Analysis and Visualization of Large Complex Multi-Step Cyber Attack Graphs

In Phase I, we have shown the feasibility of our unique attack graph approach: separating different graph types during modeling, integrating abstract and network-specific knowledge for actual attack graph creation, and generating real-time graphs for situational awareness. This unique approach renders appropriate balance for the critical tradeoff between model semantics and scalability, whereas prior art is either too rich in semantics to be scalable, or too simplistic to be truly useful in analysis. In Phase II, we will extend the research. First, we will construct type abstract graphs (TAG) via text mining vulnerability and attack database, and finalize graph generation and analysis algorithms. Second, we will develop a distributed Bayesian inference framework using our multi-agent approach, which will better situational awareness and prediction capability. Third, we will investigate algorithms for action planning and extend the graphical models to application and mission assessment. Finally, the developed models and algorithms will be implemented into a prototype software tool, and we will evaluate the effectiveness of the proposed approach using large-scale simulations and experimentations on actual enterprise networks. Our work will greatly enhance the research and practice aiming at practical and useful software tool to aid security analysis in normal and attack situations.