Using Network Tainting to Bound the Scope of Network Ingress Attacks

Published

July 1, 2014

Author(s)

Peter M. Mell, Richard Harang

Abstract

This research describes a novel security metric, network taint, which is related to software taint analysis. We use it here to bound the possible malicious influence of a known compromised node through monitoring and evaluating network flows. The result is a dynamically changing defense-in-depth map that shows threat level indicators gleaned from monotonically decreasing threat chains. We augment this analysis with concepts from the complex networks research area in forming dynamically changing security perimeters and measuring the cardinality of the set of threatened nodes within them. In providing this, we hope to advance network incident response activities by providing a rapid automated initial triage service that can guide and prioritize investigative activities.

Conference Dates

June 30-July 2, 2014

Conference Location

San Francisco, CA

Conference Title

Eighth International Conference on Software Security and Reliability (SERE 2014)

Pub Type

Conferences

Download Paper

https://doi.org/10.1109/SERE.2014.34

Keywords

network tainting, complex networks, scale-free, security

Citation

Mell, P. and Harang, R. (2014), Using Network Tainting to Bound the Scope of Network Ingress Attacks, Eighth International Conference on Software Security and Reliability (SERE 2014), San Francisco, CA, [online], https://doi.org/10.1109/SERE.2014.34 (Accessed October 15, 2025)