공격 그래프 상의 보안 메트릭 사용 방안 조사
Survey on the use of security metrics on attack graph
2
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
As the IT industry developed, the information held by the company soon became a corporate asset. As this information has value as an asset, the number and scale of various cyber attacks which targeting enterprises and institutions is increasing day by day. Therefore, research are being carried out to protect the assets from cyber attacks by using the attack graph to identify the possibility and risk of various attacks in advance and prepare countermeasures against the attacks. In the attack graph, security metric is used as a measure for determining the importance of each asset or the risk of an attack. This is a key element of the attack graph used as a criterion for determining which assets should be protected first or which attack path should be removed first. In this survey, we research trends of various security metrics used in attack graphs and classify the research according to application viewpoints, use of CVSS(Common Vulnerability Scoring System), and detail metrics. Furthermore, we discussed how to graft the latest security technologies, such as MTD(Moving Target Defense) or SDN(Software Defined Network), onto the attack graphs.
Abstract
As the IT industry developed, the information held by the company soon became a corporate asset. As this information has value as an asset, the number and scale of various cyber attacks which targeting enterprises and institutions is increasing day by day. Therefore, research are being carried out to protect the assets from cyber attacks by using the attack graph to identify the possibility and risk of various attacks in advance and prepare countermeasures against the attacks. In the attack graph, security metric is used as a measure for determining the importance of each asset or the risk of an attack. This is a key element of the attack graph used as a criterion for determining which assets should be protected first or which attack path should be removed first. In this survey, we research trends of various security metrics used in attack graphs and classify the research according to application viewpoints, use of CVSS(Common Vulnerability Scoring System), and detail metrics. Furthermore, we discussed how to graft the latest security technologies, such as MTD(Moving Target Defense) or SDN(Software Defined Network), onto the attack graphs.
참고문헌 (43)
- "Ministry of Science and ICT"[URL]
- Schneier, Bruce, "Attack trees", Dr. Dobb’s journal, 24(12), pp.21~29 (1999)
- Phillips, Cynthia, "A graphbased system for network-vulnerability analysis", Proceedings of the 1998 workshop on New security paradigms, pp.71~79 (1998)
- "National Institute of Standards and Technology Glossary"[URL]
- "CVE"[URL]
- "CVSS"[URL]
- Ou, Xinming, "MulVAL: A Logic-based Network Security Analyzer", USENIX Security Symposium, 8 (2005)
- Ingols, Kyle, "Practical attack graph generation for network defense", Computer Security Applications Conference, pp.121~130 (2006)
- Ortalo, Rodolphe, "Experimenting with quantitative evaluation tools for monitoring operational security", IEEE Transactions on Software Engineering, 25(5), pp.633~650 (1999)
- Mehta, Vaibhav, "Ranking attack graphs", International Workshop on Recent Advances in Intrusion Detection, pp.127~144 (2006)
- Idika, Nwokedi, "Extending attack graph-based security metrics and aggregating their application", IEEE Transactions on Dependable and Secure Computing, 9(1), pp.75~85 (2012)
- "National Institute of Standards and Technology"[URL]
- Balzarotti, Davide, "Assessing the risk of using vulnerable components", Quality of Protection, pp.65~77 (2006)
- Wang, Lingyu, "An attack graph-based probabilistic security metric", IFIP Annual Conference on Data and Applications Security and Privacy, 5094, pp.283~296 (2008)
- Gallon, Laurent, "Using CVSS in attack graphs", Availability, Reliability and Security, 2011 Sixth International Conference on. IEEE, pp.59~66 (2011)
- Wang, Lingyu, "Measuring the overall security of network configurations using attack graphs", IFIP Annual Conference on Data and Applications Security and Privacy, 4602, pp.98~112 (2007)
- Suh-Lee, Candace, "Quantifying security risk by measuring network risk conditions", Computer and Information Science (ICIS), 2015 IEEE, 2015, 9~14
