Network Security Situation Assessment Methods and Tactics Based on Multivariate Spatiotemporal Attack Graph Model

In the context of cloud computing, network attackers usually exhibit complex, dynamic, and diverse behavior characteristics. Existing research methods, such as Bayesian attack graphs, lack evidence correlation and real-time reflection of the network attack events, and high computational complexity for attack analysis. To solve these problems, this study proposes a Dynamic Uncertain Causal Attack Graph (DUCAG) model and a Causal Chain-based Risk Probability Calculation (CCRP) algorithm. The DUCAG model is constructed to represent the uncertain underlying causalities among network attack events, and the CCRP algorithm aims at dynamically updating the causality weights among different network attack events and attacker hypotheses based on alarm information and causal chain reasoning process. By causality simplification and causality reasoning methods, the CCRP efficiently predicts the attacker behaviors and potential attack likelihood under uncertain time-varying attack situations, and is robust to the incompleteness and redundancy in alarm information. Four experiments under different attack scenarios demonstrate that, the DUCAG model can effectively characterize and predict the complex and uncertain attack causalities, in a manner of high time efficiency. The proposed method has application significance on cloud computing platforms by dynamically evaluating network security status, predicting the future behaviors of attackers, and assisting in adjusting network defense strategies.

The significant expansion in network size to support new paradigms such as cloud computing, IoT (Internet of Things), etc. together with the exponential increase in vulnerabilities has challenged the existing security mechanisms greatly. These challenges have opened many avenues for research in network security. However, while attack graphs play an important role in analyzing vulnerabilities, analyzing large attack graphs itself is a major issue. Therefore, it is necessary to extract only the critical part of the attack graph. Although technologies have been developed for attack path characterization, there is a lack of hybrid technology that can differentiate between similar behavior attack paths. We have proposed a cost-based path characterization technique that takes the attack node's vulnerability complexity into account and significantly reduces the number of vulnerabilities that need to be patched to avoid the major segment of attack graph. Moreover, we have used a real network prototype to validate the performance of the proposed scheme. The proposed scheme works well in cases where some vulnerabilities have similar risk scores. To the best of our knowledge, this is the first time that a cost-effective approach for attack path analysis has been proposed.

As networks continue to grow in size and complexity, automatic assessment of the security vulnerability becomes increasingly important. The typical means by which an attacker breaks into a network is through a series of exploits, where each exploit in the series satisfies the pre-condition for subsequent exploits and makes a causal relationship among them. Such a series of exploits constitutes an attack path where the set of all possible attack paths form an attack graph. Attack graphs reveal the threat by enumerating all possible sequences of exploits that can be followed to compromise a given critical resource. The contribution of this chapter is to identify the most probable attack path based on the attack surface measures of the individual hosts for a given network and also identify the minimum possible network securing options for a given attack graph in an automated fashion. The identified network securing options are exhaustive and the proposed approach aims at detecting cycles in forward reachable attack graphs. As a whole, the chapter deals with identification of probable attack path and risk mitigation which may facilitate in improving the overall security of an enterprise network.

In order to evaluate the network security risks and implement effective defenses in industrial control system, a risk assessment method for industrial control systems based on attack graphs is proposed. Use the concept of network security elements to translate network attacks into network state migration problems and build an industrial control network attack graph model. In view of the current subjective evaluation of expert experience, the atomic attack probability assignment method and the CVSS evaluation system were introduced to evaluate the security status of the industrial control system. Finally, taking the centralized control system of the thermal power plant as the experimental background, the case analysis is performed. The experimental results show that the method can comprehensively analyze the potential safety hazards in the industrial control system and provide basis for the safety management personnel to take effective defense measures.

Attack graphs are the graphs which describe attack scenarios, play important roles in analyzing network threats. These attack graphs are able to reveal such potential threats by evaluating the all possible sequences that an attacker can follow to compromise given critical resources or nodes. An Attack graph specifies an attack scenario that results in compromising network values. There are so many methods proposed to evaluate the network security in attack graphs. But no method specifies the overhead occurred due to the evaluation of network security at each and every node. This paper addresses the problem of overhead occurred due to the network security evaluation in Short-Normalizedattack graphs by evaluating a factor called network security risk. In this paper first the possible n valid attack paths are going to be calculated and then the security risk is going to be calculated for those n valid paths. This security risk denotes the amount of overhead occurred due to this evaluation.

