Attack path discovery plays an important role in protecting network infrastructure. Unfortunately, previous attack path discovery algorithms are difficult for applying in reality because of the high computational complexity problem. To achieve effective attack path discovery, we proposed a compact graph planning algorithm to incorporate goal states related information into attack path discovery. Our model extracts goal states related information by calculating closure of goal states, and then construct planning graph structure given the closure, after which the backward search algorithm is used to extract the attack path solution. The experiments were done on the typical enterprise network, comparing the effectiveness of attack path discovery algorithms with existing known methods. The result turns out that our proposed compact graph planning algorithm shows great improvement in discovering attack paths. INDEX TERMS Attack path discovery, graph planning, functional dependency theory, cyber security. I. INTRODUCTION With the increasing size and complexity of computer network, cyber security problem becomes more prominent than ever. Community Emergency Response Team(CERT) points out that global network security events increase exponentially from 2003 to 2018 [1]. To cope with the problem, attack paths discovery technology [2], which could discover hidden network vulnerabilities automatically, is widely adopted. As shown in Figure 1, attack paths discovery technology could not only find individual vulnerability existed in each host, but combinational vulnerabilities existed in whole network. Although tools like APT2 [3], Autosploit [4] and MulVAL [5] etc. have been developed to improve efficiency for discovering hidden attack paths, they are still far from reality because of two limitations. The first is that most of these tools, such as APT2, Autosploit and so on, aim at discovering individual vulnerabilities and fail in finding combinational vulnerabilities, and the second is that high computational complexity problem makes it hard to apply in large scale network. The associate editor coordinating the review of this manuscript and approving it for publication was Alba Amato.

No abstract

Mining penetration testing semantic knowledge hidden in vast amounts of raw penetration testing data is of vital importance for automated penetration testing. Associative rule mining, a data mining technique, has been studied and explored for a long time. However, few studies have focused on knowledge discovery in the penetration testing area. The experimental result reveals that the long-tail distribution of penetration testing data nullifies the effectiveness of associative rule mining algorithms that are based on frequent pattern. To address this problem, a Bayesian inference based penetration semantic knowledge mining algorithm is proposed. First, a directed bipartite graph model, a kind of Bayesian network, is constructed to formalize penetration testing data. Then, we adopt the maximum likelihood estimate method to optimize the model parameters and decompose a large Bayesian network into smaller networks based on conditional independence of variables for improved solution efficiency. Finally, irrelevant variable elimination is adopted to extract penetration semantic knowledge from the conditional probability distribution of the model. The experimental results show that the proposed method can discover penetration semantic knowledge from raw penetration testing data effectively and efficiently.

No abstract

No abstract