Cost Minimization for Thwarting Network Attacks

Abstract

An Attack Graph is a graphical representation of possible ways that an intruder can attack a network system through atomic attacks. Based on such graphs, Sheyer et al. have formulated a problem of thwarting a minimum set of atomic attacks (i.e., set T’) to guarantee that the network system won’t be attacked. As thwarting different atomic attacks usually involve different cost, we extend their problem to find a minimum-cost T’. Unlike their approach of using the greedy method to obtain approximate solution of this NP-hard problem, we reduce the minimum-cost problem to solving a set of Integer Programming equations. A Branch and Bound Algorithm can efficiently solve these equations for small cases. For larger cases, the algorithm takes the solution of the greedy method as the initial solution, iteratively improving this solution until that the software program is terminated.