Network Vulnerability Analysis Using a Constrained Graph Data Model

An attack graph models the causal relationships between vulnerabilities. Attack graphs have important applications in protecting critical resources in networks against sophisticated multi-step intrusions. Currently, analyses of attack graphs largely depend on proprietary implementations of specialized algorithms. However, developing and implementing algorithms causes a delay to the availability of new analyses. The delay is usually unacceptable due to rapidly-changing needs in defending against network intrusions. An administrator may want to revise an analysis as soon as its outcome is observed. Such an interactive analysis, similar to that in decision support systems, is desirable but difficult with current approaches based on proprietary implementations of algorithms. This paper addresses the above issue through a relational approach. Specifically, we devise a relational model for representing necessary inputs, such as network configurations and domain knowledge, and we generate attack graphs from these inputs as relational views. We show that typical analyses can be supported through different type of searches in an attack graph, and these searches can be realized as relational queries. Our approach eliminates the needs for implementing algorithms, because an analysis is now simply a relational query. The interactive analysis of attack graphs becomes possible, since relational queries can be dynamically constructed and revised at run time. As a side effect, experimental results show that the mature optimization techniques in relational databases can transparently improve the performance of the analysis.

Attack graphs are important tools for analyzing security vulnerabilities in enterprise networks. Previous work on attack graphs has not provided an account of the scalability of the graph generating process, and there is often a lack of logical formalism in the representation of attack graphs, which results in the attack graph being difficult to use and understand by human beings. Pioneer work by Sheyner, et al. is the first attack-graph tool based on formal logical techniques, namely model-checking. However, when applied to moderate-sized networks, Sheyner's tool encountered a significant exponential explosion problem. This paper describes a new approach to represent and generate attack graphs. We propose logical attack graphs, which directly illustrate logical dependencies among attack goals and configuration information. A logical attack graph always has size polynomial to the network being analyzed. Our attack graph generation tool builds upon MulVAL, a network security analyzer based on logical programming. We demonstrate how to produce a derivation trace in the MulVAL logic-programming engine, and how to use the trace to generate a logical attack graph in quadratic time. We show experimental evidence that our logical attack graph generation algorithm is very efficient. We have generated logical attack graphs for fully connected networks of 1000 machines using a Pentium 4 CPU with 1GB of RAM.

As computer networks continue to grow, it becomes increasingly more important to automate the process of evaluating their vulnerability to attacks. Despite the best efforts of software architects and developers, network hosts inevitably contain a number of vulnerabilities. Hence, it is not feasible for a network administrator to remove all vulnerabilities present in the network hosts. Therefore, the recent focus in security of such networks is on analysis of vulnerabilities globally, finding exploits that are more critical, and preventing them to thwart an intruder. When evaluating the security of a network, it is rarely enough to consider the presence or absence of isolated vulnerabilities. This is because intruders often combine exploits against multiple vulnerabilities in order to reach their goals (Abadi & Jalili, 2005). For example, an intruder might exploit the vulnerability of a particular version of FTP to overwrite the .rhosts file on a victim host. In the next step, the intruder could remotely log in to the victim. In a subsequent step, the intruder could use the victim host as a base to launch another exploit on a new victim, and so on. (Phillips & Swiler, 1998) proposed the concept of attack graphs, where each node represents a possible attack state. Edges represent a change of state caused by a single action taken by the intruder. (Sheyner et al., 2002) used a modified version of the model checker NuSMV (NuSMV, 2010) to produce attack graphs. (Ammann et al., 2002) introduced a monotonicity assumption and used it to develop a polynomial algorithm to encode all of the edges in an attack graph without actually computing the graph itself. These attack graphs are essentially similar to (Phillips & Swiler, 1998), where any path in the graph from an initial node to a goal node shows a sequence of exploits that an intruder can launch to reach his goal. (Noel et al., 2005) presented a number of techniques for managing attack graph complexity through visualization. (Mehta et al., 2006) presented a ranking scheme for the nodes of an attack graph. Rank of a node shows its importance based on factors like the probability of an intruder reaching that node. Given a ranked attack graph, the system administrator can concentrate on relevant subgraphs to figure out how to start deploying security measures. (Ou et al., 2006) presented logical attack graphs, which directly illustrate logical dependencies among attack goals and configuration information. Their attack graph generation tool builds upon MulVAL (Ou et al., 2005), a network security analyzer based on logical programming. The aim of minimization analysis of network attack graphs is to find a minimum critical set of exploits that completely disconnect the initial nodes and the goal nodes of the graph.

