A structural framework for modeling multi-stage network attacks

Kristopher Daley, Ryan Larson, Jerald Dawkins

Research output: Contribution to journalArticlepeer-review

37 Scopus citations

Abstract

Incidents such as Solar Sunrise and Nimda demonstrate the need to expressively model distributed and complex network attacks. To protect information systems, system administrators must be able to represent vulnerabilities in a way that lends itself to correlation, analysis, and prediction. State of the art intrusion detection and attack analysis systems struggle to effectively represent sophisticated attacks. Strategic models express exploits as goal-oriented attack trees. Attack trees represent adversarial behavior by connecting events in 'AND'-'OR' tree structures. However these structures need to be enhanced and expressed in a formal manner in order to adequately represent the complexity of recent cyber attacks. This paper provides a methodology for capturing the structure of various network vulnerabilities and multi-stage attacks. By extending the attack tree paradigm, we provide a context sensitive attack modeling framework that, through abstraction, supports incident correlation, analysis, and prediction.

Original languageEnglish
Article number1039705
Pages (from-to)5-10
Number of pages6
JournalProceedings of the International Conference on Parallel Processing Workshops
DOIs
StatePublished - 2002
Externally publishedYes

Fingerprint

Dive into the research topics of 'A structural framework for modeling multi-stage network attacks'. Together they form a unique fingerprint.

Cite this