Attack Graphs - a survey.

I just like to share my knowledge on designing attack graphs I am currently working on, in this entry. All are invited to give their feedback on this part of area if they have any knowledge about visualization tools. The image on the right represents nodes and edges, which are grouped in clusters ( correspond to workstations,connections and subnets in the actual network). More details at Cluster

Mulval(designed by Dr.Simon Ou) is a logic based network security analyzer which uses XSB and generates tuples representing the topology of a network and the possible attacks by an malicious user. Part of my ongoing research is to take these tuples generated from the logic engine and generate an Attack graph which is in a human readable format, which can be easily understand even by a layman. Making it user interactive is the important part of it, which I will work later on. Presently I use GraphViz tool (www.graphviz.org) for generating the attack graph.

The way how GraphViz works is that it takes a Dot file as an input Dot Language , interprets the Dot file and converts into PNG file Possible Formats. The PNG file demonstrates the topology of the network and the possible attack paths in the network. I tested for 2 sample topologies and was able to generate topology layout in PNG format. But the network seems to be aligned in some zigzag manner at present. The edges seem to overlap with the subnets in the PNG file. GraphViz supports 4 types of interpreters namely dot,circo,neato and twopi. All these 4 interpreters take the dot file as input and generates different types of layouts. But as I figured out later, only the dot interpreter among all of these 4 interpreters supports representing of subnets in a topology. I am not sure how much support GraphViz gonna give me for adding human interaction in the future. Its a research tool being developed by ATT labs and the features existing currently are tremendous given that its free of cost.

Adding human interaction to the GraphViz generated file is the hard part of it.