As computer networks continue to grow, it becomes increasingly more important to automate the process of evaluating their vulnerability to attacks. Despite the best efforts of software architects and developers, network hosts inevitably contain a number of vulnerabilities. Hence, it is not feasible for a network administrator to remove all vulnerabilities present in the network hosts. Therefore, the recent focus in security of such networks is on analysis of vulnerabilities globally, finding exploits that are more critical, and preventing them to thwart an intruder. When evaluating the security of a network, it is rarely enough to consider the presence or absence of isolated vulnerabilities. This is because intruders often combine exploits against multiple vulnerabilities in order to reach their goals (Abadi & Jalili, 2005). For example, an intruder might exploit the vulnerability of a particular version of FTP to overwrite the .rhosts file on a victim host. In the next step, the intruder could remotely log in to the victim. In a subsequent step, the intruder could use the victim host as a base to launch another exploit on a new victim, and so on. (Phillips & Swiler, 1998) proposed the concept of attack graphs, where each node represents a possible attack state. Edges represent a change of state caused by a single action taken by the intruder. (Sheyner et al., 2002) used a modified version of the model checker NuSMV (NuSMV, 2010) to produce attack graphs. (Ammann et al., 2002) introduced a monotonicity assumption and used it to develop a polynomial algorithm to encode all of the edges in an attack graph without actually computing the graph itself. These attack graphs are essentially similar to (Phillips & Swiler, 1998), where any path in the graph from an initial node to a goal node shows a sequence of exploits that an intruder can launch to reach his goal. (Noel et al., 2005) presented a number of techniques for managing attack graph complexity through visualization. (Mehta et al., 2006) presented a ranking scheme for the nodes of an attack graph. Rank of a node shows its importance based on factors like the probability of an intruder reaching that node. Given a ranked attack graph, the system administrator can concentrate on relevant subgraphs to figure out how to start deploying security measures. (Ou et al., 2006) presented logical attack graphs, which directly illustrate logical dependencies among attack goals and configuration information. Their attack graph generation tool builds upon MulVAL (Ou et al., 2005), a network security analyzer based on logical programming. The aim of minimization analysis of network attack graphs is to find a minimum critical set of exploits that completely disconnect the initial nodes and the goal nodes of the graph.

Attack Graphs have been widely used by the network security administrators to gain an understanding of possible attack paths, an attacker may follow to compromise critical resources. As networks get larger and more complex, one needs to use databases to perform iterative, interactive analysis tasks with attack graphs. In this paper we investigate how property graph based graph databases like Neo4j can be effectively used towards this application. We show that extending the standard property graph model with a constraint specification mechanism aids attack graph modeling and interactive analytics. We briefly sketch a preliminary attempt to implement a constraint layer over Neo4j and show how attack graph generation and analysis can be performed faithfully in Neo4j using the extended model.

Against the background of the construction of new power systems, power generation, transmission, distribution, and dispatching services are open to the outside world for interaction, and the accessibility of attack paths has been significantly enhanced. We are facing cyber-physical cross-domain attacks with the characteristics of strong targeting, high concealment, and cross-space threats. This paper proposes a quantitative analysis method for the influence of power cyber-physical cross-domain attack paths based on graph knowledge. First, a layered attack graph was constructed based on the cross-space and strong coupling characteristics of the power cyber-physical system business and the vertical architecture of network security protection focusing on border protection. The attack graph included cyber-physical cross-domain attacks, control master stations, measurement and control equipment failures, transient stable node disturbances, and other vertices, and achieved a comprehensive depiction of the attack path. Second, the out-degree, in-degree, vertex betweenness, etc., of each vertex in the attack graph were comprehensively considered to calculate the vertex vulnerability, and by defining the cyber-physical coupling degree and edge weights, the risk of each attack path was analyzed in detail. Finally, the IEEE RTS79 and RTS96 node systems were selected, and the impact of risk conduction on the cascading failures of the physical space system under typical attack paths was analyzed using examples, verifying the effectiveness of the proposed method.

Attack graphs are important tools for analyzing network security vulnerabilities. Recently, the generation method of attack graphs is a hot topic to the security researchers. As previous works encounter the scalability problem and inaccurate input information problem, we propose a novel method to automatic construction of attack graphs based on probability. After introducing prior-probability, match-probability,and transition-probability into attack graphs generation process, we develop a new attack model and relevant generation algorithms. Our method uses threshold and key states to control the scale of result attack graphs with important attack paths reserved. The following experiments show our approach could get meaningful results with less time and space, especially when one wants to get a few shortest attack paths quickly.

