Совершенствование графов атак для мониторинга кибербезопасности: оперирование неточностями, обработка циклов, отображение инцидентов и автоматический выбор защитных мер

Both timely and adequate response on the computer security incidents and organization losses from the computer attacks depend on the accuracy of situation recognition under the cybersecurity monitoring. The paper is devoted to the enhancement of the attack models in the form of attack graphs for the cybersecurity monitoring tasks. A number of important issues related to the application of attack graphs and their solutions are considered. They include inaccuracies in the definition of the pre- and post-conditions of attack actions, the processing of attack graph cycles for the application of Bayesian inference for the attack graph analysis, the mapping of security incidents on an attack graph, the automatic countermeasure selection in case of a high security risk level. The paper demonstrates a software prototype of the security monitoring system component which was earlier implemented and modified considering the suggested enhancements. The results of experiments are described. The influence of the modifications on the cybersecurity monitoring results is shown on a case study.Своевременность и адекватность реагирования на инциденты компьютерной безопасности, а также потери организаций от компьютерных атак, зависят от точности определения ситуации при мониторинге кибербезопасности. Статья посвящена совершенствованию моделей атак в виде графов для задач мониторинга кибербезопасности. Рассматривается ряд актуальных проблем, связанных с использованием графов атак, и способов их решения, в том числе оперирование неточностями при определении пред- и постусловий выполнения атакующих действий, обработка циклов при использовании байесовского вывода для анализа графа атак, отображение инцидентов на графе атак, а также автоматический выбор защитных мер в случае высокого уровня риска. Представлен реализованный ранее и модифицированный с учетом предложенных изменений программный прототип компонента системы мониторинга кибербезопасности и результаты экспериментов. Влияние изменений на результаты мониторинга кибербезопасности показано на примере оценки защищенности фрагмента компьютерной сети

Analytical attack modeling and security assessment based on the common vulnerability scoring system

The paper analyzes an approach to the analytical attack modeling and security assessment on the base of the Common Vulnerability Scoring System (CVSS) format, considering different modifications that appeared in the new version of the CVSS specification. The common approach to the analytical attack modeling and security assessment was suggested by the authors earlier. The paper outlines disadvantages of previous CVSS version that influenced negatively on the results of the attack modeling and security assessment. Differences between new and previous CVSS versions are analyzed. Modifications of the approach to the analytical attack modeling and security assessment that follow from the CVSS modifications are suggested. Advantages of the modified approach are described. Case study that illustrates enhanced approach is provided

Detection, control and mitigation system for secure vehicular communication

The increase in the safety and privacy of automated vehicle drivers against hazardous cyber-attacks will lead to a considerable reduction in the number of global deaths and injuries. In this sense, the European Commission has focused attention on the security of communications in high-risk systems when receiving a cyber-attack such as automated vehicles. The project SerIoT comes up as an possible solution, providing a useful open and reference framework for real-time monitoring of the traffic exchanged through heterogeneous IoT platforms. This system is capable of recognize suspicious patterns, evaluate them and finally take mitigate actions. The paper presents a use case of the SerIoT project related to rerouting tests in vehicular communication. The goal is to ensure secure and reliable communication among Connected Intelligent Transportation Systems (C-ITS) components (vehicles, infrastructures, etc) using the SerIoT's system capabilities to detect and mitigate possible network attacks. Therefore, fleet management and smart intersection scenarios were chosen, where vehicles equipped with On Board Units (OBU) interact with each other and Road Side Units (RSU) to accomplish an optimal flow of traffic. These equipments use the SerIoT systems to deal with cyber-attacks such as Denial of Service (DoS). Tests have been validated in different scenarios under threats situations. It shows the great performance of the SerIoT system taking the corresponding actions to ensure a continuous and safety traffic flow