Comparative analysis and patch optimization using the cyber security analytics framework

Abstract

Dependable metrics are one of the critical elements of an organization’s information security program and are crucial for its long-term success. Current research in the area of enterprise security metrics provides limited insight on understanding the impact that attacks have on the overall security goals of an enterprise as well as predicting the future security state of the network. In this paper we present a novel security analytics framework that takes into account both the inter-relationship between different vulnerabilities and the temporal features that evolve over time, such as the vulnerability discovery rate and the lifecycle events. We then formally define a non-homogenous stochastic model that incorporates time dependent covariates, namely the vulnerability age and the vulnerability discovery rate, to help visualize the future security state of the network leading to actionable knowledge and insight. We will perform a comparative analysis and also describe the patch optimization methodology by applying this model on a sample network to demonstrate the practicality of our approach.

Keywords

Attack graph Common Vulnerability Scoring System Markov model security metrics cyber situational awareness vulnerability discovery model vulnerability lifecycle model

Get full access to this article

View all access options for this article.

References

Oluwaseun

Zavarsky

Lindskog

et al . An analysis of CVSS v2 environmental scoring. In: Clippinger

(ed.) Privacy, security, risk and trust (PASSAT), MIT Media Lab, Boston, MA, 9–11 October 2011. Los Alamitos, CA: IEEE Computer Society.

Schiffman

. Common Vulnerability Scoring System (CVSS), http://www.first.org/cvss/ (accessed November 14, 2016)

Ali

Zavarsky

Lindskog

et al . A software application to analyze affects of temporal and environmental metrics on overall CVSS v2 score. Concordia University College of Alberta, Edmonton, Canada, October 2010.

Ortalo

Deswarte

Kaaniche

Experimenting with quantitative evaluation tools for monitoring operational security. IEEE Trans Software Eng 1999; 25: 633–650.

Vaughn

. Cluster security research involving the modeling of network exploitations using exploitation graphs. In: Turner

Stephen

(ed.) Sixth IEEE international symposium on cluster computing and grid workshops, Singapore, 16–19 May 2006, pp. 26–36. Los Alamitos, CA: IEEE Computer Society.

Idika

Bhargava

Extending attack graph-based security metrics and aggregating their application. IEEE Trans Depend Secure Comput 2010; 99: 1–1.

Wang

Singhal

Jajodia

Toward measuring network security using attack graphs. In: Karjoth

Gunter

(ed.) Proceedings of the 2007 ACM workshop on quality protection, Alexandria, Virginia, October 29, 2007, pp.49-54. New York: ACM.

Trivedi

Kim

Roy

et al . Dependability and security models. In: Medhi

Deep

(ed.) IEEE proceedings DRCN, Washington, D.C, October 25–28, 2009, pp.11–20. Piscatway, NJ USA: IEEE.

Roy

Kim

Trivedi

KS.

Attack countermeasure trees (ACT): towards unifying the constructs of attack and defense trees. J Secur Commun Networks SI: Insider Threats 2011; 3: 1–5.

10.

Sheyner

Haines

Jha

et al . Automated generation and analysis of attack graphs. In: Denise Williams

(ed.) IEEE symposium on security and privacy, Berkeley, California, 2002, p. 284. Los Alamitos, CA: IEEE.

11.

Xinming

Sudhakar

Appel

Mulval: a logic-based network security analyzer. In 14th USENIX security symposium, Baltimore, MD, July 31–5 August, 2005; 14: 8. Berkeley, CA: USENIX.

12.

Jajodia

Noel

Advanced cyber attack modeling, analysis, and visualization. Technical Report, George Mason University, Fairfax, VA 2010.

13.

S DoD, MIL-STD-1785:1988. System security engineering program management requirements.

14.

Dacier

Deswarte

. Privilege graph: an extension to the typed access matrix model. In: Gollmann

(ed.) proceedings of ESORICS, Brighton, UK, 1994; 875. Berlin: Springer.

15.

Phillips

Swiler

. A graph-based system for network-vulnerability analysis. In: Blakeley

Bob

(ed.) Proceedings of WNSP’98, Charlottesville, Virginia, USA, 22–26 September, 1998, pp.71-79. New York: ACM.

16.

Swiler

Phillips

Ellis

et al . Computer-attack graph generation tool. In: Titsworth

(ed.) proceedings of DISCEX01, Anaheim, California, 12–14 June 2001, pp.307–321. IEEE Computer Society: IEEE.

17.

Jansen

Directions in security metrics research. Technical report, NIST, 2009.

18.

Frei

Fiedler

May

et al . Why to adopt a security metric? A brief survey. Qual Protect Adv Inform Secur 2006; 23: 1–12.

19.

SANS Institute. A guide to security metrics, June 2006.

20.

