Current network security tools generally lack sufficient context for maintaining a well informed and proactive defense posture. Vulnerabilities are usually assessed in isolation, without considering how they contribute to overall attack risk. Similarly, intrusion alarms are logged as isolated events, with limited correlation capabilities. Security professionals are overwhelmed by constant threa...

Vulnerability analysis of LSDS (Large-Scale distributed systems) has become a growing focus nowadays. A new multi-layer topology model is proposed to describe complex relations between LSDS entities, redundancy mechanism and failure tolerant mechanism in LSDS. Based on this model, a structural vulnerability analysis algorithm based on weight is proposed, which can discover and validate structur...

Host compromise is a serious computer security problem today. To better protect hosts, several Mandatory Access Control systems, such as Security Enhanced Linux (SELinux) and AppArmor, have been introduced. In this paper we propose an approach to analyze and compare the quality of protection offered by these different MAC systems. We introduce the notion of vulnerability surfaces under attack s...

In this paper, we propose a quantification of the vulnerability of a communication network where links are subject to failures due to the actions of a strategic adversary. We model the adversarial nature of the problem as a 2-player game between a network manager who chooses a spanning tree of the network as communication infrastructure and an attacker who is trying to disrupt the communication...

With the increasing frequency of natural disasters and intentional attacks that challenge telecommunication networks, vulnerability to cascading and regional-correlated challenges is escalating. Given the high complexity and large traffic load of optical networks, these correlated challenges cause substantial damage to reliable network communication. In this paper, we propose a network vulnerab...

More and more security vulnerabilities were found in network softwares nowadays, making network security assessment one of the most important tasks for IT administrators. Vulnerability scanner is the key application for fulfilling such tasks. However, large numbers of vulnerabilities result in even larger number of vulnerability plug-ins including common plug-ins and specific plug-ins, which ma...

In today’s large complex enterprise network, security is a challenging task for most of the administrators. The typical means by which an attacker breaks into a network is through a series of exploits, where each exploit in the series satisfies the precondition for subsequent exploits and makes a causal relationship among them. Such a series of exploits constitutes an attack path and the set of...

Vulnerable graphs are those directed multigraphs that can generate Braess paradox in Traffic Networks. In this paper, we give a graph-theoretic characterisation of vulnerable directed multigraphs; analogous results appeared in the literature only for undirected multigraphs and for a specific family of directed multigraphs. The proof of our characterisation also provides an algorithm that checks...