Capturing the uncertain aspects in cyber security is important for security analysis in enterprise networks. However, there has been insufficient effort in studying what modeling approaches correctly capture such uncertainty, and how to construct the models to make them useful in practice. In this paper, we present our work on justifying uncertainty modeling for cyber security, and initial evi dence indicating that it is a useful approach. Our work is centered around near real-time security analysis such as intrusion response. We need to know what is really happen ing, the scope and severity level, possible consequences, and potential countermeasures. We report our current efforts on identifying the important types of uncertainty and on using Bayesian networks to capture them for enhanced security analysis. We build an example Bayesian network based on a current security graph model, justify our mod eling approach through attack semantics and experimental study, and show that the resulting Bayesian network is not sensitive to parameter perturbation.
Xie et al. REF proposed to use Bayesian network on justifying the important types of uncertainty in real time security analysis.
Using Bayesian networks for cyber security analysis
2010 IEEE/IFIP International Conference on Dependable Systems & Networks (DSN)
2010 IEEE/IFIP International Conference on Dependable Systems & Networks (DSN)
Computer Science