Evaluating Network Security With Two-Layer Attack Graphs

Abstract

Abstract-Attack graphs play important roles in analyzing network security vulnerabilities, and previous works have provided meaningful conclusions on the generation and security measurement of attack graphs. However, it is still hard for us to understand attack graphs in a large network, and few suggestions have been proposed to prevent inside malicious attackers from attacking networks. To address these problems, we propose a novel approach to generate and describe attack graphs. Firstly, we construct a two-layer attack graph, where the upper layer is a hosts access graph and the lower layer is composed of some host-pair attack graphs. Compared with previous works, our attack graph has simpler structures, and reaches the best upper bound of computation cost in O(N 2 ). Furthermore, we introduce the adjacency matrix to efficiently evaluate network security, with overall evaluation results presented by gray scale images vividly. Thirdly, by applying prospective damage and important weight factors on key hosts with crucial resources, we can create prioritized lists of potential threatening hosts and stepping stones, both of which can help network administrators to harden network security. Analysis on computation cost shows that the upper bound computation cost of our measurement methodology is O(N 3 ), which could also be completed in real time. Finally, we give some examples to show how to put our methods in practice.

An Analytical Evaluation of Network Security Modelling Techniques Applied to Manage Threats

“…This assumption helped to derive a graph containing all required information about dependency relationships among vulnerabilities [11]. Third, [12] has overcome a scalability problem by constructing a two-layer attack graphs, which in sense have reduced computation cost and simplified the graph itself. The monotonicity assumption is also applied to generate the graph.…”

“…An attack sequence is described as a single path in the graph and the dependencies between the paths are the relations between the vulnerabilities. As a result, attack graphs can provide meaningful and quantitative conclusions in analysing network security [12]. Commonly an attack graph can be represented with exploits and conditions [3].…”

“…This case is handled by the insertion of dummy conditions to capture the conjunctive relationship [3]. A new approach of two-layer attack graphs has provided an advantage of vividly analysing graphs, finding dangerous hosts inside a network and process several targets at the same time [12]. The generation model consists of host-pair attack (Figure 1(b)) and hosts access graphs (Figure 1(b)).…”

Cybersecurity: A Stochastic Predictive Model to Determine Overall Network Security Risk Using Markovian Process

“…On the other hand, most of the attack graphs are designed for a single target, and cannot be used to evaluate the overall security of the networks with several targets. To address these striking problems Anming Xie, Zhuhua Cai, Cong Tang, Jianbin Hu, and Zhong Chen [11] developed a novel approach to generate and describe the attack graph. They developed a two layer attack graph, where the upper layer is a host access graph and the lower layer is composed of some host pair attack graphs.…”

Attack Graph Analysis for Network Anti-Forensics

“…Attack graph reasoning utilizes reverse engineering techniques used by the investigators for scrutinizing computer attacks in hierarchical way (Anming, Zhuhua, Cong, Jianbin, & Zhong, 2009). This methodology is the main part of the evidence process phase in network forensics.…”