Time-Dependent Risk Evaluation Using Markov Attack Graphs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional risk assessment methods using Bayesian attack graphs fail to consider temporal changes in network system vulnerabilities, leading to inaccurate and delayed risk evaluations.
Innovation Solution
A risk evaluation device that utilizes a continuous-time Markov chain to model state transitions in a network system, incorporating transition rates and elapsed time to calculate dynamic risk probabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional Bayesian attack graph methods are used to calculate risk probability, then the calculation can be completed, but the temporal change in risk is not considered leading to inaccurate evaluation
Solution Approach 1:
The patent transforms the static Bayesian attack graph into a dynamic model by introducing time-dependent transition rates. The exploit success probability is converted into a transition rate that varies with elapsed time, allowing the risk evaluation to reflect the dynamic nature of cyberattacks where vulnerability exploitation likelihood changes over time.
Solution Approach 2:
The patent changes the parameter representation from static exploit success probability to dynamic transition rate that is a function of elapsed time. This parameter transformation enables the model to capture temporal variations in attack risk, where the likelihood of successful exploitation evolves as time progresses from the initial attack state.
2Ease of manufacture
If static exploit success probability is used in BAG edges, then the model is simple to construct, but it cannot reflect the time-dependent nature of vulnerability exploitation
Solution Approach 1:
The patent introduces dynamic transition rates that depend on elapsed time while maintaining the graphical structure of the attack model. Each edge in the graph now carries a time-dependent transition rate parameter, allowing the model to adapt to temporal changes in attack scenarios without fundamentally altering the graph construction approach.
Solution Approach 2:
The patent incorporates time-based progression where the transition rates change periodically or continuously based on elapsed time from the initial attack state. This allows the model to reflect realistic attack scenarios where vulnerability exploitation likelihood varies over time, such as increasing with prolonged exposure or decreasing with security patches.
Data Source
AI summary
A risk evaluation device (20) includes: a graph processing unit (23) that creates a state transition diagram of a continuous-time Markov chain that is a data structure including each node and each edge of a BAG and in which an obtained transition rate is applied to each edge instead of an exploit success probability of each edge; and a graph analysis unit (24) that calculates a risk probability of each node that changes with an elapsed time t from when an attacker has started an attack by performing a Markov analysis process on the basis of the state transition diagram created by the graph processing unit (23) and the elapsed time t.