Search papers, labs, and topics across Lattice.
This paper introduces a dynamic risk assessment method that combines Bayesian Attack Graphs (BAGs) with process mining to estimate the likelihood of vulnerability exploitation. Process mining analyzes network traffic to provide evidence of active exploitation, which then dynamically updates the conditional probability tables within the BAG. Experiments on a cybersecurity testbed demonstrate the approach's ability to detect active vulnerability exploitation and update system compromise probability assessments.
Real-time cybersecurity risk assessment is now possible by fusing process mining with Bayesian attack graphs, enabling dynamic updates to vulnerability exploitation probabilities based on observed network behavior.
While attack graphs are useful for identifying major cybersecurity threats affecting a system, they do not provide operational support for determining the likelihood of having a known vulnerability exploited, or that critical system nodes are likely to be compromised. In this paper, we perform dynamic risk assessment by combining Bayesian Attack Graphs (BAGs) and online monitoring of system behavior through process mining. Specifically, the proposed approach applies process mining techniques to characterize malicious network traffic and derive evidence regarding the probability of having a vulnerability actively exploited. This evidence is then provided to a BAG, which updates its conditional probability tables accordingly, enabling dynamic assessment of vulnerability exploitation. We apply our method to a cybersecurity testbed instantiating several machines deployed on different subnets and affected by several CVE vulnerabilities. The testbed is stimulated with both benign traffic and malicious behavior, which simulates network attack patterns aimed at exploiting the CVE vulnerabilities. The results indicate that our proposal effectively detects whether vulnerabilities are being actively exploited, allowing for an updated assessment of the probability of system compromise.
