Attack Graph-based Solution for Vulnerabilities Impact Assessment in Dynamic Environment

Robust PMU Placement in Branch Switching Power Networks for Minimum Variance State Estimation

As networks continue to grow in size and complexity, automatic assessment of the security vulnerability becomes increasingly important. The typical means by which an attacker breaks into a network is through a series of exploits, where each exploit in the series satisfies the pre-condition for subsequent exploits and makes a causal relationship among them. Such a series of exploits constitutes an attack path where the set of all possible attack paths form an attack graph. Attack graphs reveal the threat by enumerating all possible sequences of exploits that can be followed to compromise a given critical resource. The contribution of this chapter is to identify the most probable attack path based on the attack surface measures of the individual hosts for a given network and also identify the minimum possible network securing options for a given attack graph in an automated fashion. The identified network securing options are exhaustive and the proposed approach aims at detecting cycles in forward reachable attack graphs. As a whole, the chapter deals with identification of probable attack path and risk mitigation which may facilitate in improving the overall security of an enterprise network.

Attack graph plays an important role in network security, as it directly shows the existence of vulnerabilities in network and how attackers use these vulnerabilities to implement an effective attack, the analysis on the attack graph or the simulation of dynamic attacks through attack graph can help us easily find out the vulnerabilities in network, and take corresponding security measures, in order to strengthen network security. Previous attack graph generation methods are generally not suitable for large network, because of their high complexity of time, high consumption of space, and the large scale of attack graphs. Based on substantive analysis of the vulnerabilities in network, this paper describes a model for automatically generating and analyzing network attack graph. Besides, a prototype system bases on this model has been designed. At last, this prototype system was tested by a model network we built, and it was proved to be simple, flexible, and efficient.

The network security assessment is vital for improving the overall security posture. With diverse opportunities for using networking devices and configuring them, varying software application portfolios, and the increased flexibility of using numerous applications, today's computer networks are subject to continuous evolution. Such ever-growing computer networks in size and complexity lead to information exposure to an increased threat landscape and attack surface variation. The network attack surface constitutes exploitable technical vulnerabilities, software/hardware misconfigurations (i.e., configuration gaps), vulnerable service connectivities, and service-cum-user privileges. An adversary may exploit the network attack surface to penetrate the enterprise networks incrementally. The discovery of new vulnerabilities and vague access control rules can further set off the attack surface variation. Hence, it is essential to consider the temporal aspect of network security. Attack graph, a graphical network security modeling tool, succinctly captures the attack surface of a vulnerable network in the form of initial security conditions, much needed for an adversary for successful incremental network penetration. Existing attack graph-based metrics are inadequate in capturing the variation in the attack surface. We propose to use a Boolean similarity metric to assess the similarity between the goal-oriented attack graphs generated successively for an enterprise network within the chosen sampling interval. We represent individual attack graphs as a Boolean expression to serve our purpose. A Boolean expression is a sum-of-product expression, i.e., a disjunction of attack paths, each a conjunction of initial conditions. We have conducted a set of experiments to validate the efficacy and applicability of the Boolean similarity metric. The results indicate that the Boolean similarity measure can detect the variation in the network attack surface.

This paper focuses on D2D communication for 5G/6G in dynamic environments where the D2D network topology changes through time due to D2D Devices’ mobility. Specifically, we consider a scenario within the coverage area of a Base Station (BS) serving a number of User Devices (UEs), with variations in speed and direction causing changes in the D2D network topology, either via direct connections or via D2D single-hop or D2D Multi-hop paths. Based on this scenario, we formulate a problem aiming to maximise the total Spectral Efficiency (SE) whilst minimising the total Power Consumption (PC), by selecting the best transmission mode that the D2D devices will operate. In order to address the aforementioned problem, the Distributed Artificial Intelligence Solution (DAIS) plan proposed in our earlier work and designed for static environments is extended to consider the mobility (i.e., speed, direction and indirectly link distance change) of the D2D Device, targeting the dynamic creation of stable and efficient clusters and good backhauling links towards the gateway. The enhanced DAIS performance is comparatively evaluated in terms of SE and PC against selected variations in UE speed and direction, changes in the link Transmission Power (TP), and an increase in the number of Devices in the D2D network. Overall, the results obtained demonstrated superior performance of enhanced DAIS over all the other related investigated approaches (i.e., Distributed Sum Rate (DSR), Single Hop Relay Approach (SHRA), Distributed Random (DR)), in terms of Spectral Efficiency (SE) and Power Consumption (PC). Also, the ability of enhanced DAIS to react and adapt quickly and efficiently to D2D network topology changes, with reduced signalling overhead and control delay in responding to changes, shows that it is a well-poised approach to be used in a Dynamic D2D Environment.

