Security Optimization of Dynamic Networks with Probabilistic Graph Modeling and Linear Programming
Security Optimization of Dynamic Networks with Probabilistic Graph Modeling and Linear Programming
复制标题
DOI：
10.1109/tdsc.2015.2411264
复制
发表时间：
2016-07
影响因子：
7.3
通讯作者：
Hussain M. J. Almohri;L. Watson;D. Yao;Xinming Ou
中科院分区：
文献类型：
--
作者：
Hussain M. J. Almohri;L. Watson;D. Yao;Xinming Ou
由于复杂的配置和约束，确保大型组织的网络在技术上具有挑战性。管理这些网络需要严格而全面的分析工具。网络管理员需要确定脆弱的配置以及用于硬化网络的工具。这样的网络通常具有动态和流体结构，因此可能有关于主机连接性和可用性的不完整信息。在本文中，我们解决了对一组网络安全防御策略进行严格评估的问题，目的是减少在动态变化且复杂的网络体系结构中成功进行大规模攻击的可能性。我们描述了一种概率图模型和算法，用于分析复杂网络的安全性，以减少成功攻击的可能性的最终目标。我们的模型自然使用了一种可扩展的最新优化技术，称为顺序线性编程，该技术在各种工程问题中进行了广泛应用和研究。与攻击图上的相关解决方案相比，我们的概率模型提供了在网络配置中表达不确定性的机制，在其他地方没有报告。我们已经通过大型组织的现实网络配置数据进行了全面的实验验证。
Securing the networks of large organizations is technically challenging due to the complex configurations and constraints. Managing these networks requires rigorous and comprehensive analysis tools. A network administrator needs to identify vulnerable configurations, as well as tools for hardening the networks. Such networks usually have dynamic and fluidic structures, thus one may have incomplete information about the connectivity and availability of hosts. In this paper, we address the problem of statically performing a rigorous assessment of a set of network security defense strategies with the goal of reducing the probability of a successful large-scale attack in a dynamically changing and complex network architecture. We describe a probabilistic graph model and algorithms for analyzing the security of complex networks with the ultimate goal of reducing the probability of successful attacks. Our model naturally utilizes a scalable state-of-the-art optimization technique called sequential linear programming that is extensively applied and studied in various engineering problems. In comparison to related solutions on attack graphs, our probabilistic model provides mechanisms for expressing uncertainties in network configurations, which is not reported elsewhere. We have performed comprehensive experimental validation with real-world network configuration data of a sizable organization.