Generation and Analysis of Attack Graphs
Chunying Wang, Ning Du, Huijing Yang · Procedia Engineering · 2012
An integral part of modeling the global view of network security is constructing attack graphs. Construction by hand, however, is tedious, error prone, and impractical for attack graphs larger than a hundred nodes. In this paper we present an automated technique for generating and analyzing attack graphs. We base our technique on symbolic model checking algorithms, letting us construct attack graphs automatically and efficiently. We also describe two analyses to help decide which attacks would be most costeffective to guard against. We implemented our technique in a tool suite and tested it on a small network example, which includes models of a firewall and an intrusion detection system.