Wireless Ad Hoc network routing algorithm is one of the core technologies of wireless Ad Hoc networks. Ad Hoc network is dynamic topology on characteristic, mainly reflected on the network node number and node movement, which lead to network topology changes, in order to study the Ad Hoc network size and topology changes influence on packet delivery, time delay and routing control, through experiment it is concluded that, the dynamic source routing protocol is an ideal choice.

Due to the high mobility and dynamic topology of the FANET network, maintaining communication links between UAVs is a challenging task. The topology of these networks is more dynamic than traditional mobile networks, which raises challenges for the routing protocol. The existing routing protocols for these networks partly fail to detect network topology changes. Few methods have recently been proposed to overcome this problem due to the rapid changes of network topology. We try to solve this problem by designing a new dynamic routing method for a group of UAVs using Hybrid SDN technology (SDN and a distributed routing protocol) with a highly dynamic topology. Comparison of the proposed method performance and two other algorithms is simulated. The simulation results show that the proposed method has better results than traditional algorithms in the package delivery ratio, average end to end delay, packet loss, throughput and normalized routing Load.

Due to the dynamic change of the opportunistic network topology and the lack of stable information transmission paths between nodes, the traditional topology-based routing algorithm cannot achieve the desired routing performance. To address of this problem, this paper proposes a routing algorithm based on trajectory prediction (RATP). The routing protocol based on trajectory prediction can efficiently and quickly adapt to the network link quality instability and the dynamic changes of network topology. RATP algorithm constructs a node mobility model by analyzing the historical mobility characteristics of the nodes. According to the node prediction information, the metric value of the candidate node is calculated, and the node with the smaller metric value is selected as the data forwarding node, which can effectively reduce the packet loss rate and avoids excessive consumption. Simulation results show that compared with other algorithms, the proposed algorithm has higher data delivery ratio, and end-to-end data delay and routing overhead are significantly reduced.

Choral singing requires the coordination of physiological subsystems within and across individuals. Previously, we suggested that the choir functions as a superordinate system that imposes boundary conditions on the dynamic features of the individual singers and found reliable differences in the network topography by analyzing within- and cross-frequency couplings (WFC and CFC, respectively). Here, we further refine our analyses to investigate hyper-frequency network (HFN) topology structures (i.e., the layout or arrangement of connections) using a graph-theoretical approach. In a sample of eleven singers and one conductor engaged in choral singing (aged between 23 and 56 years, and including five men and seven women), we calculated phase coupling (WFC and CFC) between respiratory, cardiac, and vocalizing subsystems across ten frequencies of interest. All these couplings were used for construction of HFN with nodes being a combination of frequency components and subsystems across choir participants. With regard to the network topology measures, we found that clustering coefficients (CCs) as well as local and global efficiency were highest and characteristic path lengths, correspondingly, were shortest when the choir sang a canon in parts as compared to singing it in unison. Furthermore, these metrics revealed a significant relationship to individual heart rate, as an indicator of arousal, and to an index of heart rate variability indicated by the LF/HF ratio (low and high frequency, respectively), and reflecting the balance between sympathetic and parasympathetic activity. In addition, we found that the CC and local efficiency for groups singing the same canon part were higher than for groups of singers constructed randomly post hoc, indicating stronger neighbor–neighbor connections in the former. We conclude that network topology dynamics are a crucial determinant of group behavior and may represent a potent biomarker for social interaction.

Routing in Vehicular Ad hoc Networks (VANET) is a bit complicated because of the nature of the high dynamic mobility. The efficiency of routing protocol is influenced by a number of factors such as network density, bandwidth constraints, traffic load, and mobility patterns resulting in frequency changes in network topology. Therefore, Quality of Service (QoS) is strongly needed to enhance the capability of the routing protocol and improve the overall network performance. In this paper, we introduce a statistical framework model to address the problem of optimizing routing configuration parameters in Vehicle-to-Vehicle (V2V) communication. Our framework solution is based on the utilization of the network resources to further reflect the current state of the network and to balance the trade-off between frequent changes in network topology and the QoS requirements. It consists of three stages: simulation network stage used to execute different urban scenarios, the function stage used as a competitive approach to aggregate the weighted cost of the factors in a single value, and optimization stage used to evaluate the communication cost and to obtain the optimal configuration based on the competitive cost. The simulation results show significant performance improvement in terms of the Packet Delivery Ratio (PDR), Normalized Routing Load (NRL), Packet loss (PL), and End-to-End Delay (E2ED).

