A scalable approach to attack graph generation

Abstract

Attack graphs are important tools for analyzing security vulnerabilities in enterprise networks. Previous work on attack graphs has not provided an account of the scalability of the graph generating process, and there is often a lack of logical formalism in the representation of attack graphs, which results in the attack graph being difficult to use and understand by human beings. Pioneer work by Sheyner, et al. is the first attack-graph tool based on formal logical techniques, namely model-checking. However, when applied to moderate-sized networks, Sheyner's tool encountered a significant exponential explosion problem. This paper describes a new approach to represent and generate attack graphs. We propose logical attack graphs, which directly illustrate logical dependencies among attack goals and configuration information. A logical attack graph always has size polynomial to the network being analyzed. Our attack graph generation tool builds upon MulVAL, a network security analyzer based on logical programming. We demonstrate how to produce a derivation trace in the Mul-VAL logic-programming engine, and how to use the trace to generate a logical attack graph in quadratic time. We show experimental evidence that our logical attack graph generation algorithm is very efficient. We have generated logical attack graphs for fully connected networks of 1000 machines using a Pentium 4 CPU with 1GB of RAM.

On Computing Enterprise IT Risk Metrics

“…Less closely related is the work on efficient generation of attack graphs [6][7][8][9][10]. These do not, however, explicitly model network router and firewall configurations to calculate the end-to-end reachability matrix, and do not focus on the problem of defining an aggregate impact metric.…”

Ideal Based Cyber Security Technical Metrics for Control Systems

“…Some vulnerabilities are more significant than others. Tools such as Attack Graphs [11] can be used to determine priority categories for all known vulnerabilities. The Common Vulnerability Scoring System (CVSS) [15] is another suggested mechanism for prioritizing known vulnerabilities.…”

Attack Graph Analysis for Network Anti-Forensics

“…Assumption of cost of launching attacks to be equal is one of drawbacks of the system as it varies to a great extend in practical scenarios (L. Wang, Singhal, & Jajodia, 2007b). As network infrastructure becomes large, attack graphs become larger and complex (Ou, Boyer, & McQueen, 2006) . In order to handle and generate larger attack graphs, scalable analysis is required incorporating probabilistic knowledge of behavior of attacker (L. Wang, Singhal, & Jajodia, 2007a;Xie, Wen, Zhang, Hu, & Chen, 2009).…”