A new perspective of network vulnerability analysis using Network Security Gradient

Computer networks are inevitably attacked as a result of their openness, while network attack usually actualized by exploiting vulnerability existing in network environment. Attack graph, consisted of lots of related atomic attacks, can fully display the exploitation and dependence relations among all of the vulnerabilities existed in network. Thus, it is a very useful tool for network vulnerability analysis and network security evaluation. However, the prevalent Attacker´s Ability Monotonic Assumption (AAMA) constraint for attack graph generation could not make full use of the direction of network attack and the hierarchy of defense. As a result, using AAMA to constraint the process of attack graph generation is not only inefficient but also couldn´t reduce the complexity of attack graph, especially for large-scale complicated network. According to lots of experiment and theoretical analysis, we found that it is mainly the existence of Circuitous Attack Paths (CAP) in attack graph lead to it complexity and the low efficiency of generation. To address this problem, we proposed the concept of Network Security Gradient (NSG) to reflect the direction of the network attack and the hierarchy of defense, and the Gradient Attack Assumption (GAA) to constraint the process of attack graph generation for the purpose of avoiding CAPs. Testified by a case study, using the GAA to constraint the process of attack graph generation can destruct those circuitous attack paths, therefore, is an effective way to improve the efficiency of attack graph generation and reduce the complexity of attack graph, and make it more useful for vulnerability analysis and network security evaluation.