Jamming attacks and unintentional radio interference are one of the most urgent threats harming the dependability of wireless communication and endangering the successful deployment of pervasive applications built on top of wireless networks. Unlike the traditional approaches focusing on developing jamming defense techniques without considering the location of jammers, we take a different viewpoint that the jammers' position should be identified and exploited for building a wide range of defense strategies to alleviate jamming. In this paper, we address the problem of localizing multiple jamming attackers coexisting in wireless networks by leveraging the network topology changes caused by jamming. We systematically analyze the jamming effects and develop a framework that can partition network topology into clusters and can successfully estimate the positions of multiple jammers even when their jamming areas are overlapping. Our experiments on a multi-hop network setup using MicaZ sensor nodes validate the feasibility of real-time collection of network topology changes under jamming and our extensive simulation results demonstrate that our approach is highly effective in localizing multiple attackers with or without the prior knowledge of the order that the jammers are turned on.

In recent years, the static shortest path (SP) problem has been well addressed using intelligent optimization techniques, e.g., artificial neural networks, genetic algorithms (GAs), particle swarm optimization, etc. However, with the advancement in wireless communications, more and more mobile wireless networks appear, e.g., mobile networks [mobile <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">ad hoc</i> networks (MANETs)], wireless sensor networks, etc. One of the most important characteristics in mobile wireless networks is the topology dynamics, i.e., the network topology changes over time due to energy conservation or node mobility. Therefore, the SP routing problem in MANETs turns out to be a dynamic optimization problem. In this paper, we propose to use GAs with immigrants and memory schemes to solve the dynamic SP routing problem in MANETs. We consider MANETs as target systems because they represent new-generation wireless networks. The experimental results show that these immigrants and memory-based GAs can quickly adapt to environmental changes (i.e., the network topology changes) and produce high-quality solutions after each change.

Wireless sensor networks are widely applied in various applications. But due to the resource-constrained sensor nodes and the malicious attacks, the traditional key management schemes are not suitable for the network. Based on the particularities, many relevant key management schemes are developed for wireless sensor networks. This paper proposes an improved matrix key-distribution scheme for wireless sensor networks. This scheme can delete and update key information with the network topology changes to avoid key information to be revealed. Also, base on the clustered structure, this scheme can reduce communication, computation and key storage overhead, which can solve the problem that each sensor node has limited resource. Comparison and simulation results show that the proposed scheme can perform better than most of the existing key management schemes in the network security, key storage overhead.

The significant expansion in network size to support new paradigms such as cloud computing, IoT (Internet of Things), etc. together with the exponential increase in vulnerabilities has challenged the existing security mechanisms greatly. These challenges have opened many avenues for research in network security. However, while attack graphs play an important role in analyzing vulnerabilities, analyzing large attack graphs itself is a major issue. Therefore, it is necessary to extract only the critical part of the attack graph. Although technologies have been developed for attack path characterization, there is a lack of hybrid technology that can differentiate between similar behavior attack paths. We have proposed a cost-based path characterization technique that takes the attack node's vulnerability complexity into account and significantly reduces the number of vulnerabilities that need to be patched to avoid the major segment of attack graph. Moreover, we have used a real network prototype to validate the performance of the proposed scheme. The proposed scheme works well in cases where some vulnerabilities have similar risk scores. To the best of our knowledge, this is the first time that a cost-effective approach for attack path analysis has been proposed.

In view of the characteristics of large-scale, coordinated and multi-stage network attacks, a network security situation assessment method based on attack Graph model was proposed. Firstly, the network attack behavior characteristics are constructed by integrating the spatio-temporal characteristics of attack events and multi-source alarm data. Secondly, attack nodes are mapped based on alarm information to associate multi-step attack paths. Thirdly, on the basis of constructing the attack Graph, the transfer probability table of attack nodes is constructed combining with the transfer sequence, and the transfer probability is introduced into the attack graph to infer the attack intention of the attacker. Finally, according to the maximum possible attack path, the security situation of attack nodes with high probability is evaluated, and the security situation of potential attack nodes after network attack is scientifically quantified, providing theoretical support and scientific basis for network security management personnel to do a good job of protection in advance.