Interactive Analysis of Attack Graphs Using Relational Queries

Abstract. Attack graph is important in defending against well-orchestrated network intrusions. However, the current analysis of attack graphs requires an algorithm to be developed and implemented, causing a delay in the availability of analysis. Such a delay is usually unacceptable because the needs for analyzing attack graphs may change rapidly in defending against network intrusions. An administrator may want to revise an analysis upon observing its outcome. Such an interactive analysis, similar to that in decision support systems, is difficult if at all possible with current approaches based on proprietary algorithms. This paper removes the above limitation and enables interactive analysis of attack graphs. We devise a relational model for representing necessary inputs including network configuration and domain knowledge. We generate the attack graph from those inputs as relational views. We then show that typical analyses of the attack graph can be realized as relational queries ag...

• Type: Conference
• Year: 2006
• Where: DBSEC
• Authors: Lingyu Wang, Chao Yao, Anoop Singhal, Sushil Jajodia
• Keywords: Attack Graphs, DBSEC 2006, DBSEC 2007, Interactive Analysis, Network Intrusions