Tracking the bad guys: an efficient forensic methodology to trace multi-step attacks using core attack graphs
| Autor: | Rabih Mohsen, Rodrigo Vieira Steiner, Martín Barrère, Emil Lupu |
|---|---|
| Přispěvatelé: | Engineering & Physical Science Research Council (EPSRC) |
| Rok vydání: | 2017 |
| Předmět: |
Technology
Theoretical computer science Computer science Network security Core graphs Digital forensics 0211 other engineering and technologies Network size 02 engineering and technology Network topology Engineering Digital evidence 0202 electrical engineering electronic engineering information engineering Core attack graphs RISK 021110 strategic defence & security studies Science & Technology business.industry 020206 networking & telecommunications Engineering Electrical & Electronic Attack graph Complex network Forensic investigations Telecommunications Algorithm design business Attack graphs |
| Zdroj: | 13th International Conference on Network and Service Management (CNSM'17) CNSM |
| Popis: | In this paper, we describe an efficient methodology to guide investigators during network forensic analysis. To this end, we introduce the concept of core attack graph, a compact representation of the main routes an attacker can take towards specific network targets. Such compactness allows forensic investigators to focus their efforts on critical nodes that are more likely to be part of attack paths, thus reducing the overall number of nodes (devices, network privileges) that need to be examined. Nevertheless, core graphs also allow investigators to hierarchically explore the graph in order to retrieve different levels of summarised information. We have evaluated our approach over different network topologies varying parameters such as network size, density, and forensic evaluation threshold. Our results demonstrate that we can achieve the same level of accuracy provided by standard logical attack graphs while significantly reducing the exploration rate of the network. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|