Neural Networks in Vulnerability Assessment

Vulnerability of computer network

Definition of vulnerability

Computer security vulnerability research is a new field of network security research. In the research process, researchers put forward different definitions according to different understanding and application requirements.

1. Software vulnerability
   Software vulnerability is essentially a security vulnerability in software, which will endanger the security strategy of the system and eventually reduce the use value of the system.
   
   
2. Computer system vulnerability
   A computer management system consists of a series of state descriptions that ultimately constitute the current initial state configuration of the entity of the computer management system. By using such a set of transitions to the initial states, all the initial states that can be reached from a given initial state are ultimately partitioned by the management system as two types of initial states defined in the security policy. Vulnerability is an authorized state that converts an authorized state to an unauthorized state. The damaged state refers to the state achieved by the above method. An attack is a sequence of authorization state transitions that ends with a corrupted state.
   
   
3. Network unit vulnerability
   Vulnerability of a computer network refers to a set of characteristics of a computer network that can be used by malicious objects (attackers or attack programs) to gain unauthorized access to resources through authorized means and methods in the network, or cause damage to the network and the host network. Network vulnerability comes from the vulnerability of corresponding software providing services in the network and the vulnerability of hosts in the network.
   
   
4. Vulnerability of information systems
   In the field of risk management technology system, there are system security process automation management system security automation and management automation, internal risk control, critical events, in the process of penetration can automatically prevent unauthorized access to information or damage the key steps of risk management, risk management weaknesses. Systematic risk management is in the technical field. Weaknesses in risk management exist in the process of system physical layout. Organizations, processes, people, management, hardware or software can infiltrate the automatic collection and processing system or data. The existence of the vulnerability itself does not cause any damage to the system. In an automated data attack, the vulnerability of a system is only one or a set of conditions that cause damage to two systems or behaviors. In the field of system risk management technology, any attack or vulnerability or attribute in the risk management system is defective. Any attack or harmful event or dangerous entity can provide a risk management opportunity to attack or implement automated data attacks. In the field of system information security, weaknesses that can be automatically evaluated are those that can be automatically infiltrated to overcome the risk attributes or security attributes of countermeasures.

Vulnerability assessment

The evaluation of vulnerability is mainly to detect the vulnerability of the system by means of various management and scientific and technological means, to find out the potential security risks and the system vulnerability that may be damaged and utilized by illegal personnel in the process, and to analyze and evaluate the security and development status of the whole system according to the results of various tests. On this basis, according to the results of vulnerability assessment, appropriate security strategy is formulated, which provides reference and basis for the perfect design and implementation of security assessment system. One of the main objectives of vulnerability detection and assessment is to analyze and understand various security risks that may exist in the whole system development process and to provide scientific basis and intention for how to protect the security and development of the whole system. The whole system vulnerability here can be just one device as a service, or just the device stored on the network as a computer, or the entire computer network.

Vulnerability analysis method

As shown in Fig. 1, from rule-based analysis to model-based analysis, from stand-alone analysis to distributed analysis, there are many methods of vulnerability assessment, which can be summarized into three categories: quantitative assessment method, qualitative assessment method and comprehensive assessment method combining qualitative and quantitative methods.

Fig. 1 Attack diagram evaluation model

In the attack tree method, the tree structure in the form of and-or is used to model the network vulnerability. The nodes in the attack tree represent the attack, the root node represents the attacker's ultimate target, AND the children of a node represent the methods to achieve this target.

Figure 2 shows an example of an attack tree in which the attacker's goal is to get a free lunch. The AND node represents the conjunction, which means that all its child nodes must meet to achieve the current goal; the OR node represents the disjunction, which means that the current goal can be reached as long as any of its children are satisfied.

Fig. 2 Attack tree method

Model-based quantitative analysis

1. Network elements
   Network element $c_{i}$ is the set of network protocol entity $e_{i}$:
   
   $c_{i} = \left\{ {e_{i} \left| {u\left( {e_{i} } \right) = i} \right.} \right\},\quad i,j \in N$
   
   (1)
   
   U is a mapping from the protocol entity to its network node number:
   
   $u:\left| {e_{i} } \right| \to N,C \equiv \bigcup\limits_{i} {\left\{ {c_{i} } \right\}}$
   
   (2)
   
   
2. Connection
   There is $l_{k}$ between $c_{i}$ and $c_{j}$ if and only if:
   $\exists e_{m} ,e_{n} ,u\left( {e_{m} } \right) = i \wedge u\left( {e_{n} } \right) = j \wedge u\left( {e_{m} } \right) = h\left( {e_{n} } \right) = k \wedge e_{ik} \leftrightarrow e_{jk}$
   
   (3)
   
   h is a mapping from the protocol entity to its network level:
   $h:\left| {e_{i} } \right| \to N,L \equiv \bigcup\limits_{k} {\left\{ {l_{k} } \right\}}$
   
   (4)
   
   
3. Network
   Net is a binary group, net=<C, L>. The vector $e_{i}$ made up of the variables $e_{i}$ made up of state $S_{j} \in S_{ej}$. Marked as safe if the expected value is met; if the expected value is not met but the security attribute of $c_{i}$ is not destroyed, it is marked as an error state. Sets that do not meet expectations and break $c_{i}$'s security properties are marked as failing.
   
