# Network Security Node-Edge Scoring System Using Attack Graph Based on Vulnerability Correlation
## 5 Conclusions  
In this paper, we proposed a method for defining node and edge values based on the information of the network, accordingly calculating the risk of each node and edge, and calculating the risk of a specific attack path through this. In previous research, the information contained in the node was used preferentially; in particular, the vulnerability scores provided by CVSS were used. However, in this study, we aimed to solve the problems associated with previous studies by proposing a method to calculate edge risk along with these values. A formula for calculating edge risk score was defined; access location, attack type, CIA, and correlation were calculated; and we attempted to use correlation to calculate more accurate risk scores through a vulnerability correlation analysis of two nodes. In the process of calculating the edge risk score, by analyzing the link between the two nodes, it was possible to determine which node was more dangerous when moving from one node to the next. This method also helped reduce the error of the risk generated by calculating the risk using only the CVSS information held by previous research. For the experiment, a network was built, an attack route was defined, and the risk level for each attack route was finally calculated. As a result of the experiment, the risks for 12 nodes and 13 edges were calculated, and through this, the risk score increased as the number of vulnerabilities increased or the number of nodes that could go through the node increased. In the edge risk score, it was confirmed that the risk was calculated differently depending on the prerequisites required for the vulnerability even if the two nodes were the same, and even if the two edges started from the same node, the risk varied depending on which vulnerability the arrival node had. Moreover, we calculated the risk score for six attack routes, and it was confirmed that the higher the risk calculated through nodes and edges, the higher the risk, which depended on the correlation between the states of the nodes \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Attack Route** & **Proposed** & **WIVSS**[16] & **Attack Route** & **Proposed** & **WIVSS**[16] \\ \hline Route 1 & 3.7075 & 4.7299 & Route 4 & 5.2433 & 7.2499 \\ \hline Route 2 & 4.0052 & 5.1247 & Route 5 & 4.1612 & 5.4416 \\ \hline Route 3 & 4.5398 & 6.1016 & Route 6 & 4.9278 & 6.6999 \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Comparative experimental results. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Attack Route (Path)** & **VCAG-SS Score** & **Attack Route (Path)** & **VCAG-SS Score** \\ \hline Route 1 (5) & 3.7075 & Route 4 (6) & 5.2433 \\ \hline Route 2 (6) & 4.0052 & Route 5 (5) & 4.1612 \\ \hline Route 3 (5) & 4.5398 & Route 6 (6) & 4.9278 \\ \hline \hline \end{tabular}
\end{table} 
Table 9: VCAG-SS risk assessment results according to attack vectors. included in the attack path and the vulnerability. In addition, we confirmed the number of paths according to the attack route, and we confirmed that the states of the nodes and edges included in it was more important than the number of paths. Unlike previous research, this paper proposed a method of measuring risk score by defining an edge rather than improving its own values of the CVSS. This made it possible to calculate a simple and effective attack route risk score. However, since the values of CVSS 2.0 were used as is, the values were old, and an association analysis between nodes was performed, but the pre and post conditions of vulnerabilities were judged through experts, so a more accurate analysis should be conducted. Therefore, in future research, we will propose a more sophisticated risk calculation method by constructing a more complex network data set, calculating the risk along the attack path, and upgrading the node risk and edge risk. Further, since the number of paths to go through increases as the network becomes larger, we will also study how to effectively apply the number of paths to the attack vector risk. Conceptualization, S.-S.H.