Optimal security hardening using multi-objective optimization on attack tree models of networks

Abstract

Researchers have previously looked into the problem of determining if a given set of security hardening measures can effectively make a networked system secure. Many of them also addressed the problem of minimizing the total cost of implementing these hardening measures, given costs for individual measures. However, system administrators are often faced with a more challenging problem since they have to work within a fixed budget which may be less than the minimum cost of system hardening. Their problem is how to select a subset of security hardening measures so as to be within the budget and yet minimize the residual damage to the system caused by not plugging all required security holes. In this work, we develop a systematic approach to solve this problem by formulating it as a multi-objective optimization problem on an attack tree model of the system and then use an evolutionary algorithm to solve it.

Aggregating vulnerability metrics in enterprise networks using attack graphs

“…Dewri et al [8] formulate security hardening as a multi-objective optimization problem, using a genetic algorithm to search for an optimal solution based on costs of security hardening and potential damage. Homer and Ou [11] demonstrate the effectiveness of using MinCostSAT as a basis for automated network reconfiguration, with numeric cost values being assigned to each configuration setting and reachable privilege in the attack graph.…”

“…Much work has already been done in analyzing network configuration data and identifying network vulnerabilities to construct attack graphs [2,6,7,8,14,15,16,19,20,21,29,30,31,32,35,37,40,41,42,44]. Attack graphs illustrate the cumulative effect of attack steps, showing how series of individual steps can potentially enable an attacker to gain privileges deep into the network.…”

Management of security policy configuration using a Semantic Threat Graph approach

“…The research carried out by [10] describes an Enhanced Attack Tree (EAT) that supports temporal dependencies and sequential threat events that must occur for an attack to be successful. Threat trees have also been extended to provide qualitative [56] and quantitative [6,17,15,9] metrics for risk analysis.…”

Dynamic deployment of context-aware access control policies for constrained security devices

“…Another paradigm is presented in [20]: the use of attack-tree representations to address the network policy enforcement problem. The authors in [20] propose to quantify the damage following an attack and the cost related to the implementation of new security controls; both quantications follow the same cost model. The optimization problem, solved with a genetic algorithm, is to nd a minimum security cost that corresponds to a minimum damage.…”

“…Our approach is dierent from those using attack graph models: we deploy a policy based on a more abstract model than the one dealing with attacker's privileges. Our methodology is placed prior to the attack graph applications and the result of our deployment process could be jointly used with such approaches in [20,30]; our deployment would clearly inuence the attack graph instantiation.…”