Hypergraph-driven mitigation of cyber-attacks

Gustavo Daniel Gonzalez Granadillo (1) , Elena Doynikova (2, 3) , Igor Kotenko (2, 3) , Joaquin Garcia-Alfaro (4, 5, 6)

1 ARI - Atos Research & Innovation (ATOS)
2 SPIIRAS - Science of St. Petersburg Institute for Informatics and Automation of the Russian Academy of Sciences
3 ITMO - National Research University of Information Technologies, Mechanics and Optics [St. Petersburg]
4 R3S-SAMOVAR - Réseaux, Systèmes, Services, Sécurité
5 TSP - RST - Département Réseaux et Services de Télécommunications
6 CNRS - Centre National de la Recherche Scientifique

We extend a mitigation model that evaluates individual and combined countermeasures against multistep cyberattack scenarios. The goal is to anticipate the actions of an attacker that wants to disrupt a given system (eg, an information system). The process is driven by a hypergraph formalism, enforced with a stateful return on response investment metric that optimally evaluates, ranks, and selects appropriate countermeasures to handle ongoing and potential attacks

Mots clés: Security metrics; Return on security investment; Attack graphs; Countermeasure selection; Mitigation; Network security

Domaines: Cryptographie et sécurité [cs.CR]; Réseaux et télécommunications [cs.NI]

Gustavo Daniel Gonzalez Granadillo, Elena Doynikova, Igor Kotenko, Joaquin Garcia-Alfaro. Hypergraph-driven mitigation of cyber-attacks. Internet technology letters, 2018, 1 (3), pp.e38-1 - e38-6. ⟨10.1002/itl2.38⟩. ⟨hal-02013488⟩