Toward measuring network security using attack graphs

In measuring the overall security of a network, a crucial issue is to correctly compose the measure of individual components. Incorrect compositions may lead to misleading results. For example, a network with less vulnerabilities or a more diversified configuration is not necessarily more secure. To obtain correct compositions of individual measures, we need to first understand the interplay between network components. For example, how vulnerabilities can be combined by attackers in advancing an intrusion. Such an understanding becomes possible with recent advances in modeling network security using attack graphs. Based on our experiences with attack graph analysis, we propose an integrated framework for measuring various aspects of network security. We first outline our principles and methodologies. We then describe concrete examples to build intuitions. Finally, we present our formal framework. It is our belief that metrics developed based on the proposed framework will lead to ...

• Type: Conference
• Year: 2007
• Where: CCS
• Authors: Lingyu Wang, Anoop Singhal, Sushil Jajodia
• Keywords: Attack Graph, Attack Graph Analysis, CCS 2007, Network Security, Security Privacy