Показатели и методики оценки защищенности компьютерных сетей на основе графов атак и графов зависимостей сервисов
Ключевые слова:
показатели защищенности, методика оценки рисков, граф атак, граф зависимостей сервисовАннотация
В данной работе рассматриваются основные направления исследований в области показателей защищенности и вводится сформированная на их основе классификация показателей. Кроме того, предлагается многоуровневый подход к оценке защищенности, включающий систему показателей защищенности и методики их расчета, основанные на графах атак и зависимостях сервисов. Данный подход позволяет оценивать различные аспекты защищенности системы с учетом ее топологии, режима работы, исторических данных об инцидентах и другой информации.Литература
Котенко И.В., Саенко И.Б., Полубелова О.В., Чечулин А.А. Технологии управления информацией и событиями безопасности для защиты компьютерных сетей // Проблемы информационной безопасности. Компьютерные системы. 2012, № 2. С.57–68
Котенко И.В., Дойникова Е.В. Анализ протокола автоматизации управления данными безопасности SCAP // Защита информации. Инсайд, 2012, № 2, С.56-63
Ahmed M.S., Al-Shaer E., Khan L. A novel quantitative approach for measuring network security // Proceedings of the 27th Conference on Computer Communications (INFOCOM'08). 2008. P. 1957–1965
Blakely B.A. Cyberprints Identifying cyber attackers by feature analysis. Doctoral Dissertation: Iowa State University. 2012
The Center for Internet Security, The CIS Security Metrics, 2009
Dantu R., Kolan P., Cangussu J. Network risk management using attacker profiling // Security and Communication Networks, 2009. Vol.2, No.1. P. 83–96
Hoo K.J.S. How much is enough? A risk-management approach to computer security. PhD thesis, Stanford University, CA, 2000
ISO/IEC 27005:2008, Information technology — Security techniques — Information security risk management
Jahnke M., Thul C., Martini P. Graph-based metrics for intrusion response measures in computer networks // Proceedings of the 3rd IEEE Workshop on Network Security, held in conjunction with 32th IEEE Conference on Local Computer Networks. Dublin, 2007
Kanoun W., Cuppens-Boulahia N., Cuppens F., Araujo J. Automated reaction based on risk analysis and attackers skills in intrusion detection systems // Proceedings of the third International Conference on Risks and Security of Internet and Systems (CRiSIS'08). Toezer, Tunisia, 2008. P. 117–124
Kheir N., Cuppens-Boulahia N., Cuppens F., Debar H. A service dependency model for cost-sensitive intrusion response // Proceedings of the 15th European Symposium on Research in Computer Security (ESORICS'10), 2010. P. 626–642
Kotenko I., Chechulin A. Attack Modeling and Security Evaluation in SIEM Systems // International Transactions on Systems Science and Applications, SIWN Press. 2013. ISSN 1751-1461
Kotenko I., Chechulin A. Common Framework for Attack Modeling and Security Evaluation in SIEM Systems // 2012 IEEE International Conference on Green Computing and Communications, Conference on Internet of Things, and Conference on Cyber, Physical and Social Computing. Besançon, France, November 20-23, 2012. Los Alamitos, California. IEEE Computer Society. 2012. P. 94–101
Kotenko I., Stepashkin M. Attack graph based evaluation of network security // Proceedings of the 10th IFIP Conference on Communications and Multimedia Security (CMS'2006). Heraklion, Greece, 2006. P. 216–227
Manadhata P.K., Wing J.M. An attack surface metric // IEEE Transactions on Software Engineering, 2010. P. 371–386
MASSIF FP7 Project. MAnagement of Security information and events in Service Infrastructures. http://www.massif-project.eu
Mayer A. Operational Security Risk Metrics: Definitions, Calculations, Visualizations // Metricon 2.0. CTO RedSeal Systems, 2007
Mell P., Scarfone K., Romanosky S. A Complete Guide to the Common Vulnerability Scoring System Version 2.0, 2007
Peltier T.R. How to complete a risk assessment in 5 days or less // Auerbach publications, 2008. P. 1–55
Olsson T. Assessing security risk to a network using a statistical model of attacker community competence // Proceedings of the 11th international conference on Information and Communications Security, 2009. P. 308–324
Poolsappasit N., Dewri R., Ray I. Dynamic security risk management using Bayesian attack graphs // IEEE Transactions on Dependable and Security Computing, 2012. Vol.9, No.1. P.61–74
Stakhanova N., Basu S., Wong J. A cost-sensitive model for preemptive intrusion response systems // Proceedings of the 21st International Conference on Advanced Networking and Applications, Washington, DC, USA, IEEE Computer Society, 2007. P. 428–435
Wang L., Singhal A., Jajodia S., Noel S. k-zero day safety: measuring the security risk of networks against unknown attacks // Proceedings of the 15th European conference on Research in computer security, Springer-Verlag Berlin, Heidelberg, 2010. P. 573–587
Wu Y.-S., Foo B., Mao Y.-C., Bagchi S., Spafford E.H. Automated adaptive intrusion containment in systems of interacting services // Computer Networks: The International Journal of Computer and Telecommunications Networking, 2007. Vol.51. P. 1334–1360
Котенко И.В., Дойникова Е.В. Анализ протокола автоматизации управления данными безопасности SCAP // Защита информации. Инсайд, 2012, № 2, С.56-63
Ahmed M.S., Al-Shaer E., Khan L. A novel quantitative approach for measuring network security // Proceedings of the 27th Conference on Computer Communications (INFOCOM'08). 2008. P. 1957–1965
Blakely B.A. Cyberprints Identifying cyber attackers by feature analysis. Doctoral Dissertation: Iowa State University. 2012
