An attack graph generation framework based on attack patterns

Abstract

Attack graphs have become an essential tool for identifying multi-stage, multi-host attacks within organizational networks. As networks grow more extensive and complex, even experienced security analysts struggle to pinpoint how attackers exploit vulnerabilities across multiple hosts to compromise critical resources. Traditional methods of generating attack graphs face scalability challenges and often require frequent adaptations due to network configuration changes. Our project addresses these issues by introducing a novel attack graph generation framework based on attack patterns. We leverage the power of graph databases to manage large, interconnected datasets efficiently. Our framework uses Common Attack Pattern Enumeration and Classification (CAPEC) to map vulnerabilities to corresponding attack patterns, enabling a comprehensive representation of potential attack paths. By utilizing the Neo4j graph database, we enhance the scalability and practicality of attack graph analysis. This project details the development of our framework, including an efficient algorithm for identifying all possible attack paths within a network. The approach takes into account network configurations, known vulnerabilities, and potential attack patterns, providing a nuanced understanding of a network’s security posture. Our system generates attack graphs dynamically and facilitates interactive analysis, significantly improving the detection and mitigation of security threats. Experimental results demonstrate the effectiveness of our approach in real-world scenarios, highlighting its potential to offer valuable insights for network administrators, security analysts, and researchers. By regularly updating the attack graph based on the latest vulnerability data, our framework ensures timely detection of changes that could pose significant security risks. This work aims to provide a robust and scalable solution for network security analysis, enhancing the ability to monitor and defend against complex, evolving threats.