Abstract:Attack graphs play important roles in analyzing network security vulnerabilities, and previous works have provided meaningful conclusions on the generation and security measurement of attack graphs. However, it is still hard for us to understand attack graphs in a large network, and few suggestions have been proposed to prevent inside malicious attackers from attacking networks. To address these problems, we propose a novel approach to generate and describe attack graphs. Firstly, we construct a two-layer attack graph, where the upper layer is a hosts access graph and the lower layer is composed of some host-pair attack graphs. Compared with previous works, our attack graph has simpler structures, and reaches the best upper bound of computation cost in O(N2). Furthermore, we introduce the adjacency matrix to efficiently evaluate network security, with overall evaluation results presented by gray scale images vividly. Thirdly, by applying prospective damage and important weight factors on key hosts with crucial resources, we can create prioritized lists of potential threatening hosts and stepping stones, both of which can help network administrators to harden network security. Analysis on computation cost shows that the upper bound computation cost of our measurement methodology is O(N3), which could also be completed in real time. Finally, we give some examples to show how to put our methods in practice.

SSIRI 2009 Short Paper A New Method to Generate Attack Graphs

A New Method to Generate Attack Graphs

An Effective Method of Generating Attack Graphs

An Effective Method To Generate Attack Graph

Generate attack graph for network security analysis

Study on the method to generate network attack graphs

A Probability-Based Approach to Attack Graphs Generation

Evaluating Network Security With Two-Layer Attack Graphs

A Scalable Approach to Full Attack Graphs Generation

An Attack Graph Generation Method Based on Parallel Computing.

Attack Graph Generation with Implementation in Network Security

Attack Graph Generation based on Security Administrator Information

Two Scalable Approaches to Analyzing Network Security Using Compact Attack Graphs

Complex Network Security Analysis Based on Attack Graph Model

An Improved Approach to Access Graph Generation

Two Scalable Analyses of Compact Attack Graphs for Defending Network Security

A Component-Centric Access Graph Based Approach to Network Attack Analysis

Research on Automatic Generation and Analysis Technology of Network Attack Graph

Attack Grammar: A New Approach to Modeling and Analyzing Network Attack Sequences

A NETWORK SECURITY GRADE BASED ATTACK GRAPH GENERATION PARALLEL APPROACH

Generating Network Attack Graphs for Security Alert Correlation