In today's networked environments, protecting critical resources usually requires us to understand and measure the likelihood of multi-step attacks that combine different vulnerabilities for reaching the attack goal.  Such a measurement is now feasible due to a qualitative model of causal... See full abstract

In today's networked environments, protecting critical resources usually requires us to understand and measure the likelihood of multi-step attacks that combine different vulnerabilities for reaching the attack goal.  Such a measurement is now feasible due to a qualitative model of causal relationships between vulnerabilities, nammely, attack graph.  This paper proposes an attack graph-based probabilistic metric for measuring network security and studies its efficient computation.  We first define the basic metric and provide an intuitive and meaningful interpretation to the metric.  We then study the definition in more complex attack graphs with cycles and extend the definition accordingly.  We show that computing the metric by definition is not efficient in many cases and propose heuristics to improve the efficiency of such computation.
Hide full abstract