An Approach to Model Network Exploitations Using Exploitation Graphs

Abstract

In this article, a modeling process is defined to address challenges in analyzing attack scenarios and mitigating vulnerabilities in networked environments. Known system vulnerability data, system configuration data, and vulnerability scanner results are considered to create exploitation graphs ( e-graphs) that are used to represent attack scenarios. Experiments carried out in a cluster computing environment showed the usefulness of proposed techniques in providing in-depth attack scenario analyses for security engineering. Critical vulnerabilities can be identified by employing graph algorithms. Several factors were used to measure the difficulty in executing an attack. A cost/benefit analysis was used for more accurate quantitative analysis of attack scenarios. The authors also show how the attack scenario analyses better help deployment of security products and design of network topologies.

Aggregating vulnerability metrics in enterprise networks using attack graphs

“…Much work has already been done in analyzing network configuration data and identifying network vulnerabilities to construct attack graphs [2,6,7,8,14,15,16,19,20,21,29,30,31,32,35,37,40,41,42,44]. Attack graphs illustrate the cumulative effect of attack steps, showing how series of individual steps can potentially enable an attacker to gain privileges deep into the network.…”

Multi-step attack modelling and simulation (MsAMS) framework based on mobile ambients

“…For example, an employee might switch from working with his laptop in the office or at home, but anyway he is subject to the ruling of the network which allows the access to some resources just from within the office environment. To the best of our knowledge, models which represent a snapshot of a network, such as Attack Graphs [14,1,15,23,32,20,25,31,34], are unable to deal with all these dynamic aspects.…”

“…In fact, it uses the access-to-effect paradigm used by other researchers (e.g. [14,20]) which can be obtained from the NVD [24]. Modelling the input requires (i) the network configuration, (ii) vulnerabilities in COTS present in the network which can be obtained automatically from vulnerability scanning tools such as Nessus [22], and (iii) their attributes, which can be obtained from vulnerability databases such as the NVD [24].…”

finding multi-step attacks in computer networks using heuristic search and mobile ambients

“…It uses an access-to-effect paradigm, also used by other researchers (e.g. [125]). This paradigm adopts the type of access required for the exploitation of vulnerabilities (e.g.…”

“…Target service or host disabled with no access to host Table 5.1: Classification of vulnerabilities based on access and effect from [126] An alternative approach, also used by the Attack Graph community, relies on simplified pre-and postconditions (e.g. [126,128,125]) to compose attack steps from vulnerabilities. This approach classifies vulnerabilities always in terms of two attributes: access (or locality) and effect.…”