Capability-centric attack model for network security analysis

Most network attack models have the problem of lacking ablility to describe all types of attack patterns in deltail, with no consideration of attacker´s skill and policy. To address the problem, this paper proposes a well-structured model that abstracts the relation between attacker capability and victim vulnerability, the relation between knowledge, resource and capability of attacker. Both these two relations can be used to support automatic correlating of vulnerability exploits to build all the attack paths from the attacker to the target. The basic block of the model is a logical formula called capability, which is used to abstract consistently and precisely all levels of accesses obtained by the attacker in each step of a multistage attack. A flexible extensible language based on Pyke is developed to specify the model and derive inference rules to define logical relations between different capabilities, and a demonstration is given to show how it can be used in security applications such as vulnerability analysis and attack generation.