Automated enrichment of logical attack graphs via formal ontologies - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2024

Automated enrichment of logical attack graphs via formal ontologies

Résumé

Attack graphs represent the possible actions of adversaries to attack a system. Cybersecurity experts use them to make decisions concerning remediation and recovery plans. There are different attack graph-building approaches. We focus on logical attack graphs. Networks and vulnerabilities constantly change; we propose an attack graph enrichment approach based on semantic augmentation post-processing of the logic predicates. Mapping attack graphs with alerts from a monitored system allows for confirming successful attack actions and updating according to network and vulnerability changes. The predicates get periodically updated based on attack evidence and ontology knowledge, allowing us to verify whether changes lead the attacker to the initial goals or cause further damage to the system not anticipated in the initial graphs. We illustrate our approach using a specific cyber-physical scenario affecting smart cities.

Dates et versions

hal-04563448 , version 1 (29-04-2024)

Identifiants

Citer

Kéren Saint-Hilaire, Frédéric Cuppens, Nora Cuppens, Joaquin Garcia‐alfaro. Automated enrichment of logical attack graphs via formal ontologies. ICT Systems Security and Privacy Protection (SEC), Jun 2023, Poznan, Poland. pp.59-72, ⟨10.1007/978-3-031-56326-3_5⟩. ⟨hal-04563448⟩
11 Consultations
0 Téléchargements

Altmetric

Partager

Gmail Mastodon Facebook X LinkedIn More