Research on Network Node Correlation in Network Risk Assessment
Zhang Yong · Chinese Journal of Computers · 2007
In the field of network risk assessment, to enhance the accuracy of assessment, the connectivity between network nodes has been introduced to many studies. However, this characteristic is not sufficient for expressing certain special logical relations over physical connective relations between nodes, such as one party′s control on particular resources of the other party. Therefore, this paper introduces a conception of network node correlation (NNC). Through analyzing several access scenarios in practice, this paper proposes a NNC taxonomy, then discusses NNC detection methods, and an example is given to illustrate the application and effect of NNC in network risk assessment. Deep analysis and comparison show that using NNC can help to correlate some isolated vulnerabilities to analyze the security risk of networks. Moreover, NNC adds privilege relations between network nodes on the basis of the connectivity of protocol layers so that using NNC also helps to improve the accuracy of detecting network vulnerabilities and attacks.