Hypergraph‐driven mitigation of cyberattacks

Abstract

We extend a mitigation model that evaluates individual and combined countermeasures against multistep cyberattack scenarios. The goal is to anticipate the actions of an attacker that wants to disrupt a given system (eg, an information system). The process is driven by a hypergraph formalism, enforced with a stateful return on response investment metric that optimally evaluates, ranks, and selects appropriate countermeasures to handle ongoing and potential attacks. KEYWORDSattack graphs, countermeasure selection, mitigation, network security, return on security investment, security metrics INTRODUCTIONQuantitative financial metrics are useful in cybersecurity to evaluate mitigation plans and select the best countermeasures to handle attack scenarios. 1 The main drawback is the management of stateful meta-data, for example, how countermeasures deployed at time t−1 shall be considered when evaluating a new group of countermeasures at time t. We argue that a plausible solution is the combination of quantitative financial metrics together with attack graph formalisms. (2,3) The challenge is data management, effective processing, and visual perception when dealing with huge size attack graphs. An application of the hypergraphs allows us to reduce the size of processed attack graph by combining multiple links within 1 node. 4 In this letter, we propose to integrate a stateful quantitative financial metric, based on return on investment (ROI)-like concepts, together with a hypergraph model, in order to evaluate, rank, and select optimal countermeasures based on financial and threat impact assessment functions. The resulting solution is evaluated at each state of the system while considering the already deployed countermeasures and the effects of adding or suppressing other security actions. Section 2 and 3 provide the background and review some related work. Section 4 proposes our solution. Section 5 describes the hypergraph-driven reduction of our attack graph model. Section 6 discusses limitations and advantages of our proposal. Section 7 concludes the paper. BACKGROUNDThe return on response investment (RORI) metric proposed in Reference 1 is extended toward a new stateful return on response investment metric (hereinafter denoted as StRORI). We assume a dynamic security monitoring process, where detection tools are permanently inspecting system and network events, in order to identify attack instances. To ease the presentation of the StRORI metric, we assume a discrete monitoring system based on temporal snapshots. Each snapshot provides a list with the different nodes affected in the attack scenario, as well as all the remainder security parameters. We propose to use attack graph Internet Technology Letters. 2018;1:e38.wileyonlinelibrary.com/journal/itl2

Intelligent Decision Support for Cybersecurity Incident Response Teams: Autonomic Architecture and Mitigation Search

“…All the other previous works tackle simpler search problems by only focusing on a single mitigation class (Marsa-Maestre et al [21]), a one-to-one mapping from attack action classes to mitigation action classes (Sandor et al [28]) or a one-to-many mapping from the former to the latter (Lysenko et al [19], Huertas-Celdran et al [5], [20]). While Gonzales-Granadillo et al [12], Kanoun et al [16], Javornik et, al. [15], Yuan et al [36], and Vieira et al [33] make other original proposals, they either do not discuss their implementation or do not evaluate it through an experiment or simulation, making it difficult to assess their practical applicability.…”

Mission‐centric decision support in cybersecurity via Bayesian Privilege Attack Graph

“…Li et al 59 in 2020 encountered countermeasures selection for multipath attacks formulated as an optimization problem and proved the problem to be NP‐hard. Gonzalez‐Granadillo et al 60 proposed a countermeasure selection using hypergraph, a concept defined in the author's previous work 61 …”

“…Gonzalez-Granadillo et al 60 proposed a countermeasure selection using hypergraph, a concept defined in the author's previous work. 61 Kotenko and Doynikova 62 outlined the uncertainty of attacker behavior and the complexity of interconnections between resources in modern distributed systems. The authors propose a model-driven approach to the security assessment and countermeasure selection that is based on integration with security information and event management systems, namely the open standards and databases.…”