Flow-based information security risk-aware routing model using base score metrics of criticality vulnerabilities

Abstract

The paper proposes an improved flow-based routing model taking into account information security risks using basic vulnerability criticality metrics. The model is based on the conditions for the implementation of single- and multipath routing, flow conservation, and prevention of overload of communication links of the telecommunications network (TCN). Within the proposed model, the problem of secure routing is formulated in an optimization form. The novelty of the developed model is that expressions are used to calculate routing metrics, which characterize the risk of information security in communication links of the TCN and in accordance with the NIST recommendations, take into account damages from the violation of confidentiality and integrity of information, availability of network resources in case of use of existing vulnerabilities; indicators of the complexity of exploiting vulnerabilities at network nodes and gaining access to network elements and the network as a whole due to the use of these vulnerabilities. As shown by the results of the study, the use of the proposed model of secure routing allows ensuring the calculation and use of routes with minimal risk of information security, thereby ensuring the maximum level of network security for packets transmitted in the TCN. The proposed approach to the formation of routing metrics can also be used to ensure comprehensive consideration in the process of solving routing problems of both network security indicators and quality of service indicators. The prospects for the development of the obtained solutions include the synthesis of models and methods of secure routing by which it would be possible to provide (guarantee) a given level of network security based on the calculation and use of appropriate routes in TCN.