GP-AG: An efficient approach to network security analysis

Attack graphs can be applied to analyze network security, but there are two issues, namely scalability and loop. To solve these problems, we propose a new kind of attack graph named GP-AG, which is generated based on greedy policy. The construction process of GP-AG falls into two phases, the first phase generates the main attack graph with complete greedy policy, and the second phase generates all the sub attack graphs with incomplete greedy policy, the entire attack graph is composed of the main attack graph and all the sub attack graphs. The experiment results indicate that GP-AG provide a novel solution to the problem of efficient attack graph representation and analysis with less nodes and edges and without loops generated, and can help network administrators to find the critical vulnerabilities and attack paths effectively.