Estimating Mean Time to Compromise Using Non-homogenous Continuous-Time Markov Models

摘要: Mean time to compromise is a commonly used comparative metric determine system's weakness and aid in risk mitigation strategies. In this paper, we provide unified framework for measuring network's mean by considering both the skill level of an attacker as well causal relationship that exists between all vulnerabilities network. Unlike existing approaches, methodology estimating coefficient different categories attackers (Beginner, Intermediate, Expert) analyzing 15 years vulnerability data NVD database. We then extend our predictive cybersecurity stochastic model into nonhomogeneous continuous derive overall modeling sojourn each state random variable based on attacker. Finally, demonstrate through case study how can enable security practitioners visualize future optimize necessary steps harden enterprise network from external threats.