Predictive model for overall network security risk
A stochastic model is described for cybersecurity using a host access attack graph to determine network security risk. The model uses Markov chains in conjunction with vulnerability metrics to analyze risks associated with a number of different types of computing devices in various types of networks. The model can be used to identify critical nodes in a host access attack graph where attackers may be most likely to focus. Based on that information, a network administrator can make appropriate, prioritized decisions for system patching. Further, a flexible risk ranking technique is described, where the decisions made by an attacker can be adjusted using a bias factor. The model can be generalized for use with complicated network environments.
1. A method to model security risk, performed by at least one computing device, comprising:
constructing a host access attack graph based on characteristics of a network of computing systems, the host access attack graph including a plurality of nodes;
gathering exploitability scores and impact scores associated with the plurality of nodes in the host access attack graph;
developing a state transition probability matrix based on the exploitability scores and the impact scores in the host access attack graph;
ranking risk associated with the plurality of nodes in the host access attack graph with reference to the state transition probability matrix, wherein the ranking comprises:
creating a risk vector with initial risk values based on the plurality of nodes in the host access attack graph;
iterating the risk vector with the state transition probability matrix to a converged risk vector at a steady state; and
ranking risk elements in the converged risk vector; and
identifying a node among the plurality of nodes having a largest risk.
2. The method according to claim 1 , wherein each node in the host access attack graph is associated with a computing device in the network of computing systems or a service executing in the network of computing systems.
3. The method according to claim 1 , wherein the developing comprises developing a quantitative score for an element in the state transition probability matrix as a function of a level of difficulty in exploiting one of the plurality of nodes and a function of an impact of exploiting the one of the plurality of nodes based on an exploitability score and an impact score of the one of the plurality of nodes.
4. The method according to claim 3 , wherein the developing comprises developing the quantitative score for the element in the state transition probability matrix based further on a bias factor associated with a level of skill of an attacker.
5. The method according to claim 1 , wherein each element in the state transition probability matrix provides a probability that an attacker would transition from one of the plurality of nodes in the host access attack graph to another one of the plurality of nodes in the host access attack graph.
6. The method according to claim 1 , wherein ranking the risk comprises prioritizing the risk associated with the plurality of nodes among the plurality of nodes using a Markovian random walk.
7. The method according to claim 1 , wherein a node among the plurality of nodes having a largest risk comprises a priority candidate for risk remediation in the network of computing systems.
8. The method according to claim 1 , further comprising summing the risk associated with the plurality of nodes to determine an overall network security risk for the network of computing systems.
9. The method according to claim 1 , wherein the exploitability scores and the impact scores comprise Common Vulnerability Scoring System (CVSS) metric scores.
10. A system to model security risk, comprising:
a memory device configured to store computer-readable instructions thereon; and
at least one processing device directed, through execution of the computer-readable instructions, to:
construct a host access attack graph based on characteristics of a network of computing systems, the host access attack graph including a plurality of nodes;
gather exploitability scores and impact scores associated with the plurality of nodes in the host access attack graph;
develop a state transition probability matrix based on the exploitability scores and the impact scores in the host access attack graph;
rank risk associated with the plurality of nodes in the host access attack graph with reference to the state transition probability matrix, wherein, to rank the risk, the at least one processing device is directed to:
create a risk vector with initial risk values based on the plurality of nodes in the host access attack graph;
iterate the risk vector with the state transition probability matrix to a converged risk vector at a steady state; and
rank risk elements in the converged risk vector; and
identify a node among the plurality of nodes having a largest risk.
11. The system according to claim 10 , wherein each node in the host access attack graph is associated with a computing device in the network of computing systems or a service executing in the network of computing systems.
12. The system according to claim 10 , wherein the at least one processing device is further directed to develop a quantitative score for an element in the state transition probability matrix as a function of a level of difficulty in exploiting one of the plurality of nodes and a function of an impact of exploiting the one of the plurality of nodes based on an exploitability score and an impact score of the one of the plurality of nodes.
13. The system according to claim 12 , wherein the at least one processing device is further directed to develop the quantitative score for the element in the state transition probability matrix based further on a bias factor associated with a level of skill of an attacker.
14. The system according to claim 10 , wherein each element in the state transition probability matrix provides a probability that an attacker would transition from one of the plurality of nodes in the host access attack graph to another one of the plurality of nodes in the host access attack graph.
15. The system according to claim 10 , wherein the at least one processing device is further directed to prioritize the risk associated with the plurality of nodes among the plurality of nodes using a Markovian random walk.
16. The system according to claim 10 , wherein the at least one processing device is further directed to sum the risk associated with the plurality of nodes to determine an overall network security risk for the network of computing systems.
17. The system according to claim 10 , wherein the exploitability scores and the impact scores comprise Common Vulnerability Scoring System (CVSS) metric scores.
18. A method to model security risk, performed by at least one computing device, comprising:
constructing a host access attack graph based on characteristics of a network of computing systems, the host access attack graph including a plurality of nodes;
developing a state transition probability matrix based on an exploitability score and an impact score of a node in the host access attack graph; and
ranking risk associated with the plurality of nodes in the host access attack graph with reference to the state transition probability matrix, wherein the ranking comprises:
creating a risk vector with initial risk values based on the plurality of nodes in the host access attack graph;
iterating the risk vector with the state transition probability matrix to a converged risk vector at a steady state; and
ranking risk elements in the converged risk vector.
19. The method according to claim 18 , wherein the developing comprises developing a quantitative score for an element in the state transition probability matrix as a function of a level of difficulty in exploiting one of the plurality of nodes and a function of an impact of exploiting the one of the plurality of nodes based on an exploitability score and an impact score of the one of the plurality of nodes.
20. The method according to claim 18 , wherein ranking the risk comprises prioritizing the risk associated with the plurality of nodes among the plurality of nodes using a Markovian random walk.