorithm is able to reach convergence faster and more stably and improve the efficiency of attack path planning.

Multiobjective network security dynamic assessment method based on Bayesian network attack graph

PurposeWith the rapid development of Internet technology, cybersecurity threats such as security loopholes, data leaks, network fraud, and ransomware have become increasingly prominent, and organized and purposeful cyberattacks have increased, posing more challenges to cybersecurity protection. Therefore, reliable network risk assessment methods and effective network security protection schemes are urgently needed.Design/methodology/approachBased on the dynamic behavior patterns of attackers and defenders, a Bayesian network attack graph is constructed, and a multitarget risk dynamic assessment model is proposed based on network availability, network utilization impact and vulnerability attack possibility. Then, the self-organizing multiobjective evolutionary algorithm based on grey wolf optimization is proposed. And the authors use this algorithm to solve the multiobjective risk assessment model, and a variety of different attack strategies are obtained.FindingsThe experimental results demonstrate that the method yields 29 distinct attack strategies, and then attacker's preferences can be obtained according to these attack strategies. Furthermore, the method efficiently addresses the security assessment problem involving multiple decision variables, thereby providing constructive guidance for the construction of security network, security reinforcement and active defense.Originality/valueA method for network risk assessment methods is given. And this study proposed a multiobjective risk dynamic assessment model based on network availability, network utilization impact and the possibility of vulnerability attacks. The example demonstrates the effectiveness of the method in addressing network security risks.

Risk Assessment Method of IoT Host Based on Attack Graph

Risk Assessment Method of IoT Host Based on Attack Graph