## 8 Using the Repository for Attack Modeling and Security Evaluation  
The hybrid repository was tested for fulfilling the task of attack modeling and security evaluation by using the AMSEC. Figure 10 depicts the interaction of the repository with other components of the AMSEC. Figure 9: Sequence diagram of the repository and client interaction. The _data repository updater_ downloads the open databases of vulnerabilities, attacks, configuration, weaknesses, platforms, and countermeasures from the external environment. The _specification generator_ converts the information about network events, configuration, and security policy, from other SIEM components or from users, into an internal representation. The _attack graph generator_ builds attack graphs (or trees) by modeling sequences of malefactor's attack actions in the analyzed computer network using information about the available attack actions of different types, the services dependencies, the network configuration, and the used security policy. The _security evaluator_ generates combined objects of the attack graphs (routes, threats) and service dependencies, calculates the metrics of combined objects on basis of the security metrics of elementary objects, evaluates the common security level, compares obtained results with requirements, finds \"weak\" places, and generates recommendations on strengthening the security level. The _reports generator_ shows vulnerabilities, detected by the AMSEC, represents \"weak\" places, generates recommendations on strengthening the security level, and depicts other relevant security information. The attack graph generator, the security evaluator and the reports generator are included in the _Security Evaluator_ component. The repository components, as shown in Figure 10, are the _Application server_ (service implementation layer), the _Database server_ (storage layer) and the _GUI_ (presentation layer). For interaction with the AMSEC we have tested two versions of the repository: (1) relational and (2) hybrid. During functioning the AMSEC constantly requests information from the repository in order to get a list of vulnerabilities for a specific set of software and hardware installed on the simulated hosts. Data about vulnerabilities are originally loaded from the NVD database. We performed a set of experiments aimed to estimate the time required for each step of AMSEC functioning. For experiments we used the client and server computers with the following characteristics: processor--Intel(R) Core(TM) i5, 1.80 GHz, RAM--4 Gb, OS--Windows 7. The list of steps of attack modeling and security evaluation contains the following five items:  
Figure 10: Interaction of the repository with the AMSEC. 1. Network model construction (on the basis of source data collected from the network scanner);
2. Vulnerability list formation (on the basis of software and hardware installed on each host);
3. Security evaluation (for each host and for the whole network);
4. Network model modification (according to real network changes, about 10% of all hosts were replaced);
5. Security evaluation (for changed network). When we use the relational repository, the vulnerabilities are stored as strings with the inclusion of logical operands. Analysis of these formulas takes place on the side of the AMSEC components. This separation of functions has led to the increase in the volume of data transmitted over the network and the growth of computational costs. It has been due to the fact that all vulnerabilities have been passed on to the AMSEC, and all formulas have been tested on the side of the AMSEC components. In all, with this implementation of the repository, more than 55 thousand vulnerabilities have been transferred over the network and checked on the side of the AMSEC. The Figure 11 shows the dependency between the time required for different steps of attack modeling and security evaluation process and the amount of hosts in the network.