Abstract:Selecting the optimal set of countermeasures is a challenging task that involves various considerations and tradeoffs such as prioritizing the risks to mitigate and costs. The vast majority of studies for selecting a countermeasure deployment are based on a limited risk assessment procedure that utilizes the common vulnerability scoring system (CVSS). Such a risk assessment procedure does not necessarily consider the prerequisites and exploitability of a specific asset, cannot distinguish insider from outsider threat actor, and does not express the consequences of exploiting a vulnerability as well as the attacker's lateral movements. Other studies applied a more extensive risk assessment procedure that relies on manual work and repeated assessment. These solutions however, do not consider the network topology and do not specify the optimal position for deploying the countermeasures, and therefore are less practical. In this paper we suggest a heuristic search approach for selecting the optimal countermeasure deployment under a given budget limitation. The proposed method expresses the risk of the system using an extended attack graph modeling, which considers the prerequisites and consequences of exploiting a vulnerability, examines the attacker's potential lateral movements, and express the physical network topology as well as vulnerabilities in network protocols. In addition, unlike previous studies which utilizes attack graph for countermeasure planning, the proposed methods does not require re-generating the attack graph at each stage of the procedure, which is computationally heavy, and therefore it provides a more accurate and practical countermeasure deployment planning process.

Dynamic Countermeasures Selection for Multi-Path Attacks

Selecting Combined Countermeasures for Multi-Attack Paths in Intrusion Response System

Cyber Protection for Malware Attack Resistance in Cyber-Physical Power Systems

Optimal Defense Resource Allocation Considering Nonlinear Attack Cost in Power Systems

Heuristic Approach Towards Countermeasure Selection using Attack Graphs

A Bi-Level Stochastic Model with Averse Risk and Hidden Information for Cyber-Network Interdiction

Optimal Patrol Strategies Against Attacker'S Persistent Attack With Multiple Resources

Constrained-Differential-Evolution-Based Stealthy Sparse Cyber-Attack and Countermeasure in an AC Smart Grid

Defense Optimization in Power Systems against False Data Injection Attacks

MAAC: Novel Alert Correlation Method To Detect Multi-step Attack

An Adaptive Defense Mechanism to Prevent Advanced Persistent Threats.

Cost-effective Moving Target Defense Against DDoS Attacks Using Trilateral Game and Multi-Objective Markov Decision Processes

Computing Effective Mixed Strategies for Protecting Targets in Large-Scale Critical Infrastructure Networks

Defender Policy Evaluation and Resource Allocation Using MITRE ATT&CK Evaluations Data

Multi-Dimensional Moving Target Defense Method Based on Adaptive Simulated Annealing Genetic Algorithm

A Partition Matching Method for Optimal Attack Path Analysis

Quantitative Assessment of General Cyber-Attack and Optimal Strategy-Selection Modelling in CPPS

Optimal Switching Attacks and Countermeasures in Cyber-Physical Systems.

Protection Issues for Supply Systems Involving Random Attacks

The Art of Manipulation: Threat of Multi-Step Manipulative Attacks in Security Games

Correlating Multi-Step Attack and Constructing Attack Scenarios Based on Attack Pattern Modeling