Vulnerabilities are collaborating to compromise your system: A network risk assessment method based on cooperative game and attack graph

The swift advancement of internet technologies has had profound effects across numerous sectors, placing cyber-security at the forefront of concerns for both businesses and governmental entities. Effective cyber risk assessment enables network administrators to reinforce their defenses against cyber attacks and mitigate potential losses. However, traditional approaches frequently concentrate solely on either the difficulty of exploiting vulnerabilities or the topological characteristics of attack graphs, and some require knowledge of the attacker’s strategies. This paper presents a novel network risk assessment methodology that combines cooperative game theory with host probabilistic Attack Graphs, called RACAG. Specifically, Shapley values is employed to provide an unbiased assessment the impact of each attack path on the overall system damage. The proposed approach does not require any prior knowledge of the attacker’s strategies but instead focuses on comprehensive analysis of the exploit difficulty of vulnerabilities in the system, asset information, network topology, and attacker traces detected by defense mechanisms. Experiments have confirmed the efficacy of RACAG in assessing the impact of attack paths on overall system damage. Additionally, they highlighted its advantages in the deployment of deceptive resources, enhancement of risk perception abilities, and its support for defenders in analyzing smokescreen tactic.