# Network Forensics Method Based on Evidence Graph and Vulnerability Reasoning
## 3 The Proposed Method
### Evidence Reasoning
#### 3.4.1 Vulnerability Relevance Analysis  
Analysis of past attacks that exploited network vulnerabilities indicates that attackers usually use multiple hosts and vulnerabilities to attack a network or a host of nodes. Thus, the relevance of vulnerabilities has become increasingly important in network security. National Vulnerability Database (NVD) [31] has been widely used in various areas. Based on the regular rules of vulnerabilities, we can establish the relationships between vulnerabilities in NVD. Common Vulnerabilities & Exposures (CVE) [32] can be used as a data dictionary to unify the names of information security vulnerabilities or weaknesses. Common Vulnerability Scoring System (CVSS) [33] is a free and open industry standard which can be used to assess and mark security vulnerabilities. The process of scanning vulnerabilities involves four steps: (1) scan the target network; (2) determine the existence of vulnerabilities through comparing with NVD records; (3) query CVE to determine the names of vulnerabilities; and (4) calculate the vulnerability scores through the CVSS vulnerability scoring system. Figure 3: The Algorithm for Constructing an Evidence Graph. Nessus is a popular tool that can be used to scan vulnerabilities to update vulnerability database at any time. Nessus is fully compatible with CVE. To better understand, the following example is used to illustrate the process of constructing vulnerability database. Scanning target 172.18.4.144 using Nessus would identify a vulnerability named \"CVE-2004-2761\" which should appear in the vulnerability report by Nessus. In the report, every vulnerability will have \"Risk information\". In this case, the risk information for \"CVE-2004-2761\" is as follows:  
_Risk Factor: Medium_  
_CVSS Base Score: 4.0_  
_CVSS Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:N_  
_CVSS Temporal Vector: CVSS2#E:ND/RL:OF/RC:C_  
_CVSS Temporal Score: 3.5_  
As shown above, the influence of vulnerability \"CVE-2004-2761\" is medium. Table 2 shows the detail of CVSS base score and Table 3 shows the detail of CVSS temporal Score. From the vulnerability report, we can see all the vulnerabilities as well as the scores of the vulnerabilities of target \"172.18.4.144\". Such information is then stored in a network vulnerability database as shown in Table 4.  
Through this process, we can obtain the vulnerability scores for network hosts and store them in a network vulnerability database that provides information about vulnerabilities of each host in the network. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Host** & **Average Base Score** & **Average Temporal Score** & **Average Score** \\ \hline
172.18.4.144 & 5.4 & 4.55 & 9.95 \\
172.18.4.11 & 6.3 & 3.5 & 9.8 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Network Vulnerability Database. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Base Metric** & **Evaluation** & **Score** \\ \hline Access Vector & Network & 1.0 \\ Access Complexity & High & 0.35 \\ Authentication & None & 0.704 \\ Confidentiality Impact & Partial & 0.275 \\ Integrity Impact & Partial & 0.275 \\ Availability Impact & None & 0.0 \\ Base Score = round\_to\_1\_decimal & (((0.6 \(\times\) Impact) + (0.4 \(\times\) Exploitability) \(-\) 1.5) \(\times\) f(Impact)) \\ Impact = 10.41 \(\times\) (1 \(-\) (1 \(-\) ConfImpact) \(\times\) (1 \(-\) IntegImpact) \(\times\) (1 \(-\) AvailImpact)) \\ Exploitability = 20 \(\times\) Access Vector \(\times\) Access Complexity \(\times\) Authentication \\ f(impact) = 0 if Impact = 0, 1.176 otherwise \\ \hline \hline \end{tabular}
\end{table} 
Table 2: CVSS Base Score. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Base Metric** & **Evaluation** & **Score** \\ \hline Exploitability & Not Defined & 1.0 \\ Remediation Level & Official Fix & 0.87 \\ Report Confidence & Confirmed & 1.0 \\ \hline \hline \multicolumn{3}{c}{Temporal Score = round\_to\_1\_decimal} \\ (Base Score \(\times\) Exploitability \(\times\) Remediation Level \(\times\) Report Confidence) \\ \hline \hline \end{tabular}
\end{table}