Cost-Aware Network Hardening with Limited Budget Using Compact Attack Graphs

Attack graphs are instrumental to analyze security vulnerabilities in networks. They provide decision support to security analysts via identification of critical exploitation scenarios. However, they may suffer from scalability issues due to network size and potential vulnerabilities, and become difficult to analyze. In this paper, we propose a heuristic method to find a cost-effective solution to protect a network using compact attack graphs. First, we extract all possible attack paths which reach predetermined critical resources embedded in the network. The exploit or initial condition which contributes the most to attack paths with least cost is selected to be removed. This process continues iteratively and a security analyst can stop it when the total cost exceeds the allocated budget. The experimental results show that the algorithm scales gracefully with the size of the graphs and it can be applied to large-scale graphs with a very large number of nodes. Moreover, our proposal measures the security level of the network in every step to show how vulnerable the network is against threats.