A graph-based system for network-vulnerability analysis

摘要: This paper presents a graph-based approach to network vulnerability analysis. The method is flexible, allowing analysis of attacks from both outside and inside the network. It can analyze risks specific asset, or examine universe possible consequences following successful attack. tool identify set attack paths that have high probability success (or low effort cost) for attacker. system could be used test effectiveness making configuration changes, implementing an intrusion detection system, etc. requires as input database common attacks, broken into atomic steps, topology information, attacker profile. information matched with profile create superset graph. Nodes stage attack, example class machines has accessed user privilege level he she compromised. arcs in graph represent stages attacks. By assigning probabilities on costs representing level-of-effort attacker, various algorithms such shortest-path highest success.