   
4. Vulnerability point
   Vulnerability point $v_{i}$ is a vulnerability in net and satisfies:
   $\exists t \in T,t\left( {v_{i} ,S_{{{\text{net}}}} } \right) = S^{\prime}_{{{\text{net}}}} ,S_{{{\text{net}}}} \ne S^{\prime}_{{{\text{net}}}} ,S^{\prime}_{{{\text{net}}}} \in S_{{{\text{net}}}}^{{{\text{fail}}}}$
   
   (5)
   
   
5. Vulnerability
   Vulnerability analysis measures the severity of vulnerability points in terms of availability and impact. Availability depends on the degree of vulnerability in W and is affected by the number of indirect precursors of vulnerability. The contribution of the precursor states to availability is inversely proportional to the distance between them and the vulnerability point. Similarly, the influence of the vulnerability can be measured by the number of distances from the vulnerability to all its direct or indirect successor states. Its availability and impact are as follows:
   $a_{vk} = \sum\limits_{i,j} {\frac{1}{{\left| {U_{ijk} } \right|}}}$
   
   (6)
   
   $b_{vk} = \sum\limits_{i,j} {\frac{1}{{\left| {E_{ijk} } \right|}}}$
   
   (7)
   
   The severity of a single vulnerability and network vulnerability is as follows:
   
   $\overline{v} k = a_{vk} + b_{vk}$
   
   (8)
   
   $\tilde{v} = \sum\limits_{k} {\overline{v} } k,k \in N$
   
   (9)

Neural network

Characteristics of neural network

1. The structure of neural network is different from that of current computers. It is composed of many small processing units connected with each other. The function of each processing unit is simple. This enables the neural network to be well applied to the parallel computer for calculation, which can greatly improve the speed of calculation.
2. Neural network has very strong fault tolerance. If one part of the neural network is destroyed, the overall performance of the network will decrease to some extent, but this does not prevent it from doing its job. The neural network still works. Even if the most important part of the network is damaged, it will not cause the complete loss of the whole network function.
3. Neural network memory information is stored on the connection weight between neurons, and the content of stored information cannot be seen from a single weight, so it is a distributed storage mode. Effective segmentation is based on the training sample and training process, the whole sample set of learning are assigned to a distributed collaborative training neural network cluster environment, at the same time by competitive selection mechanism, and makes the individual learning performance good training can effectively migration in the neural network group, in order to obtain more resources for learning.
4. Neural network has excellent imitation ability. Through its excellent imitation learning ability, it is expected that future neural network computers will provide economic prediction, market prediction and benefit prediction for mankind.

Neural network model

The neuron model is often described by the first-order differential equation, which can simulate the change of synaptic potential in biological neural network over time:

$\tau \frac{{{\text{d}}\mu }}{{{\text{d}}t}} = - \,\mu \left( t \right) + \sum {w_{ij} x_{j} \left( t \right)} - \theta_{i}$

(10)

$y_{i} \left( t \right) = f\left[ {\mu_{i} \left( t \right)} \right]$

(11)

In general, s-type function expressions are used to express the nonlinear characteristics of the network:

$f\left( {\mu_{i} } \right) = \frac{1}{{1 + \exp \left( { - \,\mu_{i} /c} \right)^{2} }}$

(12)

As a technology that can carry out adaptive pattern recognition, neural network learning not only needs to provide the experience analysis knowledge of adaptive patterns and neural pattern discrimination function in advance, but automatically forms the learning and decision-making region required by the neural network through its own neural network learning and decision-making mechanism. The structure and characteristics of neural network are determined by its topology structure, neuron characteristics, learning and decision-making training rules and other factors. By making full use of the neuron information of different states, it can learn and train the neuron information of different states in the network one by one to obtain certain state mapping and relationship. In addition, network mapping can be continuously learned, and if the environment in the network changes, the mapping can also adjust the environment accordingly.

For fault diagnosis based on neural network, the input node of the network corresponds to the fault symptom, and the output node corresponds to the fault cause. First, the network was trained with a set of fault samples, and its structure (transfer function of the middle layer and number of neurons) and parameters (connection weights and thresholds between neurons) were determined. Fault mode classification is a process of realizing nonlinear mapping between symptom set and fault based on a group of signals after network training, as shown in Fig. 3.

Fig. 3 Design of network nonlinear mapping process