Fast Network Attack Modeling and Security Evaluation based on Attack Graphs

Abstract

The paper suggests an approach to network attack modeling and security evaluation which is realized in advanced Security Information and Event Management (SIEM) systems. It is based on modeling of computer network and malefactors' behaviors, building attack graphs, processing current alerts for real-time adjusting of particular attack graphs, calculating different security metrics and providing security assessment procedures. The novelty of the proposed approach is the use of special algorithms for construction, modification and analysis of attack graphs aimed at rapid security evaluation. This allows using this approach in SIEM systems that operate in near-real time. The generalized architecture of the Attack Modeling and Security Evaluation Component (AMSEC), as one of the main analytical components of SIEM systems, is outlined. The main components and techniques for attack modeling and security evaluation are defined. A prototype of the AMSEC is presented. Experiments with this prototype are evaluated.

A review of attack graph and attack tree visual syntax in cyber security

“…An example of external semiotic inconsistency (adapted from [12] (left) and [6] (right)) ternal and external semiotic inconsistency are provided in terms of the way preconditions, exploits and precondition operators are represented. [209] vs [208] pr p , ex e vs pr e , ex r [26] vs [27] Same paper pr r vs pr p [85] pr r vs pr h [54] pr r blue vs pr h purple [6] pr r vs pr h [63] or td vs or lr * [232] pr e , ex r vs pr r , ex na [36] ef bu vs ef td [113]…”

Quantifying Integrity Impacts in Security Risk Scoring Models

“…According to [19] it is impossible for organizations to make precise estimates of the economic damages caused by an attack without having full knowledge of users' IT environment. In [11], [20] authors state that network configuration should be monitored on a continuous basis, and vulnerabilities must be analyzed to provide the necessary appropriate security level. Secondly, the computed integrity impact is a real number which enables to put on one uniform scale for comparison reasons various states rather than the current ordinal three-grades scale, naming low, medium and high.…”

Security Risk Scoring Incorporating Computers' Environment

“…According to [9] it is impossible for organizations to make precise estimates of the economic losses caused by an attack without having full knowledge of users' IT environment. Reference [10] states that organizations should monitor their network continually, and analyze available vulnerabilities to provide the necessary security levels. Secondly, the information of the environmental components is described in this research is in resolution of data items rather than entire systems, thus enabling focused information in relevance to each data item.…”