Realtime intrusion risk assessment model based on attack and service dependency graphs

Abstract

Network services are becoming larger and increasingly complex to manage. It is extremely critical to maintain the users QoS, the response time of applications, and critical services in high demand. On the other hand, we see impressive changes in the ways in which attackers gain access to systems and infect services. When an attack is detected, an Intrusion Response System (IRS) is responsible to accurately assess the value of the loss incurred by a compromised resource and apply the proper responses to mitigate attack. Without having a proper risk assessment, our automated IRS will reduce network performance, wrongly disconnect users from the network, or result in high costs for administrators reestablishing services, and become a DoS attack for our network, which will eventually have to be disabled. In this paper, we address these challenges and we propose a new model to combine the Attack Graph and Service Dependency Graph approaches to calculate the impact of an attack more accurately compared to other existing solutions. To show the effectiveness of our model, a sophisticated multi-step attack was designed to compromise a web server, as well as to acquire root privilege. Our results illustrate the efficiency of the proposed model and confirm the feasibility of the approach in real-time.

Systematic Literature Review of Security Event Correlation Methods

“…This helps to calculate the impact of current attacks and assess future impacts. Shameli-Sendi et al [91] propose a model combining attack graphs and service dependency graphs based on LAMBDA functions. These functions determine the attacker knowledge level and the attack impact on security attributes CIA (confidentiality, integrity, and availability).…”

Planning-based security testing of web applications with attack grammars

“…Further offensive testing approaches against web applications and networks can be found in Duchene et al (2014), Felderer et al (2016, Sudhodanan et al (2016), andShameli-Sendi et al (2017), respectively. A general introduction and analysis of model-based testing is elaborated in Krämer and Legeard (2016) .…”

“…This implies a reduction of testing time but still ensures the ability to identify causes of vulnerabilities. Some other techniques rely on models, either of the application (Krämer and Legeard 2016;Felderer et al 2016) or of the attacks themselves (Duchene et al 2014;Shameli-Sendi et al 2017). A system under test (SUT) is checked regarding whether it behaves in line with its specification using a graphical representation that corresponds to the SUT's expected behavior.…”