02241nas a2200313   4500008004100000245008900041210006900130260003100199520128100230653002101511653001801532653001801550653002101568653001301589653002001602653002201622653002001644653002501664653004701689653002001736653001301756653002801769653002701797100001501824700001901839700001601858700001601874856003701890       2007                        eng d00aClassification of Attributes and Behavior in Risk Management Using Bayesian Networks0 aClassification of Attributes and Behavior in Risk Management Usi  aNew Brunswick, NJc05/20073 a<p>Security administration is an uphill task to implement in an enterprise network providing secured corporate services. With the slew of patches being released by network component vendors, system administrators require a barrage of tools for analyzing the risk due to vulnerabilities in those components. In addition, criticalities in patching some end hosts raises serious security issues about the network to which the end hosts are connected. In this context, it would be imperative to know the risk level of all critical resources keeping in view the everyday emerging new vulnerabilities. We hypothesize that sequence of network actions by attackers depends on their social and attack profile (behavioral resources such as skill level, time, and attitude). To estimate the types of attack behavior, we surveyed individuals for their ability and attack intent. Using the individuals' responses, we determined their behavioral resources and classified them as having opportunist, hacker, or explorer behavior. The profile behavioral resources can be used for determining risk by an attacker having that profile. Thus, suitable vulnerability analysis and risk management strategies can be formulated to efficiently curtail the risk from different types of attackers.</p>
10aattack behaviour10aattack graphs10aattack intent10aBayesian network10abehavior10abelief networks10aexplorer behavior10ahacker behavior10aopportunist behavior10aprofile behavioral resource classification10arisk management10aSecurity10asecurity administration10avulnerability analysis1 aDantu, Ram1 aKolan, Prakash1 aAkl, Robert1 aLoper, Kall  uhttps://nsl.cse.unt.edu/node/22202256nas a2200145   4500008004100000020001800041245005500059210005500114260004700169520179200216100001502008700001602023700001902039856005202058       2004                        eng d  a0-7695-2108-800aRisk Management Using Behavior Based Attack Graphs0 aRisk Management Using Behavior Based Attack Graphs  aWashington, DC, USAbIEEE Computer Society3 a<p>Security administration is an uphill task to implement inan enterprise network providing secured corporateservices. With the slew of patches being released byMicrosoft, HP and other vendors, system administratorsrequire a barrage of tools for analyzing the risk due tothese vulnerabilities. In addition to this, criticalities inpatching some end hosts (eg., in hospitals) raises serioussecurity issues about the network to which the end hostsare connected. In this context, it would be imperative toknow the risk level of all critical resources (e.g., OracleServer in HR department) keeping in view the everydayemerging new vulnerabilities. We hypothesize thatsequence of network actions by an attacker depends onthe social behavior (e.g., skill level, tenacity, financialability). By verifying our hypothesis on hacker emailcommunications, we extended this methodology andcalculated risk level for a small network. Towards thisgoal, we formulated a mechanism to estimate the risklevel of critical resources that may be compromisedbased on attacker behavior. This estimation isaccomplished using behavior based attack graphs. Thesegraphs represent all the possible attack paths to all thecritical resources. Based on these graphs, we calculatethe risk level of a critical resource using Bayesianmethodology and periodically update the subjectivebeliefs about the occurrence of an attack Such acalculated risk level would be a measure of thevulnerability of the resource and it forms an effectivebasis for a system administrator to perform suitablechanges to network configuration. Thus suitablevulnerability analysis and risk management strategiescan be formulated to efficiently curtail the risk fromdifferent types of attacker (script kiddies, hackers,criminals and insiders).</p>
1 aDantu, Ram1 aLoper, Kall1 aKolan, Prakash  uhttp://dl.acm.org/citation.cfm?id=977403.978389