A Vulnerability Risk Assessment Method Based on Heterogeneous Information Network

Abstract

Due to the increasing number of network security vulnerabilities, vulnerability risk assessment must be performed to prioritize the repair of high-risk vulnerabilities. Traditional vulnerability risk assessment is based primarily on the Common Vulnerability Scoring Systems (CVSS) and attack graphs. Nevertheless, the CVSS metrics ignore the impact of the vulnerability on the specific network, which accounts that the identical vulnerability exists in different network environments is assigned repeated values. Additionally, the attack graphs still suffer from scalability and readability issues. To solve the above problems, a ranking method based on the heterogeneous information network is innovatively proposed to assess the vulnerability risk in a specific network. It considers the exploitability of a vulnerability, the impact of a vulnerability on the network components, and the importance of the vulnerable components. First, a heterogeneous information network containing vulnerability and host and the relationships between host and host is constructed to compute the risk score for each vulnerability and implement the ranking process. Second, a model extension method is proposed to adapt to situations in which additional factors related to vulnerability risk assessment need to be considered. Finally, we explore two case studies to compare the proposed method with CVSS and attack graph-based methods. The simulation results show that the proposed method can accurately assess the risk of vulnerabilities in a specific network environment and that it has a lower computational complexity than other methods. INDEX TERMS Common vulnerability scoring systems (CVSS), vulnerability, risk assessment, information fusion, heterogeneous information network.

VulDistilBERT: A CPS Vulnerability Severity Prediction Method Based on Distillation Model

“…A software vulnerability rating method, SVRA, was proposed, which uses a vulnerability database to analyze the frequency of CVSS metrics at diferent times, and then gives equations for exploitability and impact scores based on these frequencies. Wang et al [33] considered that CVSS metrics ignore the impact of vulnerabilities on specifc networks, i.e., the same vulnerabilities that exist in diferent network environments are assigned duplicate values, and the attack graph still sufers from scalability and readability issues. To address the above issues, the authors innovatively propose a vulnerability risk assessment method based on heterogeneous information networks.…”

Vulnerability Assessment in Heterogeneous Web Environment Using Probabilistic Arithmetic Automata

“…Wang., et al, [4] proposed a ranking method based on the heterogeneous information network to assess the vulnerability risk in a specific network. It considers the exploitability of a vulnerability, the impact of a vulnerability on the network components, and the importance of the vulnerable components and the authors compare the proposed method with CVSS and attack graph-based methods.…”

“…To enhance the model for detecting and preventing the various attacks in the heterogeneous web application since the tools used earlier will not ensure prevention mechanisms to mitigate detected vulnerabilities and attacks. The objective is also to incorporate suitable machine learning techniques into the model for accurate and effective prediction and forecasting of attacks with their root causes, to analyze the impact of attack penetration level from web application to web services and to mitigate the percentage of vulnerabilities and attacks by recommending preventive measures and best practices [4]. Due to the diversity in the detection techniques, there is a need for a standard model for detecting all possible vulnerabilities.…”

Fuzzy Expert System of Information Security Risk Assessment on the Example of Analysis Learning Management Systems

“…In this paper, Jasna Markovic-Petrovic, Mirjana Stojanovic and Slavica Bostjancic Rakas proposed a new method for security risk assessment in supervisory control and data acquisition (SCADA) networks using fuzzy logic [5]. Wenrui Wang, Fan Shi, Min Zhang, Chengxi Xu and Jinghua Zheng proposed a heterogeneous information network based ranking method for vulnerability risk assessment in a particular network [6]. Jiali Wang, Martin Neil and Norman Fenton obtained a combined Extended Factor Analysis of Information Risk-Bayesian Networks (EFBN) approach using Monte Carlo simulation and showed that it can provide an integrated solution for cybersecurity risk assessment and decision making [7].…”