Abedin

Nessa

Al-Shaer

et al . Vulnerability analysis for evaluating quality of protection of security policies. In: Karjoth

Guenter

(ed.) Proceedings of quality of protection, Alexandria, Virginia, 30 October, 2006 (QoP ‘06), October 2006. New York: ACM.

21.

National Vulnerability Database, 2014. https://nvd.nist.gov/ (accessed)

22.

Kundu

Ghosh

Chokshi

et al . Analysis of attack graph-based metrics for quantification of network security. In: IEEE India conference (INDICON), Kochi, Kerala, 7–9 December, 2012, pp.504. Piscataway, NJ: IEEE.

23.

Wang

Islam

Long

et al . An attack graph-based probabilistic security metric. In: Atluri

Vijay

(ed.) DAS 2008, LNCS 5094, London, 13-16 July, 2008, pp.283-296. Berlin: Springer.

24.

Wang

Singhal

Jajodia

. Measuring overall security of network configurations using attack graphs. In: Barker

Steve

(ed.) Data and applications security XXI, Redondo Beach, CA, 8–11 July, 2007, vol. 4602, pp.98–112. Berlin: Springer.

25.

Jaquith

Security metrics: replacing fear, uncertainty, and doubt. Boston, MA: Addison-Wesley, Pearson Education, 2007.

26.

Jonsson

Olovsson

A quantitative model of the security intrusion process based on attacker behavior. Piscataway, NJ: IEEE Trans Software Eng 1997.

27.

Sallhammar

Helvik

Knapskog

On stochastic modeling for integrated security and dependability evaluation. J Networks 2006; 1(5): 31–42.

28.

Arbaugh

Fithen

McHugh

Windows of vulnerability: a case study analysis. Computer 2000; 33: 52–59.

29.

Fischbach

. Le cycle de vie d’une vulnrabilit, http://www.securite.org (2003).

30.

Jones

Estimating software vulnerabilities. IEEE Secur Privacy 2007; 5: 28–32.

31.

Frei

Fiedler

May

et al . Large-scale vulnerability analysis. In: Proceedings of the 2006 SIGCOMM workshop on large-scale attack defense, Pisa, Italy, 11–15 September, 2006, pp. 131–138. New York: ACM.

32.

Lyu

Handbook of software reliability engineering. New York: McGraw-Hill, 1996.

33.

Anderson

. Security in open versus closed systems - the dance of Boltzmann, Coase and Moore. In: Proceedings of open source software: economics, law and policy, Toulouse, France, 20–21 June, 2002.

34.

Alhazmi

Malaiya

Modeling the vulnerability discovery process. In: Kawada

Stephanie

(ed.) Proceedings of the 16th IEEE international symposium on software reliability engineering (ISSRE’05), Chicago, 8–11 November, 2005, pp.129–138. Los Alamitos, CA: IEEE Computer Society.

35.

Rescorla

Is finding security holes a good idea?

IEEE Secur Privacy 2005; 3: 14–19.

36.

Joh

Kim

Malaiya

Vulnerability discovery modeling using Weibull distribution. In: Ceballos

Silvia

(ed.) Proceedings of the 19th IEEE international symposium on software reliability engineering (ISSRE’08), Seattle, Washington, 10–14 November, 2008, pp.299–300. Piscataway, NJ: IEEE Computer Society.

37.

Younis

Joh

Malaiya

Modeling learningless vulnerability discovery using a folded distribution. In: Proceedings of the international conference security and management (SAM’11) Las Vegas, 18–21 July, 2011, pp.617–623.

38.

Abraham

Nair

. A novel architecture for predictive cybersecurity using non-homogenous Markov models. In: O’Conner

Lisa

(ed.) IEEE international symposium on recent advances of trust, security and privacy in computing and communications (RATSP), in conjunction with IEEE TRUSTCOM, Helsinki, Finland, 20–22 August, 2015, p. 196. Piscataway, NJ: IEEE Computer Society.

39.

Abraham

Nair

. exploitability analysis using predictive cybersecurity framework. IEEE In: Jȩdrzejowicz

Piotr

(ed.) CYBCONF, Gdynia, Poland, 24–26 June, 2015, p. 30, pp.317–323. Piscataway, NJ: IEEE Computer Society.

40.

Abraham

Nair

. Cyber security analytics: a stochastic model for security quantification using absorbing Markov chains. In: Xiao

Yang

(ed.) 5th international conference on networking and information technology (ICNIT 2014), Singapore, 21–23 November, 2014, pp. 899–907. Singapore: JCM.

41.

The MITRE Corporation. Common vulnerabilities and exposures. https://cve.mitre.org/ (accessed 14 November, 2016)

42.

Shengwei

Yong

et al . Overview on attack graph generation and visualization technology. In: Yang

Tao

(ed.) IEEE international conference on anti-counterfeiting, security and identification (ASID), Shanghai, China, 2013, pp. 1–6. Los Alamitos, California: IEEE.