Attack Graph Based Evaluation of Network Security

Abstract

The perspective directions in evaluating network security are simulating possible malefactor's actions, building the representation of these actions as attack graphs (trees, nets), the subsequent checking of various properties of these graphs, and determining security metrics which can explain possible ways to increase security level. The paper suggests a new approach to security evaluation based on comprehensive simulation of malefactor's actions, construction of attack graphs and computation of different security metrics. The approach is intended for using both at design and exploitation stages of computer networks. The implemented software system is described, and the examples of experiments for analysis of network security level are considered.

Cyber-physical security metric inference in smart grid critical infrastructures based on system administrators' responsive behavior

“…The main idea is to capture potential system vulnerabilities, and then extract all possible attack paths. The generated graph can be used to compute security metrics (Kotenko and Stepashkin, 2006;Wang et al, 2007Wang et al, , 2008b, to qualitatively assess the security strength of a network (Pamula et al, 2006;Wang et al, 2006), to identify the most critical assets in the organization (Sawilla and Ou, 2008), or for security visualization (Noel et al, 2005). In particular, Noel and Jajodia (2008) uses an approach called Topological Vulnerability Analysis (TVA) (Jajodia et al, 2005;Jajodia and Noel, 2008) to match network configuration with attack simulation in order to optimize IDS sensor placement and to prioritize IDS alerts.…”

Application of security information and event management technology for information security in critical infrastructures

“…Анализ событий безопасности на основе использования си-стемы моделирования сетевых атак. В проекте предлагается внед-рить в существующие SIEM-системы дополнительную функциональ-ность -подсистему моделирования атак, которая позволит расширить возможности и повысить точность выявления инцидентов, связанных с информационной безопасностью [26][27][28][29][30][31][32][33][34].…”

Attack Graph Analysis for Network Anti-Forensics

“…As most of the tools and techniques for forensics and anti-forensics are available open source and are exploited to a great extent, even by the script kiddies. Numerous tutorials are available on internet which provide handful of information about hacking and data theft (Kotenko & Stepashkin, 2006). Another area is the incorporation of anti-forensics such as data hiding, hiding IP, network steganography, data destruction, obfuscation and log cleaning into attacks to hinder the investigation (W. Wang & Daniels, 2008).…”