Most of the current research in security analysis has been centered on identifying threats and vulnerabilities and providing suitable defense mechanisms to improve the robustness of the network and systems. While this approach is attractive, it provides limited insight into understanding the impact these attacks have on the overall security goals of the network and the system. Attack Graph as a model lends itself nicely to the analysis of the security state of a network. Most of the Attack graph based metrics proposed in the literature are one dimensional; however the research community has acknowledged the fact that security needs to be treated as a multidimensional concept. In this paper, we utilize stochastic modeling techniques using Attack graphs to define a complementary suite of quantitative metrics to aid the security engineer in visualizing the current as well as future security state of the network and optimizing the necessary steps to harden the enterprise network from external threats. We present experimental results from applying this model on a sample network to demonstrate the practicality of our approach.

/pdf/cyber-security-analytics-a-stochastic-model-for-security-1yj2fyij2e.pdf

Cyber Security Analytics: A Stochastic Model for Security Quantification Using Absorbing Markov Chains

In order to exploring the inherent rule of information security risk assessment development, based on information system or asset structure and operation status, a survey is proposed in which the common risk assessment methods are divided into four types: vulnerability identification and risk assessment, risk factors simulation and risk estimation, security situation assessment, the risk calculation based on business process analysis. The method on delving into the information system of the highest level structure--namely business process structure and change is advocated, on which business operating performance indicators are regarded as risk scale, so real-time and dynamically information security risk calculation is obtained. Finally, Based on an understanding of the information system structure and utilization, combined with feedback control theory, three levels of judgment is defined which positions information security risk assessment method status, and the information security risk assessment study on the return to the rule of non-linear system.

Survey of Information Security Risk Assessment

Security metrics serve as a powerful tool for organizations to understand the effectiveness of protecting computer networks. However majority of these measurement techniques don’t adequately help corporations to make informed risk management decisions. In this paper we present a stochastic security framework for obtaining quantitative measures of security by taking into account the dynamic attributes associated with vulnerabilities that can change over time. Our model is novel as existing research in attack graph analysis do not consider the temporal aspects associated with the vulnerabilities, such as the availability of exploits and patches which can affect the overall network security based on how the vulnerabilities are interconnected and leveraged to compromise the system. In order to have a more realistic representation of how the security state of the network would vary over time, a nonhomogeneous model is developed which incorporates a time dependent covariate, namely the vulnerability age. The daily transition-probability matrices are estimated using Frei's Vulnerability Lifecycle model. We also leverage the trusted CVSS metric domain to analyze how the total exploitability and impact measures evolve over a time period for a given network.

/pdf/a-predictive-framework-for-cyber-security-analytics-using-2rnaefyqhi.pdf

A Predictive Framework for Cyber Security Analytics using Attack Graphs

Network security situation awareness provides the unique high level security view based upon the security alert events. But the complexities and diversities of security alert data on modern networks make such analysis extremely difficult. In this paper, we analyze the existing problems of network security situation awareness system and propose a framework for network security situation awareness based on knowledge discovery. The framework consists of the modeling of network security situation and the generation of network security situation. The purpose of modeling is to construct the formal model of network security situation measurement based upon the D-S evidence theory, and support the general process of fusing and analyzing security alert events collected from security situation sensors. The generation of network security situation is to extract the frequent patterns and sequential patterns from the dataset of network security situation based upon knowledge discovery method and transform these patterns to the correlation rules of network security situation, and finally to automatically generate the network security situation graph. Application of the integrated Network Security Situation Awareness system (Net-SSA) shows that the proposed framework supports for the accurate modeling and effective generation of network security situation.

A framework for network security situation awareness based on knowledge discovery

Study on network security situation awareness based on particle swarm optimization algorithm

Evaluating security threat status is very important in network security management and analysis. A quantitative hierarchical threat evaluation model is developed in this paper to evaluate security threat status of a computer network system and the computational method is developed based on the structure of the network and the importance of services and hosts. The evaluation policy from bottom to top and from local to global is adopted in this model. The threat indexes of services, hosts and local networks are calculated by weighting the importance of services and hosts based on attack frequency, severity and network bandwidth consumption, and the security threat status is then evaluated. The experiment results show that this model can provide the intuitive security threat status in three hierarchies: services, hosts and local networks so that system administrators are freed from tedious analysis tasks based on the alarm datasets to have overall security status of the entire system. It is also possible for them to find the security behaviors of the system, to adjust the security strategies and to enhance the performance on system security. This model is valuable for guiding the security engineering practice and developing the tool of security risk evaluation.

/pdf/quantitative-hierarchical-threat-evaluation-model-for-1ernj6gg6s.pdf

Chen Xiu-Zhen

Papers

Quantitative Hierarchical Threat Evaluation Model for Network Security