A Vulnerability-Centric Approach to Network Security Metrics

随着当今的关键基础设施和企业越来越依赖于联网计算机系统，这些系统的安全性对经济和社会至关重要。然而，在我们能够提高网络的安全性之前，我们希望能够测量它，因为“你不能改善你不能测量的东西”。网络安全度量是可取的，因为它允许直接度量网络当前的安全程度，以及引入新的安全机制或配置更改后的安全程度。这种能力将使网络加固的努力成为一门科学，而不是一门艺术。网络安全度量的新兴成果，包括通用漏洞评分系统（CVSS-SIG）标准，通常将数字分数分配给漏洞，作为它们的相对可利用性或可能性。分配通常基于每个漏洞的已知事实（例如，是否需要经过身份验证的用户帐户）。这些方法都有一些局限性。首先，在单独考虑漏洞的情况下，网络安全管理员可能会被误导，因为单个漏洞得分很低，但这些漏洞可以组合起来危及关键资源。其次，当考虑我们没有先验知识或经验的零日漏洞时，该方法不再适用，这实际上导致了对安全度量的现有工作的主要批评，即未知的零日漏洞是不可测量的。第三，分配给漏洞的数值得分通常缺乏良好定义的语义，并且通常与人类分析师可以轻松解释的其他度量（例如时间或美元）无关。本研究将通过提出一种新的以漏洞为中心的方法，通过安全度量对漏洞信息进行定量建模，从而解决这些紧迫的问题。

As today's critical infrastructures and enterprises increasingly rely on networked computer systems, the security of such systems becomes crucial to the economy and society. However, before we can improve the security of a network, it is desirable to be able to measure it, since "you cannot improve what you cannot measure". A network security metric is desirable since it will allow for a direct measurement of how secure a network currently is, and how secure it would be after introducing new security mechanisms or configuration changes. Such a capability will make the effort of network hardening a science rather than an art. Emerging efforts on network security metrics, including the Common Vulnerability Scoring System (CVSS-SIG) standard, typically assign numeric scores to vulnerabilities as their relative exploitability or likelihood. The assignment is usually based on known facts about each vulnerability (e.g., whether it requires an authenticated user account). Such approaches share several limitations. First, by considering vulnerabilities on an individual basis, a network security administrator could be misled in a situation where individual vulnerabilities scores are low but these vulnerabilities can be combined to compromise a critical resource. Second, the methodology is no longer applicable when considering zero day vulnerabilities about which we have no prior knowledge or experience, which in fact leads to a major criticism of existing efforts on security metrics, that is, unknown zero day vulnerabilities are not measurable. Third, the numerical scores assigned to vulnerabilities usually lack a well defined semantic, and are not generally related to other measures that can be easily interpreted by human analysts, such as time or dollars. The proposed research will address these pressing issues by proposing a novel vulnerability-centric approach to quantitatively modeling vulnerability information through security metrics.