Finding the minimum cut set in attack graphs using genetic algorithms

Abstract

Attack graphs are useful tools to both display possible attack vectors in simple systems and as an analysis tool for more complex systems. This paper considers the latter case and how an attack graph can be used to minimize the cost of deploying countermeasures. Specifically we develop an approach to find the minimum cut set in dependency attack graphs using a genetic algorithm (GA). The minimum cut set is a natural graph representation describing a set of security countermeasures that prevent attackers reaching their targets. The work shows that the problem maps naturally to a binary encoded GA and gives satisfactory results without the need to deploy problem specific GA operators.

Risk-averse bi-level stochastic network interdiction model for cyber-security risk management

“…Noel and Jajodia [1] developed a methodology to optimally place intrusion detection system (IDS) sensors that provides complete coverage of potential attack paths using the fewest number of sensors. Alhomidi and Reed [13] employed a genetic algorithm to find the minimum cut-set in dependency attack graphs.…”

Test problems and representations for graph evolution

“…Another application is the location of cutsets, minimal collections of links that if deleted will disconnect a graph. Work on this problem appears in [1], [23]. The problem of clustering a graph into sets of tightly coupled subgraphs or communities is the subject of [21], [25].…”

A framework for Cybersecurity of Supervisory Control and Data Acquisition (SCADA) Systems and Industrial Control Systems (ICS)

“…[52,53] proposed the use of Google's page-rank based approach for network security, in which the idea was to successively remove the highest page-ranked nodes to maximally decrease the overall connectivity. [54] proposed a genetic algorithm for finding a minimum cut set in AND/OR dependency attack-graphs, with the cut set representing a set of security countermeasures that prevent attackers from exploiting the underlying vulnerabilities. [55] studied a related problem of finding a minimum label spanning tree and a minimum label path, but those do not necessarily induce a cut.…”