The Center for Internet Security, The CIS Security Metrics, 2009
Dantu R., Kolan P., Cangussu J. Network risk management using attacker profiling // Security and Communication Networks, 2009. Vol.2, No.1. P. 83–96
Hoo K.J.S. How much is enough? A risk-management approach to computer security. PhD thesis, Stanford University, CA, 2000
ISO/IEC 27005:2008, Information technology — Security techniques — Information security risk management
Jahnke M., Thul C., Martini P. Graph-based metrics for intrusion response measures in computer networks // Proceedings of the 3rd IEEE Workshop on Network Security, held in conjunction with 32th IEEE Conference on Local Computer Networks. Dublin, 2007
Kanoun W., Cuppens-Boulahia N., Cuppens F., Araujo J. Automated reaction based on risk analysis and attackers skills in intrusion detection systems // Proceedings of the third International Conference on Risks and Security of Internet and Systems (CRiSIS'08). Toezer, Tunisia, 2008. P. 117–124
Kheir N., Cuppens-Boulahia N., Cuppens F., Debar H. A service dependency model for cost-sensitive intrusion response // Proceedings of the 15th European Symposium on Research in Computer Security (ESORICS'10), 2010. P. 626–642
Kotenko I., Chechulin A. Attack Modeling and Security Evaluation in SIEM Systems // International Transactions on Systems Science and Applications, SIWN Press. 2013. ISSN 1751-1461
Kotenko I., Chechulin A. Common Framework for Attack Modeling and Security Evaluation in SIEM Systems // 2012 IEEE International Conference on Green Computing and Communications, Conference on Internet of Things, and Conference on Cyber, Physical and Social Computing. Besançon, France, November 20-23, 2012. Los Alamitos, California. IEEE Computer Society. 2012. P. 94–101
Kotenko I., Stepashkin M. Attack graph based evaluation of network security // Proceedings of the 10th IFIP Conference on Communications and Multimedia Security (CMS'2006). Heraklion, Greece, 2006. P. 216–227
Manadhata P.K., Wing J.M. An attack surface metric // IEEE Transactions on Software Engineering, 2010. P. 371–386
MASSIF FP7 Project. MAnagement of Security information and events in Service Infrastructures. http://www.massif-project.eu
Mayer A. Operational Security Risk Metrics: Definitions, Calculations, Visualizations // Metricon 2.0. CTO RedSeal Systems, 2007
Mell P., Scarfone K., Romanosky S. A Complete Guide to the Common Vulnerability Scoring System Version 2.0, 2007
Peltier T.R. How to complete a risk assessment in 5 days or less // Auerbach publications, 2008. P. 1–55
Olsson T. Assessing security risk to a network using a statistical model of attacker community competence // Proceedings of the 11th international conference on Information and Communications Security, 2009. P. 308–324
Poolsappasit N., Dewri R., Ray I. Dynamic security risk management using Bayesian attack graphs // IEEE Transactions on Dependable and Security Computing, 2012. Vol.9, No.1. P.61–74
Stakhanova N., Basu S., Wong J. A cost-sensitive model for preemptive intrusion response systems // Proceedings of the 21st International Conference on Advanced Networking and Applications, Washington, DC, USA, IEEE Computer Society, 2007. P. 428–435
Wang L., Singhal A., Jajodia S., Noel S. k-zero day safety: measuring the security risk of networks against unknown attacks // Proceedings of the 15th European conference on Research in computer security, Springer-Verlag Berlin, Heidelberg, 2010. P. 573–587
Wu Y.-S., Foo B., Mao Y.-C., Bagchi S., Spafford E.H. Automated adaptive intrusion containment in systems of interacting services // Computer Networks: The International Journal of Computer and Telecommunications Networking, 2007. Vol.51. P. 1334–1360
Security metrics and security assessment techniques for the computer networks on the base of the attack graphs
Abstract
The paper considers the last researches in the area of the security metrics. Classification of the known metrics is suggested. Multilevel approach to the security assessment is suggested. It is based on the attack graphs and service dependencies graphs. The approach allows evaluating different aspect of the system security considering its topology, operation mode, historical data about incidents and other information.Опубликован
2013-06-01
Как цитировать
Дойникова, Е. В. (2013). Показатели и методики оценки защищенности компьютерных сетей на основе графов атак и графов зависимостей сервисов. Труды СПИИРАН, 3(26), 54-68. https://doi.org/10.15622/sp.26.4
Раздел
Статьи
Авторы, которые публикуются в данном журнале, соглашаются со следующими условиями:
Авторы сохраняют за собой авторские права на работу и передают журналу право первой публикации вместе с работой, одновременно лицензируя ее на условиях Creative Commons Attribution License, которая позволяет другим распространять данную работу с обязательным указанием авторства данной работы и ссылкой на оригинальную публикацию в этом журнале.
Авторы сохраняют право заключать отдельные, дополнительные контрактные соглашения на неэксклюзивное распространение версии работы, опубликованной этим журналом (например, разместить ее в университетском хранилище или опубликовать ее в книге), со ссылкой на оригинальную публикацию в этом журнале.
Авторам разрешается размещать их работу в сети Интернет (например, в университетском хранилище или на их персональном веб-сайте) до и во время процесса рассмотрения ее данным журналом, так как это может привести к продуктивному обсуждению, а также к большему количеству ссылок на данную опубликованную работу (Смотри The Effect of Open Access).
