Phillips, C. and Swiler, L. P. 1998. A graph-based system for network-vulnerability analysis. In /Proceedings of the 1998 Workshop on New Security Paradigms/. ACM, New York, NY, 71-79.
Summary:
This paper introduces a method for analyzing vulnerabilities in computer networks by matching the network configuration, attack templates borrowed from a database of common attacks, and attacker profile. The paper describes how attack templates are matched to the configuration and attacker profile to generate the attack graph.
Attack templates include generic steps in known attacks and condition which must be hold. Attack templates are represented by a directed graph in which nodes are user level, machines, vulnerability, capabilities and state. Edges are actions by the attacker. The nodes of attack graph stages of an attack, and the edges are attacks that change the state. So the nodes in attack graph are the nodes in attack template instantiated with particular attackers/users and machines. The edges can be labeled with probability of success or cost. One can analyze the attack graphs by identifying the attack paths that are most likely to succeed, i.e. using shortest path algorithm.
Why it is good:
Attack graph provides a method for modeling attacks and relating the attacks to the machines in a network and users which could be the attackers. Using this approach, temporal stages and steps of an attack can be expressed. In addition, it supports expressing multiple ways to achieve malicious goals or attack the system by branches in the attack graph. An interesting suggestion of this work is using a database of common attacks, which contain various information about attacks; such as level of user who imposes the threat, machines which are involved, vulnerabilities which are imposed to the configuration by an attack, capabilities which express the malicious behavior needed to be delivered, and states which are atomic steps of an attack.
Problems and limitations:
The description of attack, i.e. user level, machine, vulnerability, capabilities, and state, are added to the nodes of the attack graph based on matching the configuration, attack template, and attacker profile. However, it is not described how the matching is performed. This matching may require defining a taxonomy of attacks, vulnerabilities, and capabilities, and a detailed description of the configuration. In addition, all the information about steps of an attack (user level, machine, vulnerability, capabilities, and state) are presented to the reader or user of the model in the same view. This reduces the use of such models for understanding the behavior of one single user or group of users, or security impact of an action or atomic steps.
Although the proposed approach to modeling attacks is able to express the steps of occurring an attack, its post and pre conditions, required configurations, and capabilities, it does not provide a way to express the impact of the attacks on the normal functions of the system. It is not argued why the proposed method is limited to network vulnerability analysis, and why it cannot be generalized to apply to other computer systems such as Internet attacks, applications’ vulnerability, domain specific attacks, wireless communication, etc. The proposed quantitative analysis method which assigns probability or cost to the edges for computing the shortest path, and as a result the most likely attack works well in theory. However, in real-world practices such quantitative values and even approximate measures may not be available. Finally, the approach mentions the possibility of countermeasure analysis, but it does not provide means to link possible countermeasures to the attacks.