Attack Graph Generation with Machine Learning for Network Security

Abstract

Recently, with the discovery of various security threats, diversification of hacking attacks, and changes in the network environment such as the Internet of Things, security threats on the network are increasing. Attack graph is being actively studied to cope with the recent increase in cyber threats. However, the conventional attack graph generation method is costly and time-consuming. In this paper, we propose a cheap and simple method for generating the attack graph. The proposed approach consists of learning and generating stages. First, it learns how to generate an attack path from the attack graph, which is created based on the vulnerability database, using machine learning and deep learning. Second, it generates the attack graph using network topology and system information with a machine learning model that is trained with the attack graph generated from the vulnerability database. We construct the dataset for attack graph generation with topological and system information. The attack graph generation problem is recast as a multi-output learning and binary classification problem. It shows attack path detection accuracy of 89.52% in the multi-output learning approach and 80.68% in the binary classification approach using the in-house dataset, respectively.

A Survey of Automatic Generation of Attack Trees and Attack Graphs

“…Attack Tree from [16] overview of the automatic generation of Attack Models than the other surveys, since it is the first survey focusing on this particular field. To be more specific, the automatic generation of Attack Trees is only studied in [39], where all the papers referring to Attack Graphs are not considered- [3], [6], [13], [14], [18], [28], [29], [34]- [37], we consider all of the above papers. Also, the following papers which generate Attack Tree are not considered- [7], [12], [17], [22], [32] in [39], we on the other hand consider all the papers mentioned above.…”

“…None of the papers in this category are presenting proofs or the scalability of their approach. Koo et al [18] introduces a method to support the generation of an attack graph using Deep Learning and Machine Learning. The final model takes as an input the network topology and the system information.…”

“…The authors at [18] present an easy and cheap method for generating Attack Graphs, but they explicitly state that it is applicable to small organizations. This is not the usual case nowadays, since we are surrounded by huge systems and organizations.…”

Towards Real-Time Warning and Defense Strategy AI Planning for Cyber Security Systems Aided by Security Ontology

“…When implementing an attack, it needs to meet certain conditions, such as reachability and accessibility. Note that the security knowledge base needs to fully express the conditions for vulnerability exploitation and the risk factors after the successful exploitation of vulnerabilities, which are often expressed through attack graphs in mainstream approaches [17].…”

Event-Triggered Confidentiality Fusion Estimation Against Eavesdroppers in Cyber-Physical Systems

“…However, due to its open connectivity, CPSs have become the target of malicious attackers. Eavesdropping attack is one of the typical network attacks [5,6]. The security of CPSs has received a lot of attention, among which confidentiality is a basic security issue [7].…”