Nonhomogeneous Risk Rank Analysis Method for Security Network System
- 1 Department of Mathematical and Physical Sciences, Miami University, Middletown, OH, USA
- 2 Department of Mathematics and Statistics, University of South Florida, Tampa, FL, USA
- 3 Department of Mathematics, University of Dayton, Dayton, OH, USA
Abstract
Security measures for a computer network system can be enhanced with better understanding the vulnerabilities and their behavior over the time. It is observed that the effects of vulnerabilities vary with the time over their life cycle. In the present study, we have presented a new methodology to assess the magnitude of the risk of a vulnerability as a “Risk Rank”. To derive this new methodology well known Markovian approach with a transition probability matrix is used including relevant risk factors for discovered and recorded vulnerabilities. However, in addition to observing the risk factor for each vulnerability individually we have introduced the concept of ranking vulnerabilities at a particular time taking a similar approach to Google Page Rank Algorithm. New methodology is exemplified using a simple model of computer network with three recorded vulnerabilities with their CVSS scores.
- Kaluarachchi, P.K., Tsokos, C.P. and Rajasooriya, S.M. (2016) Cybersecurity: A Statistical Predictive Model for the Expected Path Length. Journal of information Security, 7, 112-128. https://doi.org/10.4236/jis.2016.73008
- Rajasooriya, S.M., Tsokos, C.P. and Kaluarachchi, P.K. (2016) Stochastic Modelling of Vulnerability Life Cycle and Security Risk Evaluation. Journal of information Security, 7, 269-279. https://doi.org/10.4236/jis.2016.74022
- Rajasooriya, S.M., Tsokos, C.P. and Kaluarachchi, P.K. (2017) Cybersecurity: Nonlinear Stochastic models for Predicting the Exploitability. Journal of information Security, 8, 125-140. https://doi.org/10.4236/jis.2017.82009
- Kaluarachchi, P.K., Tsokos, C.P. and Rajasooriya, S.M. (2018) Non-Homogeneous Stochastic Model for Cyber Security Predictions. Journal of Information Security, 9, 12-24. https://doi.org/10.4236/jis.2018.91002
- Kaluarachchi, P.K., Tsokos, C.P. and Rajasooriya, S.M. (2019) Risk Rank Analysis Method for Vulnerabilities in a Network. Urban Studies and Public Administration, 2.
- (2016) US Government Cybersecurity Report. https://explore.securityscorecard.com/rs/797-BFK-857/images/2018%20Government%20Cybersecurity%20Report.pdf
- (2016) Symantec, Internet Security Threat Report. Vol. 21. https://www.symantec.com/content/dam/symantec/docs/reports/istr-21-2016-en.pdf
- NVD National Vulnerability Database. http://nvd.nist.gov/
- Kijsanayothin, P. (2010) Network Security Modeling with Intelligent and Complexity Analysis. Ph.D. Dissertation, Texas Tech University, Lubbock.
- Sawilla, R. and Ou, X. (2007) Googling Attack Graphs. Technical Report TM-2007-205, Defense Research and Development Canada.
- Gleich, D.F. (2015) PageRank Beyond the Web. SIAM Review, 57, 321-363. https://doi.org/10.1137/140976649
- Schiffman, M. Common Vulnerability Scoring System (CVSS). http://www.first.org/cvss/
- CVE Details. http://www.cvedetails.com/
- Frei, S. (2009) Security Econometrics: The Dynamics of (IN) Security. Ph.D. Dissertation, ETH, Zurich.
- Joh, H. and Malaiya, Y.K. (2010) A Framework for Software Security Risk Evaluation Using the Vulnerability Lifecycle and CVSS Metrics. Proceedings of International Workshop on Risk and Trust in Extended Enterprises (RTEE), November 2010, 430-434.