공격 그래프 기반의 공격 대상 예측 시스템 설계 및 구현에 대한 연구
A Study on the Design and Implementation of System for Predicting Attack Target Based on Attack Graph
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
As the number of systems increases and the network size increases, automated attack prediction systems are urgently needed to respond to cyber attacks. In this study, we developed four types of information gathering sensors for collecting asset and vulnerability information, and developed technology to automatically generate attack graphs and predict attack targets. To improve performance, the attack graph generation method is divided into the reachability calculation process and the vulnerability assignment process. It always keeps up to date by starting calculations whenever asset and vulnerability information changes. In order to improve the accuracy of the attack target prediction, the degree of asset risk and the degree of asset reference are reflected. We refer to CVSS(Common Vulnerability Scoring System) for asset risk, and Google's PageRank algorithm for asset reference. The results of attack target prediction is displayed on the web screen and CyCOP(Cyber Common Operation Picture) to help both analysts and decision makers.
Abstract
As the number of systems increases and the network size increases, automated attack prediction systems are urgently needed to respond to cyber attacks. In this study, we developed four types of information gathering sensors for collecting asset and vulnerability information, and developed technology to automatically generate attack graphs and predict attack targets. To improve performance, the attack graph generation method is divided into the reachability calculation process and the vulnerability assignment process. It always keeps up to date by starting calculations whenever asset and vulnerability information changes. In order to improve the accuracy of the attack target prediction, the degree of asset risk and the degree of asset reference are reflected. We refer to CVSS(Common Vulnerability Scoring System) for asset risk, and Google's PageRank algorithm for asset reference. The results of attack target prediction is displayed on the web screen and CyCOP(Cyber Common Operation Picture) to help both analysts and decision makers.
참고문헌 (10)
- 고장혁, "네트워크 트래픽 수집 및 복원을 통한 내부자 행위 분석 프레임워크 연구", (사)디지털산업정보학회 논문지, 13(4), pp.125~135 (2017), (사)디지털산업정보학회[DOI]
- 고장혁, "정보 유출 탐지를 위한 머신 러닝 기반 내부자 행위 분석 연구", (사)디지털산업정보학회 논문지, 13(2), pp.1~11 (2017), (사)디지털산업정보학회[DOI]
- 고장혁, "국방정보시스템 성능향상을 위한 효율적인 GPU적용방안 연구", (사)디지털산업정보학회 논문지, 11(1), pp.27~35 (2015), (사)디지털산업정보학회[DOI]
- N. Nakhla, "Automated computer network defence using ARMOUR: Mission-oriented decision support and vulnerability mitigation", 2017 International Conference On Cyber Situational Awareness, Data Analytics and Assessment(Cyber SA), pp.1~8 (2017)
- Barik, M.ridul, "Attack Graph Generation and Analysis Techniques", Defence Science Journal, 66(6), pp.559~567 (2016)
- R. Lippmann, "Validating and Restoring Defense in Depth Using Attack Graphs", MILCOM 2006, IEEE Military Communications conference, pp.1~10 (2006)
- K. Ingols, "Modeling Modern Network Attacks and Countermeasures Using Attack Graphs", 2009 Annual Computer Security Applications Conference, pp.117~126 (2009)
- S. Noel, "Advances in Topological Vulnerability Analysis", 2009 Cybersecurity Applications & Technology Conference for Homeland Security, pp.124~129 (2009)
- Jajodia S., "Cyber Situational Awareness" (2010), Springer
- "Security risk analysis of enterprise networks using probabilistic attack graphs" (2011)[URL]