Network vulnerability assessment using Bayesian networks

Yu Liu, Hong Man

Research output: Contribution to journalConference articlepeer-review

138 Scopus citations

Abstract

While computer vulnerabilities have been continually reported in laundry-list format by most commercial scanners, a comprehensive network vulnerability assessment has been an increasing challenge to security analysts. Researchers have proposed a variety of methods to build attack trees with chains of exploits, based on which post-graph vulnerability analysis can be performed. The most recent approaches attempt to build attack trees by enumerating all potential attack paths, which are space consuming and result in poor scalability. This paper presents an approach to use Bayesian network to model potential attack paths. We call such graph as "Bayesian attack graph". It provides a more compact representation of attack paths than conventional methods. Bayesian inference methods can be conveniently used for probabilistic analysis. In particular, we use the Bucket Elimination algorithm for belief updating, and we use Maximum Probability Explanation algorithm to compute an optimal subset of attack paths relative to prior knowledge on attackers and attack mechanisms. We tested our model on an experimental network. Test results demonstrate the effectiveness of our approach.

Original languageEnglish
Article number07
Pages (from-to)61-71
Number of pages11
JournalProceedings of SPIE - The International Society for Optical Engineering
Volume5812
DOIs
StatePublished - 2005
EventData Mining, Intrusion Detection, Information Assurance, and Data Networks Security 2005 - Orlando, FL, United States
Duration: 28 Mar 200529 Mar 2005

Keywords

  • Attack graph
  • Bayesian network
  • Network vulnerability

Fingerprint

Dive into the research topics of 'Network vulnerability assessment using Bayesian networks'. Together they form a unique fingerprint.

Cite this