Capturing the uncertain aspects in cyber security is important for security analysis in enterprise networks. However, there has been insufficient effort in studying what modeling approaches correctly capture such uncertainty, and how to construct the models to make them useful in practice. In this paper, we present our work on justifying uncertainty modeling for cyber security, and initial evi dence indicating that it is a useful approach. Our work is centered around near real-time security analysis such as intrusion response. We need to know what is really happen ing, the scope and severity level, possible consequences, and potential countermeasures. We report our current efforts on identifying the important types of uncertainty and on using Bayesian networks to capture them for enhanced security analysis. We build an example Bayesian network based on a current security graph model, justify our mod eling approach through attack semantics and experimental study, and show that the resulting Bayesian network is not sensitive to parameter perturbation.
Bayesian Network. Bayesian network has been employed in a number of studies for cyber security defense. REF presented a BN modeling approach which modeled three uncertainty types in the security analysis process.
Using Bayesian networks for cyber security analysis
2010 IEEE/IFIP International Conference on Dependable Systems & Networks (DSN)
2010 IEEE/IFIP International Conference on Dependable Systems & Networks (DSN)
Computer Science