Asset Risk Scoring in Enterprise Network with Mutually Reinforced Reputation Propagation

摘要: Cyber security attacks are becoming ever more frequent and sophisticated. Enterprises often deploy several protection mechanisms, such as anti-virus software, intrusion detection prevention systems, firewalls, to protect their critical assets against emerging threats. Unfortunately, these systems typically "noisy", e.g., regularly generating thousands of alerts every day. Plagued by false positives irrelevant events, it is neither practical nor cost-effective analyze respond single alert. The main challenge faced enterprises extract important information from the plethora infer potential risks assets. A better understanding will facilitate effective resource allocation prioritization further investigation. In this paper, we present MUSE, a system that analyzes large number derives risk scores correlating diverse entities in an enterprise network. Instead considering isolated static property, MUSE models dynamics based on mutual reinforcement principle. We evaluate with real-world network traces network, demonstrate its efficacy assessment flexibility incorporating wide variety data sets.