Attack Graph Analysis Using Unconfirmed Security Facts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Security diagnosis systems struggle to identify all vulnerabilities in a system due to the heavy load of scans, operational constraints, and limited information collection, making it difficult to analyze potential attacks effectively.
Innovation Solution
An analysis system generates unconfirmed facts to indicate unknown information about the system's security state, using confirmed facts and unconfirmed fact generation to create an attack graph, even when complete scan data is unavailable.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If vulnerability scans are performed frequently and comprehensively to identify all vulnerabilities, then the completeness of vulnerability identification is improved, but the load on the system to be diagnosed increases and operational constraints are violated
Solution Approach 1:
The patent segments the vulnerability identification process into two distinct phases: (1) comprehensive scanning during maintenance periods when system load can tolerate it, and (2) lightweight monitoring during operational periods when system load must be minimized. This segmentation allows the system to achieve both complete vulnerability identification and operational continuity without conflict
Solution Approach 2:
The patent performs comprehensive vulnerability scans in advance during maintenance periods before the system enters operational mode. By completing the heavy scanning work beforehand, the system prepares complete vulnerability information without imposing load during critical operational periods, thus resolving the contradiction between identification completeness and system load
2Measurement precision
If comprehensive scans are performed to collect all security information, then the accuracy of attack possibility analysis is improved, but the time required for scanning increases and operational constraints are violated
Solution Approach 1:
The patent performs comprehensive vulnerability scanning in advance during maintenance periods, storing the results for later analysis. This preliminary action ensures that complete security information is available for accurate attack possibility analysis without requiring time-consuming scans during operational periods, thus resolving the contradiction between analysis accuracy and scan duration
Solution Approach 2:
The patent divides the security assessment process into two temporal segments: comprehensive data collection during maintenance periods and rapid analysis during operational periods. This segmentation allows the system to achieve high analysis accuracy using pre-collected data without incurring long scan times during critical operations
3Reliability
If frequent comprehensive scanning is performed to maintain up-to-date vulnerability information, then the reliability of security analysis is improved, but the productivity of the system decreases due to operational constraints
Solution Approach 1:
The patent segments the security monitoring function into periodic comprehensive scans during maintenance periods and continuous lightweight monitoring during operational periods. This segmentation maintains reliable security information through regular updates while minimizing impact on operational productivity, as the lightweight monitoring requires minimal system resources
Solution Approach 2:
The patent implements periodic comprehensive vulnerability scanning at scheduled maintenance intervals, combined with continuous lightweight monitoring between scans. This periodic action ensures security information remains reliable and up-to-date while allowing the system to maintain high productivity during operational periods when comprehensive scanning is not performed
Data Source
AI summary
An analysis system includes: an unconfirmed fact generation unit which generates facts that indicate unknown information of a system to be diagnosed or a device among facts that indicate a state related to security in the system to be diagnosed or the device included in the system to be diagnosed, as unconfirmed facts.