# Multi-Layer Attack Graph Analysis in the 5G Edge Network Using a Dynamic Hexagonal Fuzzy Method
## 7 Compare the Accuracy and Performance of the VAA with the Nessus  
The underlying idea behind the VEA-bility metric [48] is that the security of a network is influenced by many factors, including the severity of existing vulnerabilities, distribution of services, connectivity of hosts, and possible attack paths. These factors are modeled into three network dimensions: Vulnerability, Exploitability, and Attackability. The overall VEA-bility score, a numeric value in the range (0, 10), is a function of these three dimensions, where a lower value implies better security. The VEA-bility metric uses data from three sources: the 5G Edge testbed topology, attack graphs, and scores as assigned by the Common Vulnerability Scoring System (CVSS) [66]. To adjust the VEA-bility metric to validate the accuracy of the vulnerability assessment of the VAA and Nessus, we modify this metric by replacing the asset Attackability factor with the \(Atc_{Cost}(i)\) value at Equation (19) for each set of actions \(i\). We let each vulnerability \(v\), which corresponds to a set of actions \(i\), have an impact score, exploitability score, and temporal score as defined by the CVSS. Impact and exploitability subscores are automatically generated for each common vulnerability identifier based on its CVE name defined by the CVSS, whereas the temporal score requires user input. We then define the severity, \(S\), of a vulnerability to be the average of the impact and temporal scores, Equation (20):  
\[S(v)=(Impact\ Score(v)+Temporal\ Score(v))/2 \tag{20}\]  
The Vulnerability score (\(V\)) of a 5G Edge testbed asset, e.g., UE, MEC server, SDN, NFV,... etc., is an exponential average of the severity scores of the vulnerabilities on the 5G Edge asset, or 10, whichever is lower. The asset Exploitability score (\(E\)) is the exponential average of the exploitability score for all asset vulnerabilities multiplied by the ratio of network services on the asset. The asset Attackability score (\(A\)) refers to the toral CP values for all vulnerabilities at a certain asset. The Attackability score is multiplied by a factor of 10 to produce a number in the range (0, 10), ensuring that all dimensions have the same range. For an asset, \(a\), let \(v\) be an asset vulnerability. We then define the three asset dimensions as shown in Equations (21)-(23):  
\[V(a)=min(10,\ ln\sum e^{S(v)}) \tag{21}\]  
\[E(a)=(min(10,\ ln\sum e^{Explitability\ Score(v)}))\ (\#\ services\ on\ a)/(\#\ network\ services) \tag{22}\]  
\[A(t)=(10)*\sum_{i=1}^{n}a_{CP(i)} \tag{23}\]  
The overall _VEA-bility_ equation for an asset \(a\) is then computed as in Equation (24). \[VEA\text{-}bility_{a}=10\ -\ ((V+E+A)_{a}/3) \tag{24}\]  
To test the performance of the proposed _VEA-bility_ metric for both the VAA and Nessus, we developed an extensive set of scenarios described in Sections 3 and 6 and used the vulnerabilities observed by the Nessus scan [32] and our VAA results after running the attacks scenarios. Figure 12 shows the overall average _VEA-bility_ scores observed in our experiments for the 5G Edge testbed assets. A higher score indicates a more secure configuration, which we call more \"VEA-ble\". Figure 12 shows that the VAA using the classical TOPSIS, on average, is 31.35% more VEA-ble than Nessus. Whereas, the VAA using the Hexagonal Fuzzy TOPSIS method, on average, is 9.65% and 37.84% more VEA-ble than the VAA with the classical TOPSIS and Nessus, respectively. To compare the performance of the VAA and Nessus, we run the experiment based on the above-mentioned six vulnerabilities. Figure 13 shows the performance of the VAA and Nessus in milliseconds. The VAA using the classical TOPSIS, on average, outperforms Nessus and the VAA using the Hexagonal Fuzzy TOPSIS by 27.14% and 11.15%, respectively. The VAA using the classical TOPSIS takes 6151 ms to compute the cost related to all possible paths of the six vulnerabilities while Nessus and the VAA using the Hexagonal Fuzzy TOPSIS take 8445 ms and 6837 ms, respectively, to assess the same six vulnerabilities.