Skip to main content
SpringerLink
Log in

Mean Value Analysis of Critical Attack Paths with Multiple Parameters

  • Conference paper
  • First Online:
Secure IT Systems (NordSec 2023)

Part of the book series: Lecture Notes in Computer Science ((LNCS,volume 14324))

Included in the following conference series:

  • 242 Accesses

Abstract

Graphical models like attack trees and attack graphs provide promising approaches to represent and analyze complex cyber infrastructures. One common analysis that graphical models are used for is to identify short, or other types of critical attack paths. In this paper, we consider attack graphs that are probabilistic, and the attack steps are characterized by multiple parameters, the probability of success, and the distribution of time to perform the attack step. We propose low-complexity solutions to find sets of critical paths according to flexible mean value-based utility functions. We demonstrate that the results are similar to the ones from Monte-Carlo simulations. Consequently, the utility function-based approach can substitute time-consuming simulations and can be a valuable component of dynamic defense strategies.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 89.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 119.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    https://gitlab.com/gnebbia/mgg.

References

  1. Ammann, P., Wijesekera, D., Kaushik, S.: Scalable, graph-based network vulnerability analysis. In: 9th ACM Conference on Computer and Communications Security, pp. 217–224 (2002)

    Google Scholar 

  2. Li, W., Vaughn, R.B.: Cluster security research involving the modeling of network exploitations using exploitation graphs. In: 6th IEEE International Symposium on Cluster Computing and the Grid, vol. 2, p. 26 (2006)

    Google Scholar 

  3. Sheyner, O., Haines, J., Jha, S., Lippmann, R., Wing, J.M.: Automated generation and analysis of attack graphs. In: IEEE Symposium on Security & Privacy, pp. 273–284 (2002)

    Google Scholar 

  4. Fila, B., Widel, W.: Efficient attack-defense tree analysis using pareto attribute domains. In: 32nd IEEE Computer Security Foundations Symposium, pp. 200–215 (2019)

    Google Scholar 

  5. Idika, N., Bhargava, B.: Extending attack graph-based security metrics and aggregating their application. IEEE Trans. Dependable Secure Comput. 9(1), 75–85 (2010)

    Article  Google Scholar 

  6. Leversage, D.J., Byres, E.J.: Estimating a system’s mean time-to-compromise. IEEE Secur. Priv. 6(1), 52–60 (2008)

    Article  Google Scholar 

  7. Ramos, A., Lazar, M., Holanda Filho, R., Rodrigues, J.J.: Model-based quantitative network security metrics: a survey. IEEE Commun. Surv. Tutor. 19(4), 2704–2734 (2017)

    Article  Google Scholar 

  8. Aslanyan, Z., Nielson, F.: Pareto efficient solutions of attack-defence trees. In: Focardi, R., Myers, A. (eds.) POST 2015. LNCS, vol. 9036, pp. 95–114. Springer, Heidelberg (2015). https://doi.org/10.1007/978-3-662-46666-7_6

    Chapter  Google Scholar 

  9. Frank, H.: Shortest paths in probabilistic graphs. Oper. Res. 17(4), 583–599 (1969)

    Article  MathSciNet  MATH  Google Scholar 

  10. Hall, R.W.: The fastest path through a network with random time-dependent travel times. Transp. Sci. 20(3), 182–188 (1986)

    Article  MathSciNet  Google Scholar 

  11. Rasteiro, D., Anjo, A.: Optimal paths in probabilistic networks. J. Math. Sci. 120(1), 974–987 (2004)

    Article  MathSciNet  MATH  Google Scholar 

  12. Xiong, W., Hacks, S., Lagerstrom, R.: A method for assigning probability distributions in attack simulation languages. Complex Syst. Inform. Model. Q. 151(26), 55–77 (2021)

    Article  Google Scholar 

  13. Van Slyke, R.M.: Monte Carlo methods and the pert problem. Oper. Res. 11(5), 839–860 (1963)

    Article  Google Scholar 

  14. Katsikeas, S., et al.: An attack simulation language for the IT domain. In: Eades III, H., Gadyatskaya, O. (eds.) GraMSec 2020. LNCS, vol. 12419, pp. 67–86. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-62230-5_4

    Chapter  Google Scholar 

  15. Wideł, W., Hacks, S., Ekstedt, M., Johnson, P., Lagerström, R.: The meta attack language - a formal description. Comput. Secur. 130, 1–12 (2023)

    Article  Google Scholar 

  16. Kulkarni, V.G.: Shortest paths in networks with exponentially distributed arc lengths. Networks 16(3), 255–274 (1986)

    Article  MathSciNet  MATH  Google Scholar 

  17. Sen, S., Pillai, R., Joshi, S., Rathi, A.K.: A mean-variance model for route guidance in advanced traveler information systems. Transp. Sci. 35(1), 37–49 (2001)

    Article  MATH  Google Scholar 

  18. Khani, A., Boyles, S.D.: An exact algorithm for the mean-standard deviation shortest path problem. Transp. Res. Part B: Methodol. 81, 252–266 (2015)