Vulnerabilities do enormous harm to personal computers. What is worse, with emergence of much more applications of computer networks nowadays, network security caused by vulnerabilities has become an important issue. And attacks turned more proficient, making it much more difficult to protect our computer networks. In view of the security issue of complex network, effective identification of attack paths contributes to network security defense a lot. In order to obtain the paths, attack graphs are used. And to construct it requires preconditions like vulnerabilities information, network configuration, and etc. In this paper, we present a simplified model to construct the attack paths. We discuss the construction of attack paths taking advantage of logic programming and corresponding preconditions generated by the logic rule and facts.

In order to discover the network vulnerability timely and solve the very serious problems of network security, this paper puts forward the attack graph which is based on intrusion detection method. The method uses the generation global network attack graph algorithm to build network initial attack graph, and call attack graph optimization algorithm to remove global attack graph unreasonable path, and achieve the goal of simply attack graph. Finally, management personnel get the basis which is computed nodes in each state attack graph algorithms degree of loss to optimize the network security. Experiments show that the intrusion detection method is reasonable and effective, and has the advantages of simple and easy.

Attack graph plays an important role in network security, as it directly shows the existence of vulnerabilities in network and how attackers use these vulnerabilities to implement an effective attack, the analysis on the attack graph or the simulation of dynamic attacks through attack graph can help us easily find out the vulnerabilities in network, and take corresponding security measures, in order to strengthen network security. Previous attack graph generation methods are generally not suitable for large network, because of their high complexity of time, high consumption of space, and the large scale of attack graphs. Based on substantive analysis of the vulnerabilities in network, this paper describes a model for automatically generating and analyzing network attack graph. Besides, a prototype system bases on this model has been designed. At last, this prototype system was tested by a model network we built, and it was proved to be simple, flexible, and efficient.

The network security assessment is vital for improving the overall security posture. With diverse opportunities for using networking devices and configuring them, varying software application portfolios, and the increased flexibility of using numerous applications, today's computer networks are subject to continuous evolution. Such ever-growing computer networks in size and complexity lead to information exposure to an increased threat landscape and attack surface variation. The network attack surface constitutes exploitable technical vulnerabilities, software/hardware misconfigurations (i.e., configuration gaps), vulnerable service connectivities, and service-cum-user privileges. An adversary may exploit the network attack surface to penetrate the enterprise networks incrementally. The discovery of new vulnerabilities and vague access control rules can further set off the attack surface variation. Hence, it is essential to consider the temporal aspect of network security. Attack graph, a graphical network security modeling tool, succinctly captures the attack surface of a vulnerable network in the form of initial security conditions, much needed for an adversary for successful incremental network penetration. Existing attack graph-based metrics are inadequate in capturing the variation in the attack surface. We propose to use a Boolean similarity metric to assess the similarity between the goal-oriented attack graphs generated successively for an enterprise network within the chosen sampling interval. We represent individual attack graphs as a Boolean expression to serve our purpose. A Boolean expression is a sum-of-product expression, i.e., a disjunction of attack paths, each a conjunction of initial conditions. We have conducted a set of experiments to validate the efficacy and applicability of the Boolean similarity metric. The results indicate that the Boolean similarity measure can detect the variation in the network attack surface.

Nowadays, networks are exposed to a set of risks and threats that can potentially cause damage and losses for companies. The security of networks must be assessed in order to measure the effectiveness of the protective measures that have been implemented. However, the impact of the dynamic behavior of these systems on the attacker's strategy is rarely considered. In this paper, we propose an attack graph-based solution that consider the evolution of system properties such as network topology changes, vulnerability discovery and patching, as well as attack detection and wiping of some system components. The topology of the attack graph evolves over time considering the evolution of the system state. Several simulations of the attacker infiltration in the system are performed by following the attack paths present in the attack graph in order to assess the security of the system. The proposed solution has been tested on a use case where a user is in remote work. By considering the changes in the network topology, new attack paths can be identified.

The identification and analysis of potential paths that an adversary may exploit to attack Cyber Physical Systems comprising sub-systems enables the comprehensive understanding of the attacks and the impact that may have to the overall system, thus facilitating the definition of appropriate countermeasures that will satisfy the pertinent security requirements. To this end, several attack modelling techniques can be employed, the attack graph being the most prevalent among them. Unfortunately, the discovery and analysis of all possible attack paths in an attack graph is not possible in systems even of a moderate size. In this work we propose a novel systematic method for discovering and analyzing attack paths in real-world scale interconnected Cyber Physical Systems. The method considers the criticality of each sub-system in discovering paths and the risk to the overall system that each path presents to analyze and prioritize paths. We illustrate the workings of the method by applying to the navigational Cyber Physical Systems of the Cyber-Enabled Ship to identify and analyze highly critical attack paths originating from the Automatic Identification System (AIS) and targeting the Autonomous Navigation System (ANS).