Measuring Security Risk of Networks Using Attack Graphs

Published

July 14, 2010

Author(s)

Steven Noel, Lingyu Wang, Anoop Singhal, Sushil Jajodia

Abstract

Today's computer systems face sophisticated attackers who combine multiple vulnerabilities to penetrate networks with devastating impact. The overall security of a network cannot be determined by simply counting the number of vulnerabilities. To accurately assess the security of networked systems, one must understand how vulnerabilities can be combined to stage an attack. We model such composition of vulnerabilities through attack graphs. By simulating incremental network penetration, and propagating attack likelihoods, we measure the overall security of a networked system. From this, we score risk mitigation options in terms of maximizing security and minimizing cost. We populate our attack graph models from live network scans and databases that have knowledge about properties such as vulnerability likelihood, impact, severity, and ease of exploitation. Our flexible model can be used to quantify overall security of networked systems, and to study cost/benefit tradeoffs for analyzing return on security investment.

Citation

International Journal of Next Generation Computing

Volume

1

Issue

1

Pub Type

Journals

Keywords

attack graphs, network security, security metrics

Citation

Noel, S. , Wang, L. , Singhal, A. and Jajodia, S. (2010), Measuring Security Risk of Networks Using Attack Graphs, International Journal of Next Generation Computing (Accessed January 5, 2026)