    Article  Google Scholar 

  19. Hutson, K.R., Shier, D.R.: Extended dominance and a stochastic shortest path problem. Comput. Oper. Res. 36(2), 584–596 (2009)

    Article  MathSciNet  MATH  Google Scholar 

  20. Martins, E.Q.V.: On a multicriteria shortest path problem. Eur. J. Oper. Res. 16(2), 236–245 (1984)

    Article  MathSciNet  MATH  Google Scholar 

  21. Hartley, R.: Vector optimal routing by dynamic programming. Math. Multi Objective Optim. 215–224 (1985)

    Google Scholar 

  22. Warburton, A.: Approximation of pareto optima in multiple-objective, shortest-path problems. Oper. Res. 35(1), 70–79 (1987)

    Article  MathSciNet  MATH  Google Scholar 

  23. Tung, C.T., Chew, K.L.: A multicriteria pareto-optimal path algorithm. Eur. J. Oper. Res. 62(2), 203–209 (1992)

    Article  MATH  Google Scholar 

  24. Sancho, N.: A new type of multi-objective routing problem. Eng. Optim. 14(2), 115–119 (1988)

    Article  Google Scholar 

  25. Wijeratne, A.B., Turnquist, M.A., Mirchandani, P.B.: Multiobjective routing of hazardous materials in stochastic networks. Eur. J. Oper. Res. 65(1), 33–43 (1993)

    Article  MATH  Google Scholar 

  26. Gandibleux, X., Beugnies, F., Randriamasy, S.: Martins’ algorithm revisited for multi-objective shortest path problems with a maxmin cost function. 4OR 4(1), 47–59 (2006)

    Article  MathSciNet  MATH  Google Scholar 

  27. Sarraute, C., Richarte, G., Lucangeli Obes, J.: An algorithm to find optimal attack paths in nondeterministic scenarios. In: 4th ACM Workshop on Security and Artificial Intelligence, pp. 71–80 (2011)

    Google Scholar 

  28. Johnson, P., Lagerstrom, R., Ekstedt, M.: A meta language for threat modeling and attack simulations. In: 13th ACM International Conference on Availability, Reliability and Security, pp. 1–8 (2018)

    Google Scholar 

  29. Steuer, R.: Multiple Criteria Optimization: Theory, Computation, and Application. WILEY Series in Probability and Mathematical Statistics. Wiley, Hoboken (1986)

    Google Scholar 

  30. Dijkstra, E.W.: A note on two problems in connexion with graphs. Numer. Math. 1(1), 269–271 (1959)

    Article  MathSciNet  MATH  Google Scholar 

  31. Yen, J.Y.: Finding the k shortest loopless paths in a network. Manage. Sci. 17(11), 712–716 (1971)

    Article  MathSciNet  MATH  Google Scholar 

  32. Tarjan, R.: Depth-first search and linear graph algorithms. SIAM J. Comput. 1(2), 146–160 (1972)

    Article  MathSciNet  MATH  Google Scholar 

  33. Al Zoobi, A., Coudert, D., Nisse, N.: Space and time trade-off for the k shortest simple paths problem. In: 18th International Symposium on Experimental Algorithms, vol. 160, pp. 1–13 (2020)

    Google Scholar 

  34. Barbehenn, M.: A note on the complexity of Dijkstra’s algorithm for graphs with weighted vertices. IEEE Trans. Comput. 47(2), 263 (1998)

    Article  MathSciNet  MATH  Google Scholar 

  35. Rubin, F.: Enumerating all simple paths in a graph. IEEE Trans. Circ. Syst. 25(8), 641–642 (1978)

    Article  MathSciNet  MATH  Google Scholar 

Download references

Acknowledgment

This work was supported by the Swedish Governmental Agency for Innovation Systems (Vinnova).

Author information

Authors and Affiliations

  1. KTH Royal Institute of Technology, Stockholm, Sweden

    Rajendra Shivaji Patil, Viktoria Fodor & Mathias Ekstedt

Authors
  1. Rajendra Shivaji Patil
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Viktoria Fodor
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Mathias Ekstedt
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Rajendra Shivaji Patil .

Editor information

Editors and Affiliations

  1. OsloMet – Oslo Metropolitan University, Oslo, Norway

    Lothar Fritsch

  2. OsloMet – Oslo Metropolitan University, Oslo, Norway

    Ismail Hassan

  3. OsloMet - Oslo Metropolitan University, Oslo, Norway

    Ebenezer Paintsil

Rights and permissions

Reprints and permissions

Copyright information

© 2024 The Author(s), under exclusive license to Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Patil, R.S., Fodor, V., Ekstedt, M. (2024). Mean Value Analysis of Critical Attack Paths with Multiple Parameters. In: Fritsch, L., Hassan, I., Paintsil, E. (eds) Secure IT Systems. NordSec 2023. Lecture Notes in Computer Science, vol 14324. Springer, Cham. https://doi.org/10.1007/978-3-031-47748-5_8

Download citation

  • DOI: https://doi.org/10.1007/978-3-031-47748-5_8

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-031-47747-8

  • Online ISBN: 978-3-031-47748-5

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation