Measuring the overall security of network configurations using attack graphs

摘要: Today's computer systems face sophisticated intrusions during which multiple vulnerabilities can be combined for reaching an attack goal. The overall security of a network system cannot simply determined based on the number vulnerabilities. To quantitatively assess networked systems, one must first understand and how attack. Such understanding becomes possible with recent advances in modeling composition as graphs. Based our experiences graph analysis, we explore different concepts issues metric to quantify potential attacks. accomplish this, present resistance assessing comparing configurations. This paper describes at abstract level two operators features expressing additional constraints. We consider concrete cases. case assumes domain real second represents resistances set initial conditions. show that proposed satisfies desired properties it adheres common sense. At same time, generalizes previously is also It belief will lead novel quantitative approaches vulnerability hardening, responses.