Abstract:Computer networks are inevitably attacked as a result of their openness, while network attack usually actualized by exploiting vulnerability existing in network environment. Attack graph, consisted of lots of related atomic attacks, can fully display the exploitation and dependence relations among all of the vulnerabilities existed in network. Thus, it is a very useful tool for network vulnerability analysis and network security evaluation. However, the prevalent Attacker's Ability Monotonic Assumption (AAMA) constraint for attack graph generation could not make full use of the direction of network attack and the hierarchy of defense. As a result, using AAMA to constraint the process of attack graph generation is not only inefficient but also couldn't reduce the complexity of attack graph, especially for large-scale complicated network. According to lots of experiment and theoretical analysis, we found that it is mainly the existence of Circuitous Attack Paths (CAP) in attack graph lead to it complexity and the low efficiency of generation. To address this problem, we proposed the concept of Network Security Gradient (NSG) to reflect the direction of the network attack and the hierarchy of defense, and the Gradient Attack Assumption (GAA) to constraint the process of attack graph generation for the purpose of avoiding CAPs. Testified by a case study, using the GAA to constraint the process of attack graph generation can destruct those circuitous attack paths, therefore, is an effective way to improve the efficiency of attack graph generation and reduce the complexity of attack graph, and make it more useful for vulnerability analysis and network security evaluation.

A Network Security Analysis Method Using Vulnerability Correlation.

A Network Security Analysis Method Based on Vulnerability Correlation

Optimization Method for Attack Graph Based on Vulnerability Exploit Correlation

A Mining Method for Computer Vulnerability Correlation

Research of Network Vulnerability Analysis Based on Attack Capability Transfer

Attack Graph-Based Method for Vulnerability Risk Evaluation

Computer Network System Security Assessment Method.

Complex Network Security Analysis Based on Attack Graph Model

Access Graph to Analyze Network Vulnerabilities

Research on Automatic Generation and Analysis Technology of Network Attack Graph

Generate attack graph for network security analysis

Novel Method of Evaluating Network Security Based on Attack Graphs

A New Perspective of Network Vulnerability Analysis Using Network Security Gradient.

Network Vulnerability Assessment Based on Knowledge Graph

A Component-Centric Access Graph Based Approach to Network Attack Analysis

An Effective Method To Generate Attack Graph

Study of Generating Attack Graph Based on Privilege Escalation for Computer Networks

A Software Vulnerability Detection Method Based on Complex Network Community

Vulnerability ranking based on exploitation and defense graph

An Adjacency Matrixes-Based Model for Network Security Analysis

VCPEC: Vulnerability Correlation Analysis Based on Privilege Escalation and Coritivity Theory.