Survey of Attack Graph Analysis Methods from the Perspective of Data and Knowledge Processing

Zeng, Jianping; Wu, Shuang; Chen, Yanyu; Zeng, Rui; Wu, Chengrong

doi:10.1155/2019/2031063

Cited by 40 publications

(27 citation statements)

References 42 publications

(48 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this part, the proposed automatic planning-based attack path discovery approach is evaluated. At first, an Input: device reachability graph Gr, subgraph size subg_size Output: all subgraphs (1) function GENERATE SUBGRAPHS (Gr, subg_size) (2) if nodes_num of Gr more than subg_size then (3) push Gr to Qp (4) while Qp is not empty do (5) pop a subgraph G from Qp (6) find branch nodes Ns from G (7) get edges from Ns and push them into Qe (8) while Qe is not empty do (9) pop an edge qe from Qe (10) find successor subgraph Gs from edge qe in G (11) if nodes in Gs less than subg_size then (12) push Gs into Qp (13) else (14) push Gs into Qo (15) output all subgraphs from Qo (16) else (17) output Gr (18) end function ALGORITHM 1: Device reachability graph partitioning.…”

Section: Case Studymentioning

confidence: 99%

“…Input: pddl file template domain_temp and problem_temp connection object to a graph database hg; planning goals Output: constructed pddl domain and problem files (1) function GENERATE PDDL FILE (domain_temp, problem_temp, hg) (2) query device nodes, device reachability, vulnerability and component via hg (3) generate domain file: (4) generate predicates of vulnerability, reachability, pre and postconditions (5) generate actions of vulnerability from pre-and postconditions of vulnerability ( 6) end (7) generate problem file: (8) generate objects from device nodes (9) generate initially satisfied conditions (10) generate goals based on your input (11) end (12) return generated domain and problem files (13) end function ALGORITHM 2: Automatic construction of PDDL domain and problem files. experimental setup is introduced by a hypothetical network topology from IT to OT networks in Section 6.1. en, attack paths are illustrated, and the corresponding data is stored in the form of graph data in Section 6.2.…”

Section: Case Studymentioning

confidence: 99%

“…Input: number of threads thread_num Output: attack graph AG; adding exploit and attack edges in a graph database (1) create an empty attack graph AG (2) get domain.pddl and problem.pddl via GENERATE PDDL FILE (domain_temp, problem_temp, hg) (3) get all subgraphs from GENERATE SUBGRAPHS (G, subg_size) (4) create threads pool threads_pool and set maxim workers corresponding to thread_num (5) foreach subgraph in subgraphs do (6) modify problem.pddl and domain.pddl based on subgraph (7) create a thread and bind it to enumerate attack paths using a planner (8) submit this thread to threads_pool (9) while True do (10) check the status of threads in threads_pool ( 11) if all tasks in threads_pool have done do (12) break ( 13) generate subag from paths returned from each thread and merge them into AG (14) get ag_edges from AG (15) create attack and exploit edges in a graph database according to ag_edges ALGORITHM 3: Attack graph generation in a multithreading manner. e paths in the attack graph are a mix of the Device nodes and the Vulnerability nodes, which represents that an attacker can reach a device and exploit vulnerability.…”

Section: Attack Path Discoverymentioning

confidence: 99%

“…Focusing on finding all possible attack paths, dependencies of topologies, vulnerabilities, exploitations, and targets are integrated into a graph, called attack graph [8]. Since the attack graph model was first constructed in 1997, quantities of generation methods for it have been widely used in a variety of scenarios to discovery attack paths [6].…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

An Automatic Planning-Based Attack Path Discovery Approach from IT to OT Networks

Wang

Zhang

Liu

et al. 2021

Security and Communication Networks

View full text Add to dashboard Cite

With the convergence of IT and OT networks, more opportunities can be found to destroy physical processes by cyberattacks. Discovering attack paths plays a vital role in describing possible sequences of exploitation. Automated planning that is an important branch of artificial intelligence (AI) is introduced into the attack graph modeling. However, while adopting the modeling method for large-scale IT and OT networks, it is difficult to meet urgent demands, such as scattered data management, scalability, and automation. To that end, an automatic planning-based attack path discovery approach is proposed in this paper. At first, information of the attacking knowledge and network topology is formally represented in a standardized planning domain definition language (PDDL), integrated into a graph data model. Subsequently, device reachability graph partitioning algorithm is introduced to obtain subgraphs that are small enough and of limited size, which facilitates the discovery of attack paths through the AI planner as soon as possible. In order to further cope with scalability problems, a multithreading manner is used to execute the attack path enumeration for each subgraph. Finally, an automatic workflow with the assistance of a graph database is provided for constructing the PDDL problem file for each subgraph and traversal query in an interactive way. A case study is presented to demonstrate effectiveness of attack path discovery and efficiency with the increase in number of devices.

show abstract

Section: Case Studymentioning

confidence: 99%

Section: Case Studymentioning

confidence: 99%

Section: Attack Path Discoverymentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

An Automatic Planning-Based Attack Path Discovery Approach from IT to OT Networks

Wang

Zhang

Liu

et al. 2021

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…However, there are still several problems with the attack graph-based approach. Attack graph generation can involve up to polynomial complexity, and the evaluation and analysis of attack graphs to determine all possible attack paths suffer from scalability issues [7]. Meanwhile, a large-scale attack graph is complicated, making it difficult for humans to digest all the dependency relations and specify the key problems in a limited amount of time.…”

Section: Introductionmentioning

confidence: 99%

A Vulnerability Risk Assessment Method Based on Heterogeneous Information Network

et al. 2020

View full text Add to dashboard Cite

Due to the increasing number of network security vulnerabilities, vulnerability risk assessment must be performed to prioritize the repair of high-risk vulnerabilities. Traditional vulnerability risk assessment is based primarily on the Common Vulnerability Scoring Systems (CVSS) and attack graphs. Nevertheless, the CVSS metrics ignore the impact of the vulnerability on the specific network, which accounts that the identical vulnerability exists in different network environments is assigned repeated values. Additionally, the attack graphs still suffer from scalability and readability issues. To solve the above problems, a ranking method based on the heterogeneous information network is innovatively proposed to assess the vulnerability risk in a specific network. It considers the exploitability of a vulnerability, the impact of a vulnerability on the network components, and the importance of the vulnerable components. First, a heterogeneous information network containing vulnerability and host and the relationships between host and host is constructed to compute the risk score for each vulnerability and implement the ranking process. Second, a model extension method is proposed to adapt to situations in which additional factors related to vulnerability risk assessment need to be considered. Finally, we explore two case studies to compare the proposed method with CVSS and attack graph-based methods. The simulation results show that the proposed method can accurately assess the risk of vulnerabilities in a specific network environment and that it has a lower computational complexity than other methods. INDEX TERMS Common vulnerability scoring systems (CVSS), vulnerability, risk assessment, information fusion, heterogeneous information network.

show abstract

Attack Path Analysis for Cyber Physical Systems

Kavallieratos

Katsikas

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Survey of Attack Graph Analysis Methods from the Perspective of Data and Knowledge Processing

Cited by 40 publications

References 42 publications

An Automatic Planning-Based Attack Path Discovery Approach from IT to OT Networks

An Automatic Planning-Based Attack Path Discovery Approach from IT to OT Networks

A Vulnerability Risk Assessment Method Based on Heterogeneous Information Network

Attack Path Analysis for Cyber Physical Systems

Contact Info

Product

Resources

About