Boosting Logical Attack Graph for Efficient Security Control

This paper reports an approach, which is termed AG-HMM, to achieve cost-effective security control by exploring logical attack graph to represent network observations, and Hidden Markov Model (HMM) to estimate attack states. One advantage of our approach is to construct a probabilistic mapping between network observations and attack states, potentially revealing the most significant vulnerabilities and allowing security administrators (SA) to efficiently deal with them through cost-benefit analysis. A preliminary experiment is conducted to evaluate our approach in a typical enterprise network.