Analysis of Stepping Stone Attacks in Dynamic Vulnerability Graphs

Vulnerability graphs have been employed as an effective tool for analyzing exploitability and impact of chain of exploits in networked environments. The attack graphs are created by a chain of "stepping stones" from the attacker origin to the desired target. The stepping stones not only provide the intermediate steps to reach the target, but also make it difficulty to identify the attacker's true location. In this paper, we model and analyze stepping stones in dynamic vulnerability graphs. Most analysis based on attack graph assume that the graph edges and weights remain constant during the attacker's attempt to propagate through the network. We propose a biased min- consensus technique for dynamic graphs with switching topology as a distributed technique to determine the attach paths with more probable stepping-stones in dynamic vulnerability graphs. We use min-plus algebra to determine necessary and sufficient convergence conditions. A necessary condition for convergence to the shortest path in the switching topology case is provided.