# Network Security Node-Edge Scoring System Using Attack Graph Based on Vulnerability Correlation
## 3 Vulnerability Correlation and Attack Graph-Based Node-Edge Scoring System  
In this paper, we propose VCAG-SS, a node-edge vulnerability correlation analysis method for attack graph-based optimized attack route detection. The nodes PCs, servers, users, and the like are included in the network, and node information includes IP, access location, and CVE information. Further, the edge refers to the relationship between the vulnerabilities of the nodes. For example, assuming that CVEi and CVEj vulnerabilities exist, CVEi steals administrator information through an attack, and CVEj performs an attack under the precondition that it has the authority of an administrator, then this indicates that CVEi is an attack that must be carried out before CVEj is performed. Therefore, the vulnerability correlation analysis identifies the relationship between the vulnerabilities existing between the two nodes. The information collected in this way calculates the individual risk of nodes and edges through the VCAG-SS, and the overall risk score for the attack route is calculated by adding the node risk score and the edge risk score of the attack route. For the node risk, the CVSS score is used, and for the edge risk, the access location, attack type, CIA, and correlation are used. The proposed method calculates the edge weight using the correlation index between vulnerabilities and the CIA values for each access location, attack target, and vulnerability; through this, the node-edge value that provides the optimal route at the minimum cost is identified. The proposed method can be expressed as:  
\[VCAG-SS_{route}=(nodeRank_{route}+arsRank_{route})*Path_{route} \tag{1}\]  
Based on the node risk, edge risk, and number of routes, the attack priority risk is calculated for the corresponding route. The node risk is determined as in Equation (2), and the CVSS score of the vulnerability occurring in the node is used. The edge risk is as expressed in Equation (3), and the evaluation is performed with the access method of the two nodes, the type of attack performed on each node, the CIA, and the correlation between the two nodes.  
\[nodeRank=CVSS_{node}\ Score \tag{2}\]  
\[arsRank=w_{1}AL+w_{2}AT+w_{3}CIA+w_{4}CCI \tag{3}\]  
Equations (4)-(6) are the methods used to obtain each item of the edge risk, where \(AL\) is the access location, \(AT\) is the target of attack, \(CIA\) is the CIA value for each vulnerability, and \(CCI\) is the correlation index between vulnerabilities. \(w_{1}\), \(w_{2}\), \(w_{3}\), and \(w_{4}\), respectively, refer to the weights according to the access location, attack target, CIA value for each vulnerability, and the correlation index between vulnerabilities, which are arbitrarily calculated by the user according to the relative importance of the four values. The \(AL\) values are calculated according to the proposed method with the access methods (network, local, etc.) of two nodes. To determine which attack method was used in the attack type, the CIA used the CVSS-based CIA of the vulnerability. The vulnerability correlation index can be used by experts to evaluate the correlation between possible vulnerabilities in the two nodes.  
\[\textit{Access Location}\ (AL)=\textit{Node}_{i}\ \textit{AL weight}*\ \textit{Node}_{j}\ \textit{AL weight} \tag{4}\]  
\[\textit{Attack Type}\ (AT)=\frac{number\ of\ attack_{i}}{\sum_{k=1}^{n}{k_{attack_{i}}}} \tag{5}\]  
\[CIA=CVSS_{confidentiality}+CVSS_{intergity}+CVSS_{availability} \tag{6}\]  
\[\textit{CVE correlation index}\ (CCI)=c_{i,j} \tag{7}\]