An Attack Graph-Based Probabilistic Security Metric

Authors:
Lingyu Wang;Tania Islam;Tao Long;Anoop Singhal;Sushil Jajodia
Affiliations:
Concordia Institute for Information Systems Engineering, Concordia University, Montreal, Canada QC H3G 1M8;Concordia Institute for Information Systems Engineering, Concordia University, Montreal, Canada QC H3G 1M8;Concordia Institute for Information Systems Engineering, Concordia University, Montreal, Canada QC H3G 1M8;Computer Security Division, National Institute of Standards and Technology, Gaithersburg, USA MD 20899;Center for Secure Information Systems, George Mason University, Fairfax, USA VA 22030-4444
Venue:
Proceeedings of the 22nd annual IFIP WG 11.3 working conference on Data and Applications Security
Year:
2008

Citing 19
Cited 12

A graph-based system for network-vulnerability analysis

Proceedings of the 1998 workshop on New security paradigms
Authentication metric analysis and design

ACM Transactions on Information and System Security (TISSEC)
Experimenting with Quantitative Evaluation Tools for Monitoring Operational Security

IEEE Transactions on Software Engineering
Scalable, graph-based network vulnerability analysis

Proceedings of the 9th ACM conference on Computer and communications security
Automated Generation and Analysis of Attack Graphs

SP '02 Proceedings of the 2002 IEEE Symposium on Security and Privacy
Using Model Checking to Analyze Network Vulnerabilities

SP '00 Proceedings of the 2000 IEEE Symposium on Security and Privacy
Efficient Minimum-Cost Network Hardening Via Exploit Dependency Graphs

ACSAC '03 Proceedings of the 19th Annual Computer Security Applications Conference
Measuring the attack surfaces of two FTP daemons

Proceedings of the 2nd ACM workshop on Quality of protection
A weakest-adversary security metric for network configuration security analysis

Proceedings of the 2nd ACM workshop on Quality of protection
Common Vulnerability Scoring System

IEEE Security and Privacy
Security Metrics: Replacing Fear, Uncertainty, and Doubt

Security Metrics: Replacing Fear, Uncertainty, and Doubt
Minimum-cost network hardening using attack graphs

Computer Communications
NetKuang: a multi-host configuration vulnerability checker

SSYM'96 Proceedings of the 6th conference on USENIX Security Symposium, Focusing on Applications of Cryptography - Volume 6
Toward measuring network security using attack graphs

Proceedings of the 2007 ACM workshop on Quality of protection
Measuring Network Security Using Bayesian Network-Based Attack Graphs

COMPSAC '08 Proceedings of the 2008 32nd Annual IEEE International Computer Software and Applications Conference
Using attack graphs for correlating, hypothesizing, and predicting intrusion alerts

Computer Communications
Measuring the overall security of network configurations using attack graphs

Proceedings of the 21st annual IFIP WG 11.3 working conference on Data and applications security
Interactive analysis of attack graphs using relational queries

DBSEC'06 Proceedings of the 20th IFIP WG 11.3 working conference on Data and Applications Security
An efficient and unified approach to correlating, hypothesizing, and predicting intrusion alerts

ESORICS'05 Proceedings of the 10th European conference on Research in Computer Security

Towards Modelling Information Security with Key-Challenge Petri Nets

NordSec '09 Proceedings of the 14th Nordic Conference on Secure IT Systems: Identity and Privacy in the Internet Age
Formal approach to security metrics.: what does "more secure" mean for you?

Proceedings of the Fourth European Conference on Software Architecture: Companion Volume
Quantitative software security measurement in an engineering service bus platform

Proceedings of the 2010 ACM-IEEE International Symposium on Empirical Software Engineering and Measurement
k-zero day safety: measuring the security risk of networks against unknown attacks

ESORICS'10 Proceedings of the 15th European conference on Research in computer security
Formal analysis of security metrics and risk

WISTP'11 Proceedings of the 5th IFIP WG 11.2 international conference on Information security theory and practice: security and privacy of mobile devices in wireless communication
Effective network vulnerability assessment through model abstraction

DIMVA'11 Proceedings of the 8th international conference on Detection of intrusions and malware, and vulnerability assessment
Distilling critical attack graph surface iteratively through minimum-cost SAT solving

Proceedings of the 27th Annual Computer Security Applications Conference
A planner-based approach to generate and analyze minimal attack graph

Applied Intelligence
Improving VRSS-based vulnerability prioritization using analytic hierarchy process

Journal of Systems and Software
A preliminary analysis of vulnerability scores for attacks in wild: the ekits and sym datasets

Proceedings of the 2012 ACM Workshop on Building analysis datasets and gathering experience returns for security
A stochastic model of attack process for the evaluation of security metrics

Computer Networks: The International Journal of Computer and Telecommunications Networking
Aggregating vulnerability metrics in enterprise networks using attack graphs

Journal of Computer Security

Quantified Score

Hi-index	0.00

Visualization

Abstract

To protect critical resources in today's networked environments, it is desirable to quantify the likelihood of potential multi-step attacks that combine multiple vulnerabilities. This now becomes feasible due to a model of causal relationships between vulnerabilities, namely, attack graph. This paper proposes an attack graph-based probabilistic metric for network security and studies its efficient computation. We first define the basic metric and provide an intuitive and meaningful interpretation to the metric. We then study the definition in more complex attack graphs with cycles and extend the definition accordingly. We show that computing the metric directly from its definition is not efficient in many cases and propose heuristics to improve the efficiency of such computation.