- "National Vulnerability Database"[URL]
- Pamula, Joseph, "A weakest-adversary security metric for network configuration security analysis", Proceedings of the 2nd ACM workshop on Quality of protection. ACM, pp.31~38 (2006)
- Noel, Steven, "Measuring security risk of networks using attack graphs", International Journal of Next-Generation Computing, 1(1), pp.135~147 (2010)
- Tupper, Melanie, "VEAbility security metric: A network security analysis tool", Availability, Reliability and Security, 2008. ARES 08. Third International Conference on. IEEE, pp.950~957 (2008)
- Keramati, Marjan, "CVSS-based security metrics for quantitative analysis of attack graphs", Computer and Knowledge Engineering (ICCKE), 2013 3th International eConference on. IEEE, pp.178~183 (2013)
- Dai, Fangfang, "Exploring risk flow attack graph for security risk assessment", IET Information Security, 9(6), pp.344~353 (2015)
- Singhal, Anoop, "Security risk analysis of enterprise networks using probabilistic attack graphs", Network Security Metrics, pp.53~73 (2017)
- Xie, Lixia, "Network Security Risk Assessment Based on Attack Graph", Journal of Computers, 8(9), pp.2339~2347 (2013)
- Homer, John, "Aggregating vulnerability metrics in enterprise networks using attack graphs", Journal of Computer Security, 21(4), pp.561~597 (2013)
- Frigault, Marcel, "Measuring network security using bayesian network-based attack graphs", Annual IEEE International Computer Software and Applications Conference. IEEE, pp.698~703 (2008)
- Poolsappasit, Nayot, "Dynamic security risk management using bayesian attack graphs", IEEE Transactions on Dependable and Secure Computing, 9(1), pp.61~74 (2012)
- Liu, Si-chao, "Network security risk assessment method based on HMM and attack graph model", 2016 17th IEEE, Distributed Computing (SNPD). IEEE, pp.2016[DOI]
- Sawilla, Reginald E., "Identifying critical attack assets in dependency attack graphs", European Symposium on Research in Computer Security, 5283, pp.18~34 (2008)
- Hui, Wang, "An Approach of Security Risk Evaluation Based on the Bayesian Attack Graph", Open Cybernetics & Systemics Journal, 9, pp.953~960 (2015)
- Noel, Steven, "Metrics suite for network attack graph analytics", Proceedings of the 9th Annual Cyber and Information Security Research Conference. ACM, pp.5~8 (2014)
- Moon, Young Hoon, "Hybrid Attack Path Enumeration System Based on Reputation Scores", Computer and Information Technology (CIT), 2016 IEEE International Conference on. IEEE, pp.241~248 (2016)
- Ghosh, Nirnay, "An approach for security assessment of network configurations using attack graph", Networks and Communications, 2009. NETCOM'09. First International Conference on. IEEE, pp.283~288 (2009)
- Ge, Mengmeng, "Evaluating Security and Availability of Multiple Redundancy Designs when Applying Security Patches", Dependable Systems and Networks Workshop (DSN-W), 2017 47th Annual IEEE, 2017, 53~60
- Singh, Umesh Kumar, "Quantifying security risk by critical network vulnerabilities assessm ent", International Journal of Computer Applications, 156(13), pp.26~33 (2016)
- Zhang, Mengyuan, "Network diversity: a security metric for evaluating the resilience of networks against zero-day attacks", IEEE Transactions on Information Forensics and Security, 11(5), pp.1071~1086 (2016)
- Jessica Steinberger, "DDoS defense using MTD and SDN", IEEE Network Operations and Management Symposium 2018 on. IEEE (2018)
- Zhuang, Rui, "Investigating the application of moving target defenses to network security", Resilient Control Systems (ISRCS), 2013 6th International Symposium on. IEEE, pp.162~169 (2013)
- Hong, Jin Bum, "Assessing the effectiveness of moving target defenses using security models", IEEE Transactions on Dependable and Secure Computing, 13(2), pp.163~177 (2016)
- Chowdhary, Ankur, "Sdn based scalable mtd solution in cloud network", Proceedings of the 2016 ACM Workshop on Moving Target Defense. ACM, pp.27~36 (2016)
- Yusuf, Simon Enoch, "Security Modelling and Analysis of Dynamic Enterprise Networks", Computer and Information Technology (CIT), 2016 IEEE International Conference on. IEEE, pp.249~256 (2016)
- 문주연, "동적 네트워크 환경에 적용 가능한 Attack Graph 모델 연구", 정보보호학회논문지, 28(2), pp.485~500 (2018), 한국정보보호학회[DOI]