A logic-based approach to network security risk assessment

An important problem in network security risk assessment is to uncover network threats due to current software vulnerabilities and misconfigurations. This paper proposes a logic-programming approach to conduct this risk assessment automatically. We use Datalog to specify network security property states and attack rules. The threat analysis could be conducted by a logic-programming engine that can evaluate Datalog efficiently (such as XSB). We analyze trace proofs produced by the reasoning engine, and get threat information of evaluated network system. After identifying the threats, we apply game theory to compute threat risks. A simple network attack has been simulated to illuminate the appliance of the new approach. Results on how the approach has been able to help the system administrator understand the threat risks of attacks and take countermeasures accordingly are also analyzed.