AGQL: A Query Language for Attack Graph based Network Vulnerability Analysis

摘要

Attack graph is a widely used formalism for modeling attacks in computer networks, particularly the multi step attacks. Many of the existing analysis techniques based on attack graphs provide valuable insights into the security posture of a network. But, the network administrator need to have a good knowledge about underlying graph data structures and graph manipulation algorithms. This paper proposes a query language for attack graph based network vulnerability analysis. It consists of query constructs to accomplish different attack graph based analysis tasks and also for generating the attack graph itself. The features of the query language are based on generic models of attack graph and as such it can be implemented on top of any kind of data store i.e., relational database, graph database etc. This query language will help administrators in developing network security applications that require frequent querying of the attack graph.