[Paper Review] Heuristic Approach Towards Countermeasure Selection using Attack Graphs

Orly Stan, Ron Bitton+7 more|arXiv (Cornell University)|Jun 26, 2019

Information and Cyber Security18 references4 citations

TL;DR

This paper proposes a heuristic A*-based approach for optimal countermeasure selection using extended attack graphs that model network topology, vulnerability prerequisites, lateral movement, and attacker goals. By avoiding repeated attack graph regeneration, the method efficiently identifies cost-effective countermeasure plans that minimize residual risk within budget constraints, outperforming CVSS-only methods in practicality and accuracy.

ABSTRACT

Selecting the optimal set of countermeasures is a challenging task that involves various considerations and tradeoffs such as prioritizing the risks to mitigate and costs. The vast majority of studies for selecting a countermeasure deployment are based on a limited risk assessment procedure that utilizes the common vulnerability scoring system (CVSS). Such a risk assessment procedure does not necessarily consider the prerequisites and exploitability of a specific asset, cannot distinguish insider from outsider threat actor, and does not express the consequences of exploiting a vulnerability as well as the attacker's lateral movements. Other studies applied a more extensive risk assessment procedure that relies on manual work and repeated assessment. These solutions however, do not consider the network topology and do not specify the optimal position for deploying the countermeasures, and therefore are less practical. In this paper we suggest a heuristic search approach for selecting the optimal countermeasure deployment under a given budget limitation. The proposed method expresses the risk of the system using an extended attack graph modeling, which considers the prerequisites and consequences of exploiting a vulnerability, examines the attacker's potential lateral movements, and express the physical network topology as well as vulnerabilities in network protocols. In addition, unlike previous studies which utilizes attack graph for countermeasure planning, the proposed methods does not require re-generating the attack graph at each stage of the procedure, which is computationally heavy, and therefore it provides a more accurate and practical countermeasure deployment planning process.

Motivation & Objective

• Address the limitations of CVSS-based countermeasure selection, which ignores network topology, attacker lateral movement, and threat actor type.
• Overcome the computational inefficiency of re-generating attack graphs at each step in traditional attack graph-based planning.
• Develop an automated, scalable method to recommend countermeasures with optimal deployment positions and cost-effectiveness under budget constraints.
• Integrate network topology, vulnerability dependencies, and attacker behavior into a unified risk assessment for more accurate countermeasure planning.
• Provide a practical, repeatable framework for security teams to prioritize and deploy countermeasures that block attack paths early and effectively.

Proposed method

• Construct an extended attack graph that models network topology, vulnerability prerequisites, consequences, and potential lateral movement of attackers.
• Represent the countermeasure selection problem as a graph path-finding task, where nodes correspond to system states and edges represent countermeasure deployments.
• Apply the A* heuristic search algorithm to find a near-optimal plan that minimizes residual risk under a given budget.
• Use a cost model combining purchase, operational, training, and manpower costs for each countermeasure, weighted by its impact (e.g., CVSS score).
• Integrate policy constraints to exclude countermeasures that block legitimate services, ensuring practical feasibility.
• Avoid re-computing the attack graph at each step by reusing the initial graph, significantly reducing computational overhead.

Experimental results

Research questions

• RQ1 How can countermeasure selection be improved by incorporating network topology and attacker behavior beyond CVSS scoring?
• RQ2 Can a heuristic search approach like A* provide near-optimal countermeasure plans efficiently without regenerating attack graphs at each step?
• RQ3 To what extent does deploying countermeasures on DMZ hosts reduce overall system risk compared to internal host hardening, even when internal vulnerabilities are more severe?
• RQ4 How does the inclusion of attacker lateral movement and prerequisite conditions affect the selection of optimal countermeasures?
• RQ5 Can the method generate redundant or multiple countermeasure suggestions for the same attack path to enhance system resilience?

Key findings

• The proposed method generates countermeasure plans that are significantly more effective than CVSS-based selection, particularly in blocking attack paths at early stages (e.g., DMZ compromise) even when internal vulnerabilities are more severe.
• By avoiding repeated attack graph regeneration, the method achieves substantial computational savings while maintaining high accuracy in risk assessment.
• The approach successfully identifies that securing DMZ hosts—despite lower individual CVSS scores—can eliminate entire attack paths to internal assets, making it a higher-priority target under budget constraints.
• The system recommends deploying countermeasures at specific network positions (e.g., hosts in DMZ), which is a key practical improvement over methods that only rank vulnerabilities.
• Plans generated are redundant when budget allows, suggesting multiple countermeasures for the same attack path, thereby enhancing system resilience.
• The method effectively handles non-CVE vulnerabilities (e.g., unencrypted Telnet) by assigning expert-scorable severity (e.g., CVSS 10), demonstrating flexibility beyond standard scoring systems.