Efficient Attack Countermeasure Selection Accounting for Recovery and Action Costs

Abstract

The losses arising from a system being hit by cyber attacks can be staggeringly high, but defending against such attacks can also be costly. This work proposes an attack countermeasure selection approach based on cost impact analysis that takes into account the impacts of actions by both the attacker and the defender.We consider a networked system providing services whose provision depends on other components in the network. We model the costs and losses to service availability from compromises and defensive actions to the components, and show that while containment of the attack can be an effective defensive strategy, it can be more cost-efficient to allow parts of the attack to continue further whilst focusing on recovering services to a functional state. Based on this insight, we build a countermeasure selection method that chooses the most cost-effective action based on its impact on expected losses and costs over a given time horizon. Our method is evaluated using simulations in synthetic graphs representing network dependencies and vulnerabilities, and found to perform well in comparison to alternatives.

Security Countermeasures Selection Using the Meta Attack Language and Probabilistic Attack Graphs

“…Attack graphs are also being studied extensively and employed for the purpose of optimal selection of countermeasures, e.g., in [20], [29], [35], [37]. While the objects called attack graphs in [37] are essentially the same as the attack graphs of [1], and a reduced version of the latter, called vulnerability dependency graphs in [1] is used in [35], in each of the works [20], [29], [37] attack graphs are defined differently. Furthermore, each of them having different optimization goals, the optimization methods of [20], [29], [35], [37] require different input data.…”

“…time-to-compromise [12], path length [14], attack difficulty [24], weakest adversary security metric [27], attack resistance [40], probabilistic security metric [39] it is possible to measure security of the target assets in a network. These metrics can be further used for suggesting actions by which security of valuable assets increases [20], [23], [25], [29], [35], [37].…”

Analyzing the Viability of UAV Missions Facing Cyber Attacks

“…In this regard, our approach relates to works on quantifying cyber resilience [13] of a system, most directly to approaches for measuring resilience based on performance over time such as Bruneau et al [14] and Ganin et al [15]. In employing a resilience-inspired view on attack impacts as a basis for decision making, our approach is similar to that adopted in [7] to select countermeasures to attacks, but our focus here is on UAVs and on making decisions over the appropriate mission setup and on mission continuation in the face of attacks. We model attack impacts with a combination of a model of attack progression and a model of system performance in producing its output.…”

“…We model attack impacts with a combination of a model of attack progression and a model of system performance in producing its output. This relates to methods by [6], [7] that approach attack impact assessment via a combination of an attack graph (AG) and a service dependency graph. In contrast to these works, we use a Petri net for modeling attack progression, and find it particularly suited to this in our application context.…”

“…Our evaluation of attack impacts relates to works on attack impact analysis such as [6], [7], but differs in the use of Petri nets for the attack modeling, and in the application to UAVs. While Petri nets have been used for modeling cyber attacks by e.g.…”