@conference {24,
	title = {Risk Management Using Behavior Based Bayesian Networks},
	booktitle = {Proceedings of the 2005 IEEE International Conference on Intelligence and Security Informatics},
	year = {2005},
	publisher = {Springer-Verlag},
	organization = {Springer-Verlag},
	address = {Atlanta, GA},
	abstract = {<p>Security administration is an uphill task to implement in an enterprise network providing secured corporate services. With the slew of patches being released by Microsoft, HP and other vendors, system administrators require a barrage of tools for analyzing the risk due to these vulnerabilities. In addition to this, criticalities in patching some end hosts (eg., in hospitals) raises serious security issues about the network to which the end hosts are connected. In this context, it would be imperative to know the risk level of all critical resources (e.g., Oracle Server in HR department) keeping in view the everyday emerging new vulnerabilities. We hypothesize that sequence of network actions by an attacker depends on the social behavior (e.g., skill level, tenacity, financial ability). We extended this and formulated a mechanism to estimate the risk level of critical resources that may be compromised based on attacker behavior. This estimation is accomplished using behavior based attack graphs. These graphs represent all the possible attack paths to all the critical resources. Based on these graphs, we calculate the risk level of a critical resource using Bayesian methodology and periodically update the subjective beliefs about the occurrence of an attack. Such a calculated risk level would be a measure of the vulnerability of the resource and it forms an effective basis for a system administrator to perform suitable changes to network configuration. Thus suitable vulnerability analysis and risk management strategies can be formulated to efficiently curtail the risk from different types of attackers (script kiddies, hackers, criminals and insiders).</p>
},
	isbn = {3-540-25999-6, 978-3-540-25999-2},
	doi = {10.1007/11427995_10},
	url = {http://dx.doi.org/10.1007/11427995_10},
	author = {Ram Dantu and Kolan, Prakash}
}
@conference {11,
	title = {Risk Management Using Behavior Based Attack Graphs},
	booktitle = {Proceedings of the International Conference on Information Technology: Coding and Computing (ITCC{\textquoteright}04) Volume 2 - Volume 2},
	year = {2004},
	publisher = {IEEE Computer Society},
	organization = {IEEE Computer Society},
	address = {Washington, DC, USA},
	abstract = {<p>Security administration is an uphill task to implement inan enterprise network providing secured corporateservices. With the slew of patches being released byMicrosoft, HP and other vendors, system administratorsrequire a barrage of tools for analyzing the risk due tothese vulnerabilities. In addition to this, criticalities inpatching some end hosts (eg., in hospitals) raises serioussecurity issues about the network to which the end hostsare connected. In this context, it would be imperative toknow the risk level of all critical resources (e.g., OracleServer in HR department) keeping in view the everydayemerging new vulnerabilities. We hypothesize thatsequence of network actions by an attacker depends onthe social behavior (e.g., skill level, tenacity, financialability). By verifying our hypothesis on hacker emailcommunications, we extended this methodology andcalculated risk level for a small network. Towards thisgoal, we formulated a mechanism to estimate the risklevel of critical resources that may be compromisedbased on attacker behavior. This estimation isaccomplished using behavior based attack graphs. Thesegraphs represent all the possible attack paths to all thecritical resources. Based on these graphs, we calculatethe risk level of a critical resource using Bayesianmethodology and periodically update the subjectivebeliefs about the occurrence of an attack Such acalculated risk level would be a measure of thevulnerability of the resource and it forms an effectivebasis for a system administrator to perform suitablechanges to network configuration. Thus suitablevulnerability analysis and risk management strategiescan be formulated to efficiently curtail the risk fromdifferent types of attacker (script kiddies, hackers,criminals and insiders).</p>
},
	isbn = {0-7695-2108-8},
	url = {http://dl.acm.org/citation.cfm?id=977403.978389},
	author = {Ram Dantu and Loper, Kall and Kolan, Prakash}
}