Attack graph is an essential tool for the security assessment of industrial Internet systems. Unfortunately, the traditional attack graph mainly focuses on discrete information and cannot handle continuous information such as temperature and humidity. These continuous data represent the states of the industrial Internet and are also indicators of attacks, which should be included in the attack graph. To this end, this paper presents a hybrid attack graph model, which can simultaneously describe the discrete and continuous information of the system. Based on the hybrid attack graph model, a security analysis method is presented. Firstly, the transformation rule from hybrid attack graph to timed automata is established. Secondly, the security attribute of the system is described by sequential logic of continuous interval, and then the model checker TACK is used to complete the analysis of the system. Finally, an example is analyzed and verified by a smart home system to illustrate the method’s effectiveness. The method in this paper provides a new idea for attack graph construction and analysis for industrial Internet systems.

An attack graph is a succinct representation of all paths through a system that end in a state where an intruder has successfully achieved his goal. Today Red Teams determine the vulnerability of networked systems by drawing gigantic attack graphs by hand. Constructing attack graphs by hand is tedious, error-prone, and impractical for large systems. By viewing an attack as a violation of a safety property, we can use off-the-shelf model checking technology to produce attack graphs automatically: a successful path from the intruder's viewpoint is a counterexample produced by the model checker In this paper we present an algorithm for generating attack graphs using model checking as a subroutine. Security analysts use attack graphs for detection, defense and forensics. In this paper we present a minimization analysis technique that allows analysts to decide which minimal set of security measures would guarantee the safety of the system. We provide a formal characterization of this problem: we prove that it is polynomially equivalent to the minimum hitting set problem and we present a greedy algorithm with provable bounds. We also present a reliability analysis technique that allows analysts to perform a simple cost-benefit trade-off depending on the likelihoods of attacks. By interpreting attack graphs as Markov Decision Processes we can use the value iteration algorithm to compute the probabilities of intruder success for each attack the graph.

As networks continue to grow in size and complexity, automatic assessment of the security vulnerability becomes increasingly important. The typical means by which an attacker breaks into a network is through a series of exploits, where each exploit in the series satisfies the pre-condition for subsequent exploits and makes a causal relationship among them. Such a series of exploits constitutes an attack path where the set of all possible attack paths form an attack graph. Attack graphs reveal the threat by enumerating all possible sequences of exploits that can be followed to compromise a given critical resource. The contribution of this chapter is to identify the most probable attack path based on the attack surface measures of the individual hosts for a given network and also identify the minimum possible network securing options for a given attack graph in an automated fashion. The identified network securing options are exhaustive and the proposed approach aims at detecting cycles in forward reachable attack graphs. As a whole, the chapter deals with identification of probable attack path and risk mitigation which may facilitate in improving the overall security of an enterprise network.

