Information System Security Risk Evaluation Based On Extended Attack Tree

With the development of information technology, information system (IS) is widely used, also the scale of IS which is based on Internet and core in information resource is becoming larger and larger. That makes it a virtual breeding ground for attackers. Therefore how to make IS reliable and robust to avoid attacks in a long time is what we should deal with at present. Risk evaluation is one of the best solutions to deal with security problem of IS. It is a proactive method to prevent attacks rather than a reactive method. First, analyzing the potential risk of IS, and then evaluating impact caused by those risks. The result of risk evaluation can be foundation of security alternatives, establishment of IS and IS's performance. It's a process to reduce risk and its final aim is to reduce risk to an acceptable level.Attack tree is a graph-based description model, gives a form methodology for describing risks of IS based on goal-oriented attack behavior. A new risk evaluation methodology is proposed with extended attack tree model. It has great advantage in supporting risk evaluation. While conducting risk evaluation based on extended attack tree model, all algorithms are presented for each step of this new evaluation method, such as attack chaining algorithm, attack scenarios algorithm.As a part of the research to quantify risk in security risk evaluation , multi-attribute utility theory is devised and proposed, three attributes are assigned to nodes of extended attack tree which reduces subjectivity of evaluation. Attack pruning method is proposed to facilitate complexity of computing with regard to large-scale IS. In the process of risk control, lots of indexes, such as risk metric, cost metric, and problems should be taken into account to choose the most reasonable countermeasures.Then, implementing the method, a prototype of automatic risk evaluation tool was constructed based on Visual C++ 6.0. The tool has simulated each step of process of the risk evaluation method. And the result is reasonable. This verifies that the risk evaluation method based on extended attack tree model is an effective and tangible way to conducting risk evaluation on IS. The simulation system also offers a good foundation for the implementation of more automatic and more functional evaluation tool.