Identifying Critical Attack Assets in Dependency Attack Graphs

Abstract

Abstract. Attack graphs have been proposed as useful tools for analyzing security vulnerabilities in network systems. Even when they are produced efficiently, the size and complexity of attack graphs often prevent a human from fully comprehending the information conveyed. A distillation of this overwhelming amount of information is crucial to aid network administrators in efficiently allocating scarce human and financial resources. This paper introduces AssetRank, a generalization of Google's PageRank algorithm which ranks web pages in web graphs. AssetRank addresses the unique semantics of dependency attack graphs and incorporates vulnerability data from public databases to compute metrics for the graph vertices (representing attacker privileges and vulnerabilities) which reveal their importance in attacks against the system. The results of applying the algorithm on a number of network scenarios show that the numeric ranks computed are consistent with the intuitive importance that the privileges and vulnerabilities have to an attacker. The vertex ranks can be used to prioritize countermeasures, help a human reader to better comprehend security problems, and provide input to further security analysis tools.

Determining Asset Criticality for Cyber Defense

“…Some work has been done to determine cyber asset criticality [8] [9] [10]. These approaches either view asset criticality from the prospective of the attacker or only focus on the dependency aspect of asset criticality.…”

“…While it provides in interesting approach, it still requires human decision makers to make a determination regarding the criticality of an asset, using the information presented to them. Sawilla et al focus on the criticality of an asset from an attacker's point of view using dependency attack graphs [10] rather than focus on the impact of the asset itself. Their approach uses a generalization of Google's PageRank algorithm [11] to calculate the importance of an asset to an attacker.…”

“…PageRank assesses the importance of a web page by the number of pages linking to it as well as the importance of these pages. The straightforward and intuitiveness of the algorithm has made it popular to apply in other areas such as attack paths [10] and measuring species' importance of co-extinction [24]. Very simply stated, the algorithm recursively calculates a page rank value in which for each page that links to it, the page rank value of that page is divided by the number of outgoing links from that page, and then these values are summed up [11].…”

Defensive Resource Allocations with Security Chokepoints in IPv6 Networks

“…Sawilla and Ou [22] use attack graphs with a ranking method as a tool for monitor placement, explicitly invoking minimal graph cuts as a method for selecting remediation or focused monitoring. While exploring a closely related problem space to the one we consider, both works makes use of significant side information in the form of attack graphs and the result of vulnerability scans and analysis that we do not consider.…”

On Computing Enterprise IT Risk Metrics

“…Less closely related is the work on efficient generation of attack graphs [6][7][8][9][10]. These do not, however, explicitly model network router and firewall configurations to calculate the end-to-end reachability matrix, and do not focus on the problem of defining an aggregate impact metric.…”