# Multi-Layer Attack Graph Analysis in the 5G Edge Network Using a Dynamic Hexagonal Fuzzy Method
## 5 The New Vulnerability Analysis Approach (VAA)
### Step 1:Develop a scalable attack Graph Generator (GG) model. This model is based on the security attack vector that focuses on the attacks and threats that may harvest intelligence from the 5G network resources, states, and flows as a result of the integration of the NFV and SDN. The basic idea underlying this model is that the attacker's action cost is under the constraint of certain vulnerability and network dynamic factors/indicators of the 5G network such as latency, accessibility, and other factors described in [65]. The vulnerability factors refer to the Common Vulnerability Scoring System (CVSS) factors/indicators namely Base, Temporal, and Environmental. Each of these factors is a composite of other several factors described in [66]. We model this problem as a multi-objective decision-making problem as follows. 1. Create the GG three-layer hierarchical model based on the vulnerability and dynamic network factors, see Figure 6.  
The attack graph is modeled based on these factors. An attack graph is defined as a tuple \(G\) = (\(A\), \(S\), \(T\)), where \(A\) is a set of attack actions, \(S\) is a set of system states, T is a set of targets that the attacker tries to achieve. An attack graph GG consists of a set of nodes of four types, see Figure 5: (1) attack-step nodes (circular-shaped AND-nodes). Each node in this set represents a single attack step that can be carried out when all the predecessors (preconditions to the attack which are either configuration settings or network privileges) are satisfied; (2) Privilege nodes (diamond-shaped nodes): Each node in this set represents a single network privilege. The privilege can be achieved through any one of its predecessor AND node which represents an attack step leading to the privilege. Each node in this set represents a fact about the current network configuration that contributes to one or more attack possibilities (sub-action); (3) Configuration nodes (circular-shaped): Each node in this set represents an initial vulnerability, configuration settings, or network privileges that are known to be true and have no variance in probability; (4) Final step nodes (rectangular-shaped): Each node in this set represents a final exploit action against a certain vulnerability. 1. Construct a pair-wise evaluation matrix \(M\), see Figure 7, based on the attack graph. After that, we compute the combinatorial weights (\(W^{i}\)) which refer to the weight of the impact of each layer's dynamic factors, in the GG three-layer model, on the attacker decision as given in Equation (3). Figure 6: The Hierarchical GG with corresponding factors’ codes. \[W^{i}=(W^{iL}_{j})_{j=1\cdots n}W^{L} \tag{3}\]  
where \(i\) is the GG hierarchical layer index \(\in\) {1,2,3}, \(j\) refers to the dynamic factors, and \(W^{L}\) is the criteria layer combinational weight vector which is computed as given in Equation (4). \[W^{L}=M*W \tag{4}\]  
where \(W\) is the relevant normalized characteristic vector/eigenvector \(=\lambda_{max}*W\), for all \(w\) = (\(w_{1}\), \(w_{2}\), \(w_{3}\),..., \(w_{n}\)). \(\lambda_{max}\) is the largest eigenvalue of matrix \(M\). **Step 2: Compute the attack cost of actions using the classical TOPSIS. **  
To compute the attack cost of actions, we will apply the classical TOPSIS approach as follows. 1. Normalize the pair-wise decision matrix \(M\) to form the normalized decision matrix \(N\) as given in Equation (5). \[N_{ij}=\left(N_{ij}\right)_{m\times n}\] (5) where, \(N_{ij}=\frac{M_{ij}}{\sqrt{\sum_{j=1}^{n}M_{ij}^{2}}}\), \(i=1,2,\ldots,m\),  
Based on the \(L2_{i}{}^{+}\) and \(L2_{i}{}^{-}\) distances, we compute the similarity to the worst condition as the cost of the attacker's actions (\(Atc_{Cost}\)) as shown in Equation (12). \[Atc_{Cost}(i)=\frac{L2_{i}^{-}}{L2_{i}^{+}+L2_{i}^{-}} \tag{12}\]  
where \(i\in\{1,2,\,\ldots,\,m\}\) is the actions the attacker can choose from \(m\) possible actions.