Risk Score Aggregation for Security Evaluation in Network Environments

With the increasing complexity of network environments, evaluating security risks can be a challenge.Quantitatively scoring computer systems or networks based on specific threats or concerns can facilitate the comparison of their security levels.Such scoring needs considering multiple security risk factors and multiple systems to enable meaningful comparisons, determining whether one system or network is relatively more secure than another.Our research aims to address this challenge by developing a comprehensive risk score aggregation methodology for evaluating security in modern network environments.In this thesis, we present two approaches to risk score aggregation: multi-factor aggregation for systems and multi-target aggregation for networks.In the first work, we propose an aggregation approach that combines machine measurements with human decision making for aggregating well-established individual risk factors into a risk score for a system.Specifically, we modify the Analytic Hierarchy Process (AHP) to facilitate group decision-making among selected "experts" who can derive the weights of individual risk factors for aggregation.We showcase the feasibility of our approach by selecting several common metrics to measure the target systems in our testbed and conducting an AHP survey with seventeen experts.The resulting overall aggregated scores for the target systems demonstrate how our approach enables the comparison of the overall security between those systems.By considering cloud-oriented settings, we also showcase how this approach i can be applicable to today's virtualized environments.The existing state-of-the-art approaches for aggregating multiple systems only consider one target in a network.The aggregation of risks scores of multiple targets is still yet to be explored.To this end, we propose another aggregation approach that uses the well-established attack paths as inter-system influences, treating each system as a potential target, to calculate cumulative attack probabilities for each system.We further aggregate these probabilities (i.e., the risk scores) into a single risk score for the entire network.To evaluate this approach, we consider several typical network types, including virtually hosted telecom networks such as 5G core and 5G Mobile Access Edge Computing (MEC) along with two additional network types.We employed the dataset collected from a real research data center.The results show that our approach can be generalized and applied to assess the security of various type of network.By considering multiple risk factors and interconnected entities/systems in network environments, we believe that our proposed methodologies for risk score aggregation can provide valuable insights and contribute to the research on risk assessments in modern IT environments.First and foremost, I would like to express my sincere gratitude to my thesis supervisor, Dr. Lianying Zhao for his constant support, invaluable feedback and patience throughout the entire research process.Without his guidance and trust, I can confidently say that I would not have reached this point in my academic career.I am also deeply thankful to our research manager, Makan Pourzandi for engaging in discussions, sharing insights and giving encouragement.

Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.