Corporate networks security evaluation based on attack graphs

Authors:
Evgeny Sergeevich Abramov;Artem Viktorovich Andreev;Denis Valerievich Mordvin;Oleg Borisovich Makarevich
Affiliations:
TIT SFEDU, Taganrog, Russian Fed.;TIT SFEDU, Taganrog, Russian Fed.;TIT SFEDU, Taganrog, Russian Fed.;TIT SFEDU, Taganrog, Russian Fed.
Venue:
Proceedings of the 4th international conference on Security of information and networks
Year:
2011

Citing 3
Cited 2

FIREMAN: A Toolkit for FIREwall Modeling and ANalysis

SP '06 Proceedings of the 2006 IEEE Symposium on Security and Privacy
Modeling Modern Network Attacks and Countermeasures Using Attack Graphs

ACSAC '09 Proceedings of the 2009 Annual Computer Security Applications Conference
Automated method for constructing of network traffic filtering rules

Proceedings of the 3rd international conference on Security of information and networks

Development of a secure cluster-based wireless sensor network model

Proceedings of the 6th International Conference on Security of Information and Networks
Using quadrocopter as a pentest tool

Proceedings of the 6th International Conference on Security of Information and Networks

Quantified Score

Hi-index	0.00

Visualization

Abstract

Using attack graphs for the security analysis allows to consider the relationship of individual components and their security parameters. It gives more accurate data to assess the security of the system as a whole comparing with investigation of security properties of the individual nodes. This paper describes the calculation of attack graph, analyze the results and evaluate the effectiveness of existing countermeasures. The model allows dynamic routing, filtering on any network object, NAT. States in attack graph are detailed to confidentiality, integrity, availability triad. In constructing the attack graph takes into account both local and network vulnerability. The results of experimental evaluation of system performance presented. For the analysis of 10000 simulated hosts took an average time of about 100 seconds. The number of access control rules (from 500 to 4000 per simulated subnet) were chosen so that the maximum number of filtering rules for devices were about 1,000.