Modeling modern network attacks and countermeasures using attack graphs
Name
Ingols-2009-Modeling modern network attacks and countermeasures using attack graphs.pdf
Size
625.97 KB
Format
Adobe PDF
Checksum (MD5)
bd2978aa8ae30b2f9bcb012bb799f20c
Author(s)
Ingols, Kyle W.
Chu, Matthew D.
Lippmann, Richard P.
Webster, Seth R.
Boyer, Stephen
Date Issued
February 2010
Journal
Annual Computer Security Applications Conference, 2009. ACSAC '09
Publisher
Institute of Electrical and Electronics Engineers
Citation
Ingols, K. et al. “Modeling Modern Network Attacks and Countermeasures Using Attack Graphs.” Computer Security Applications Conference, 2009. ACSAC '09. Annual. 2009. 117-126. ©2009 Institute of Electrical and Electronics Engineers.
Version
Final published version
Abstract
By accurately measuring risk for enterprise networks, attack graphs allow network defenders to understand the most critical threats and select the most effective countermeasures. This paper describes substantial enhancements to the NetSPA attack graph system required to model additional present-day threats (zero-day exploits and client-side attacks) and countermeasures (intrusion prevention systems, proxy firewalls, personal firewalls, and host-based vulnerability scans). Point-to-point reachability algorithms and structures were extensively redesigned to support "reverse" reachability computations and personal firewalls. Host-based vulnerability scans are imported and analyzed. Analysis of an operational network with 84 hosts demonstrates that client-side attacks pose a serious threat. Experiments on larger simulated networks demonstrated that NetSPA's previous excellent scaling is maintained. Less than two minutes are required to completely analyze a four-enclave simulated network with more than 40,000 hosts protected by personal firewalls.
Subjects
network reachability
network defense
attack tree
attack graph
SCAP
MIT Department
Lincoln Laboratory
Terms of Use
Article is made available in accordance with the publisher's policy and may be subject to US copyright law. Please refer to the publisher's site for terms of use.
Persistent DSpace Link
DOI of Published Version
https://doi.org/10.1109/ACSAC.2009.21