In this research, we designed a universal graph model. We targeted this work on improving graph data organization representation, flexible formation of graph substructures for complex system modeling and generic processing of data organization. We form coherently composed graph modeling features including inheritance hierarchy of basic graph types, data participating graphs of multiple aspects, hierarchically composed and connected graphs, and property-based graph models based on existing graph models. Design cases are used to illustrate its achievement of our design goal. Keywords—graph theory; graph model, multi-aspect graph; hierarchical graph I. INTRODUCTION Computer modeling plays a key role to apply computer's capability in various fields of applications. Effective support of computer modeling should consist of data representation capability, data access and navigation capability, and generic operations for forming more general and reusable generic algorithms. As computer applications keep growing complex in wider areas, we need enhanced computer models capable of supporting these applications. Graph data models are one of the most extensively used discrete mathematical models in computer modeling of various applications from VLSI circuit design, computer system design and modeling, network modeling, etc. Traditional graph libraries such as LEDA(1), Boost Graph Library(2), LINK(3), and GraphStream(4) focuses on single- level directed and undirected graph modeling. Lee's work(5) utilized decorator and visitor patterns to add new vertex data and attach processing during graph traversal. Pizzonia's (6) employed static object-oriented extension of graph property classes associated with corresponding graph operations. Bertault(7) employed an extensible graph property class hierarchy and dynamic property checking. Directed and undirected hypergraphs are not supported in these approaches. Hyperedges in hypergraphs can be represented as vertices in ordinary graphs. Hypergraphs cannot be treated as super types of directed and undirected graphs to support generic algorithms with ordinary graphs. On data organization point of view, these approaches provide various graph organization types but only as single- level specialized graph type. Each of them should be utilized distinctly. Once these graph models need to be combined in a complex data model, designers should add artificial data structures to join them together. Still, such combined data model or its selected subparts cannot be viewed and utilized as if in a single graph model. This requires designers to add more application-specific gluing data structures, processing codes of distinct graph substructures and their gluing logic, and semantically similar but redundant non-generic codes. It thus hinders effective development and reuse of computer models for various complex applications. From our literature survey, we did not find any previous work providing combinational features for flexibly composing graph structures. Our design goal lies in three improvement directions, representation of complex system data organization, flexible formation of graph substructures for processing, and generic processing of data organization as well as individual data. Our main approach is to form coherently composed graph modeling features including inheritance hierarchy of basic graph types, vertex data participating in graphs of multiple aspects, hierarchically composed and connected graphs, and property-based graph models based on existing graph models. It forms a universal graph model of combinations of complex graph-oriented data organizations, flexibly forms various virtual graph substructures for complex system modeling and processing, and support generic processing capability at the graph structure levels and at the leaf data levels. In section 2, we describe refined design goals and the approach of our work. In the following sections, we in sequence introduce planned composed graph modeling features of our universal graph model, including generic accesses among basic graph models, joining multiple graphs into a multi-aspect graph model, generic structuring of graph models, and generic accesses of property-based graph models. In section 7, we introduce its software design and a design case. The last section concludes this research.

In view of the characteristics of large-scale, coordinated and multi-stage network attacks, a network security situation assessment method based on attack Graph model was proposed. Firstly, the network attack behavior characteristics are constructed by integrating the spatio-temporal characteristics of attack events and multi-source alarm data. Secondly, attack nodes are mapped based on alarm information to associate multi-step attack paths. Thirdly, on the basis of constructing the attack Graph, the transfer probability table of attack nodes is constructed combining with the transfer sequence, and the transfer probability is introduced into the attack graph to infer the attack intention of the attacker. Finally, according to the maximum possible attack path, the security situation of attack nodes with high probability is evaluated, and the security situation of potential attack nodes after network attack is scientifically quantified, providing theoretical support and scientific basis for network security management personnel to do a good job of protection in advance.

Attack graphs are important tools for analyzing network security vulnerabilities. Recently, the generation method of attack graphs is a hot topic to the security researchers. As previous works encounter the scalability problem and inaccurate input information problem, we propose a novel method to automatic construction of attack graphs based on probability. After introducing prior-probability, match-probability,and transition-probability into attack graphs generation process, we develop a new attack model and relevant generation algorithms. Our method uses threshold and key states to control the scale of result attack graphs with important attack paths reserved. The following experiments show our approach could get meaningful results with less time and space, especially when one wants to get a few shortest attack paths quickly.

Against the background of the construction of new power systems, power generation, transmission, distribution, and dispatching services are open to the outside world for interaction, and the accessibility of attack paths has been significantly enhanced. We are facing cyber-physical cross-domain attacks with the characteristics of strong targeting, high concealment, and cross-space threats. This paper proposes a quantitative analysis method for the influence of power cyber-physical cross-domain attack paths based on graph knowledge. First, a layered attack graph was constructed based on the cross-space and strong coupling characteristics of the power cyber-physical system business and the vertical architecture of network security protection focusing on border protection. The attack graph included cyber-physical cross-domain attacks, control master stations, measurement and control equipment failures, transient stable node disturbances, and other vertices, and achieved a comprehensive depiction of the attack path. Second, the out-degree, in-degree, vertex betweenness, etc., of each vertex in the attack graph were comprehensively considered to calculate the vertex vulnerability, and by defining the cyber-physical coupling degree and edge weights, the risk of each attack path was analyzed in detail. Finally, the IEEE RTS79 and RTS96 node systems were selected, and the impact of risk conduction on the cascading failures of the physical space system under typical attack paths was analyzed using examples, verifying the effectiveness of the proposed method.

