A model-based semi-quantitative approach for evaluating security of enterprise networks

A challenging issue in Enterprise Risk Management (ERM) is to quantify network attributes with respect to security. This paper presents a model-based semi-quantitative approach for evaluating the security of enterprise networks. Instead of focusing on particular attacks/intrusions, our approach aims at characterizing attacker behaviors by examining attacker intent, objective, and attack consequence, which are essential for enforcing an attack scheme. In particular, an attack scheme involving several atomic attacks is formulated as a partially observable Markov decision process: a goal-directed attacker takes a sequence of actions to achieve the malicious goal, and a reward signal is used as feedback to integrate the attacker's intent, cost and objective and guides its advances. It is also used to measure attack impact, from security analyst's economic perspective, by considering the significance of network assets. Our approach provides network administrators a useful tool for performing better countermeasures during the risk management process. We carry out a real trace study to demonstrate its feasibility in practice and validate its performance.