3 years ago

FASHION: Functional and Attack graph Secured HybrId Optimization of virtualized Networks. (arXiv:1910.07921v2 [cs.NI] UPDATED)

Devon Callahan, Timothy Curry, Daniel Davidson, Heytem Zitoun, Benjamin Fuller, Laurent Michel

Maintaining a resilient computer network is a delicate task with conflicting priorities. Flows should be served while controlling risk due to attackers. Upon publication of a vulnerability, administrators scramble to manually mitigate risk before a patch is available. Tools exist to check network reachability (Khurshid et al., NSDI 2013) and risk using (probabilistic) attack graphs (Sheyner et al., IEEE S\&P 2002). These tools are not designed to fashion configurations that simultaneously satisfy multiple properties.

We introduce FASHION: a linear optimizer that \emph{fashions} network configurations to balance functionality and security requirements. FASHION formalizes functionality as a multi-commodity flow problem with side-constraints. FASHION formulates security as the average of 1) the risk of the connected component in the attack graph and 2) the highest probability path in the attack graph. These measures approximate the risk in a probabilistic attack graph (Wang et al., Network Security Metrics 2017). FASHION outputs a set of software-defined networking rules consumable by a Frenetic controller (Foster et al., ICFP 2011). The approximation linearly combines two measures. One measure is the impact of the set of nodes the attacker can reach in the attack graph (ignoring probability). The second is the maximum probability path in the attack graph.

FASHION is evaluated on data center networks with up to 649 devices, usually outputting a solution in under 30 minutes. FASHION allows an enterprise to automatically reconfigure their network upon a change in functionality (shift in user demand) or security (publication or patching of a vulnerability).

Publisher URL: http://arxiv.org/abs/1910.07921

DOI: arXiv:1910.07921v2

You might also like
Discover & Discuss Important Research

Keeping up-to-date with research can feel impossible, with papers being published faster than you'll ever be able to read them. That's where Researcher comes in: we're simplifying discovery and making important discussions happen. With over 19,000 sources, including peer-reviewed journals, preprints, blogs, universities, podcasts and Live events across 10 research areas, you'll never miss what's important to you. It's like social media, but better. Oh, and we should mention - it's free.

  • Download from Google Play
  • Download from App Store
  • Download from AppInChina

Researcher displays publicly available abstracts and doesn’t host any full article content. If the content is open access, we will direct clicks from the abstracts to the publisher website and display the PDF copy on our platform. Clicks to view the full text will be directed to the publisher website, where only users with subscriptions or access through their institution are able to view the full article.