The identification and analysis of potential paths that an adversary may exploit to attack Cyber Physical Systems comprising sub-systems enables the comprehensive understanding of the attacks and the impact that may have to the overall system, thus facilitating the definition of appropriate countermeasures that will satisfy the pertinent security requirements. To this end, several attack modelling techniques can be employed, the attack graph being the most prevalent among them. Unfortunately, the discovery and analysis of all possible attack paths in an attack graph is not possible in systems even of a moderate size. In this work we propose a novel systematic method for discovering and analyzing attack paths in real-world scale interconnected Cyber Physical Systems. The method considers the criticality of each sub-system in discovering paths and the risk to the overall system that each path presents to analyze and prioritize paths. We illustrate the workings of the method by applying to the navigational Cyber Physical Systems of the Cyber-Enabled Ship to identify and analyze highly critical attack paths originating from the Automatic Identification System (AIS) and targeting the Autonomous Navigation System (ANS).

Attack graph is a general paradigm to model the weakness of an information system network and all possible attack sequences that attackers can obtain specific targets. In real systems, a vast majority of attack graph generation methods suffer from the states explosion issue. However, if we can predict which attack actions will own the maximum probability to be exploited by intruders precisely, namely finding the optimal attack path, we can solve this problem. In this paper, we propose an attack graph generation algorithm based on supervised Kohonen neural network. Using this method, we can presage the attack success rate and attack status types which would be attained if attackers successfully exploit vulnerabilities. Based on these results and the network topology, a probabilistic matrix and an optimal atomic attack matrix are proposed by us. Finally, the two matrices can be effectively used to generate the optimal attack path. After modeling the optimal path, the core nodes in the target network can be located, and network administrators can enact a series of effective defense strategies according to them.

: Report developed under SBIR contract for Topic No. N03-T010. In an ideal world, system and network administrators would keep all of their systems fully patched all the time. Unfortunately, for a variety of reasons few sites have the luxury of such an approach. Given that administrators cannot apply all possible countermeasures (e.g., patches), our next best strategy is to identify an ordering of countermeasures that will provide the optimal level of security for a given amount of changes to the network. One of the primary approaches to identify this optimized ordering is through attack graph analysis, and this approach has received considerable attention recently. Unfortunately, there are a number of critical problems with this strategy. This paper presents an approach that takes advantage of simple filtering capabilities in commodity routers that partially addresses the limitation of the attack graph strategy. Furthermore, in at least one problem, dealing with unknown vulnerabilities, the simple strategy presented in this paper can produce better results than the attack graph approach.

Smart infrastructure integrates cyberphysical systems, self-organizing networks of devices, fog computing to enhance the quality and convenience of manufacturing and social life, providing efficient resource management and increasing productivity and availability of traditional services. New technologies are characterized with a high degree of heterogeneity, structural complexity, and dynamic topology that result in a large number of new information and cyber security threats. Given a high degree of integration of digital cyber space into the processes of management, monitoring, aggregation, and data transferring, an assessment of its security level is a necessary requirement to maintain and control a safe and reliable environment for handling data and performing physical processes. Risk analysis and assessment is an extremely important task at all stages of the life cycle of subsystems and components of the smart environment. It allows us to assess a level of protection, identify vulnerable assets, and counteract the most likely directions of security threats. The known methods for security risk assessment do not consider the features of modern smart technologies, and this forces us to search for new approaches. This paper proposes a comprehensive method that includes a calculation of security indicators, risk assessment and selection of protective measures, based on attack graphs and thus allows us to consider the dynamics of changes in the components of the smart infrastructure. The automated system for assessing the security risks in the smart infrastructure and choosing the protective measures has been implemented.

Attack graph plays an important role in network security, as it directly shows the existence of vulnerabilities in network and how attackers use these vulnerabilities to implement an effective attack, the analysis on the attack graph or the simulation of dynamic attacks through attack graph can help us easily find out the vulnerabilities in network, and take corresponding security measures, in order to strengthen network security. Previous attack graph generation methods are generally not suitable for large network, because of their high complexity of time, high consumption of space, and the large scale of attack graphs. Based on substantive analysis of the vulnerabilities in network, this paper describes a model for automatically generating and analyzing network attack graph. Besides, a prototype system bases on this model has been designed. At last, this prototype system was tested by a model network we built, and it was proved to be simple, flexible, and efficient.