# Network Forensics Method Based on Evidence Graph and Vulnerability Reasoning
## 3 The Proposed Method
### Evidence Reasoning
#### 3.4.2 Vulnerability Evidence Reasoning Algorithm  
We propose a Vulnerability Evidence Reasoning Algorithm (VERA) based on the evidence graph and the network vulnerability database. The algorithmic procedure is illustrated in Figure 4. Using this algorithm, we can infer attacked nodes as well as attacking routes. In VERA, each network node has two important values: the degree of importance of the node (called Nodeworth) and that of the links (Linkworth). Nodeworth is defined as the value of vulnerabilities that a host has while Linkworth is the sum of the Nodeworth of all the nodes that have outgoing links to the node. In our case, the value of Nodeworth is the summation of the average base score and the average temporal score, as illustrated in Table 4. If a network host is vulnerable, it can be easily attacked and compromised. The initial value of Nodeworth is the average value of the vulnerability of a node.  
Following are the steps of the VERA algorithm to be applied to network forensics:  
1. H is the adjacency matrix for the evidence graph assuming that the set of nodes \(N=\{n_{1},n_{2},\ldots,n_{n}\}\). For any node \(n_{i}\)\(\in\)\(N\), \(y_{i}\) is the Nodeworth of the node, \(z_{i}\) is the Linkworth of the node, \(A_{i}\) is the set of nodes that have outgoing links to the node, and \(B_{i}\) is the set of nodes to which this node has outgoing links. \(Z\) is the Linkworth of all the nodes.  
Figure 4: The Procedure for Vulnerability Evidence Reasoning.  
2. Initialize Nodeworth vector \(y\) and Linkworth vector: \[y^{0}=\left(\frac{Vul_{1}}{\sqrt{n}},\frac{Vul_{2}}{\sqrt{n}},\ldots,\frac{Vul_{n }}{\sqrt{n}}\right)^{T}\] (1) \[z^{0}=\left(\frac{1}{\sqrt{n}},\frac{1}{\sqrt{n}},\ldots,\frac{1}{\sqrt{n}} \right)^{T}\] (2) Then, (\(Vul_{1}\), \(Vul_{2}\), \(\ldots\), \(Vul_{n}\)) is the average vulnerability score of a host node.
3. At the kth iteration, the Nodeworth of node \(n_{i}\) is \(y_{i}^{k}\) which is equal to the sum of \(z_{i}\), i.e., \(y=\mathrm{H}^{\mathrm{T}}\mathrm{Z}\). \[y_{i}^{k}=\sum_{i\subseteq A_{i}}z_{i}\] (3)
4. After a new Nodeworth vector \(y\) is obtained in the previous step, the Linkworth of the host is the sum of \(y_{i}\). i.e., \(Z=\mathrm{H}y\). \[z_{i}^{k}=\sum_{i\subseteq B_{i}}y_{i}\] (4)
5. The sum of each vector is equal to 1. Thus, execute the two steps until they converge. \[\sum_{i=1}^{n}y_{i}^{2}=1,\sum_{i=1}^{n}z_{i}^{2}=1\] (5)  
\(Y\) contains the Nodeworth values of all the nodes which are sorted in an ascending order. The more vulnerable a node is, the higher the score of the node. \(Z\) contains the Linkworth values of all the nodes in the descending order. If a link connects important nodes, it is easy to be attacked. In addition to the definitions of Nodeworth and Linkworth, we can also consider the relevance of vulnerability. We can thus consider a node with a high Nodeworth value to be a potential candidate of the attack and a node with a high Linkworth value to be a potential victim. Based on network vulnerability and the result of VERA, we can identify the attacker and the victim in the evidence graph and reconstruct the attack scenario.