Visible to the public An Approach to Incorporating Uncertainty in Network Security AnalysisConflict Detection Enabled

TitleAn Approach to Incorporating Uncertainty in Network Security Analysis
Publication TypeConference Paper
Year of Publication2017
AuthorsHoang Hai Nguyen, University of Illinois at Urbana-Champaign, Kartik Palani, University of Illinois at Urbana-Champaign, David Nicol, University of Illinois at Urbana-Champaign
Conference NameSymposium and Bootcamp for the Science of Security (HotSoS 2017)
Date Published04/2017
Conference LocationHanover, MD
KeywordsA Hypothesis Testing Framework for Network Security, Attack Graphs, Network security, NSA SoS Lablets Materials, science of security, UIUC, uncertainty analysis

Attack graphs used in network security analysis are analyzed to determine sequences of exploits that lead to successful acquisition of privileges or data at critical assets. An attack graph edge corresponds to a vulnerability, tacitly assuming a connection exists and tacitly assuming the vulnerability is known to exist. In this paper we explore use of uncertain graphs to extend the paradigm to include lack of certainty in connection and/or existence of a vulnerability. We extend the standard notion of uncertain graph (where the existence of each edge is probabilistically independent) however, as signicant correlations on edge existence probabilities exist in practice, owing to common underlying causes for dis-connectivity and/or presence of vulnerabilities. Our extension describes each edge probability as a Boolean expression of independent indicator random variables. This paper (i) shows that this formalism is maximally descriptive in the sense that it can describe any joint probability distribution function of edge existence, (ii) shows that when these Boolean expressions are monotone then we can easily perform uncertainty analysis of edge probabilities, and (iii) uses these results to model a partial attack graph of the Stuxnet worm and a small enterprise network and to answer important security-related questions in a probabilistic manner.

Citation Keynode-34304

Other available formats:

An Approach to Incorporating Uncertainty in Network Security Analysis