Interactive Analysis of Attack Graphs Using Relati

Authors: Lingyu Wang Chao Yao Anoop Singhal Sushil Jajodia

Publish Date: 2006/7/31

Volume: , Issue: , Pages: 119-132

PDF Link

Abstract

Attack graph is important in defending against wellorchestrated network intrusions However the current analysis of attack graphs requires an algorithm to be developed and implemented causing a delay in the availability of analysis Such a delay is usually unacceptable because the needs for analyzing attack graphs may change rapidly in defending against network intrusions An administrator may want to revise an analysis upon observing its outcome Such an interactive analysis similar to that in decision support systems is difficult if at all possible with current approaches based on proprietary algorithms This paper removes the above limitation and enables interactive analysis of attack graphs We devise a relational model for representing necessary inputs including network configuration and domain knowledge We generate the attack graph from those inputs as relational views We then show that typical analyses of the attack graph can be realized as relational queries against the views Our approach eliminates the needs for developing a proprietary algorithm for each different analysis because an analysis is now simply a relational query The interactive analysis of attack graphs is now possible because relational queries can be dynamically constructed and revised at run time Moreover the mature optimization techniques in relational databases can also improve the performance of the analysisThis material is based upon work supported by National Institute of Standards and Technology Computer Security Division by Homeland Security Advanced Research Projects Agency under the contract FA875005C0212 administered by the Air Force Research Laboratory/Rome by Army Research Office under grants DAAD190310257 and W911NF0510374 by Federal Aviation Administration under the contract DTFAWA04P00278/0001 and by the National Science Foundation under grants IIS0242237 and IIS0430402 Any opinions findings and conclusions or recommendations expressed in this material are those of the authors and do not necessarily reflect the views of the sponsoring organizations

Keywords: