A Vulnerability-Centric Approach to Network Security Metrics

随着当今的关键基础设施和企业越来越依赖于联网的计算机系统，这类系统的安全对经济和社会变得至关重要。然而，在我们能够提高网络的安全性之前，我们希望能够测量它，因为“你不能改进你不能测量的东西”。网络安全度量是可取的，因为它将允许直接测量网络当前的安全程度，以及引入新的安全机制或配置更改后网络的安全程度。这样的能力将使网络加固的努力成为一门科学，而不是一门艺术。网络安全指标方面的新兴努力，包括通用漏洞评分系统(CVSS-SIG)标准，通常会将数字分数作为漏洞的相对可利用性或可能性。分配通常基于有关每个漏洞的已知事实(例如，它是否需要经过身份验证的用户帐户)。这些方法有几个共同的局限性。首先，通过单独考虑漏洞，网络安全管理员可能会在单个漏洞得分较低但这些漏洞可以组合在一起危及关键资源的情况下受到误导。其次，在考虑我们事先不知道或没有经验的零日漏洞时，这种方法不再适用，这实际上导致了对现有安全度量努力的重大批评，即未知的零日漏洞是不可测量的。第三，分配给漏洞的数字分数通常缺乏定义良好的语义，并且通常与人类分析人员可以轻松解释的其他衡量标准无关，例如时间或金钱。拟议的研究将通过提出一种新的以漏洞为中心的方法来解决这些紧迫的问题，以通过安全度量对漏洞信息进行量化建模。

As today's critical infrastructures and enterprises increasingly rely on networked computer systems, the security of such systems becomes crucial to the economy and society. However, before we can improve the security of a network, it is desirable to be able to measure it, since "you cannot improve what you cannot measure". A network security metric is desirable since it will allow for a direct measurement of how secure a network currently is, and how secure it would be after introducing new security mechanisms or configuration changes. Such a capability will make the effort of network hardening a science rather than an art. Emerging efforts on network security metrics, including the Common Vulnerability Scoring System (CVSS-SIG) standard, typically assign numeric scores to vulnerabilities as their relative exploitability or likelihood. The assignment is usually based on known facts about each vulnerability (e.g., whether it requires an authenticated user account). Such approaches share several limitations. First, by considering vulnerabilities on an individual basis, a network security administrator could be misled in a situation where individual vulnerabilities scores are low but these vulnerabilities can be combined to compromise a critical resource. Second, the methodology is no longer applicable when considering zero day vulnerabilities about which we have no prior knowledge or experience, which in fact leads to a major criticism of existing efforts on security metrics, that is, unknown zero day vulnerabilities are not measurable. Third, the numerical scores assigned to vulnerabilities usually lack a well defined semantic, and are not generally related to other measures that can be easily interpreted by human analysts, such as time or dollars. The proposed research will address these pressing issues by proposing a novel vulnerability-centric approach to quantitatively modeling vulnerability information through security metrics.