Sciweavers

Share
ESORICS
2010
Springer

k-Zero Day Safety: Measuring the Security Risk of Networks against Unknown Attacks

9 years 1 months ago
k-Zero Day Safety: Measuring the Security Risk of Networks against Unknown Attacks
The security risk of a network against unknown zero day attacks has been considered as something unmeasurable since software flaws are less predictable than hardware faults and the process of finding such flaws and developing exploits seems to be chaotic [10]. In this paper, we propose a novel security metric, k-zero day safety, based on the number of unknown zero day vulnerabilities. That is, the metric simply counts how many unknown vulnerabilities would be required for compromising a network asset, regardless of what vulnerabilities those might be. We formally define the metric based on an abstract model of networks and attacks. We then devise algorithms for computing the metric. Finally, we show the metric can quantify many existing practices in hardening a network.
Lingyu Wang, Sushil Jajodia, Anoop Singhal, Steven
Added 09 Nov 2010
Updated 09 Nov 2010
Type Conference
Year 2010
Where ESORICS
Authors Lingyu Wang, Sushil Jajodia, Anoop Singhal, Steven Noel
Comments (0)
books