Network Attack Surface: Lifting the Attack Surface Concept to Network Level for Evaluating the Resilience against Zero-Day Attacks

The concept of attack surface has seen many applications in various domains, e.g., software security, cloud security, mobile device security, Moving Target Defense (MTD), etc. However, in contrast to the original attack surface metric, which is formally and quantitatively defned for a software, most of the applications at higher abstraction levels (e.g., the network level) are limited to an intuitive and qualitative notion, losing the power of the original concept. In this paper, we lift the attack surface concept to the network level as a security metric for evaluating the resilience of networks against potential zero day attacks. Specifcally, we tackle two main challenges as follows. First, we develop models for addressing the incompatibility between the original attack surface model and the need for average across different resources inside a network. Second, we design heuristic algorithms to signifcantly reduce the complexity of calculating the network attack surface. Finally, we confrm the effectiveness of the proposed algorithms through simulation results.