I.V. Kotenko - Ph.D., Professor, Head of the Laboratory of Computer Security Problems, St. Petersburg Institute for Informatics and Automation of the Russian Academy of Sciences (SPIIRAS). E-mail: ivkote@comsec.spb.ru
A.A. Chechulin - Researcher at laboratory of computer security problems, St. Petersburg Institute for Informatics and Automation of the Russian Academy of Sciences (SPIIRAS). E-mail: chechulin@comsec.spb.ru

The paper presents a technique for attack graph construction, modification and analysis for networks security evaluation and security events processing. A set of existing approaches to security evaluation is analyzed in the paper. The current state of research is analyzed for the following areas: techniques for computer network security evaluation; approaches for attack graphs construction; software for security evaluation. The performed analysis showed that analytical attack modeling is used only for offline analysis and cannot be used for real-time systems due to time consumptions. Thus, the time consumption is the main obstacle for applying the analytical modeling in real-time systems. To solve this problem the technique for efficient attack graph construction, modification and analysis is proposed. Three main phases of the technique suggested are as follows: (1) collecting of the source data concerning the analyzed network and the existing vulnerabilities; (2) attack graph construction and security metrics calculation; (3) real-time event processing and modification of the attack graphs in accordance with the changes of the real network. The first phase of data gathering also can be divided into three stages: (1) preparatory; (2) information gathering from the external sources (vulnerability databases, etc.); (3) construction of the models that describe the protected network. The second phase in turn has the following stages: (1) attack graph construction; (2) attack graph analysis and security metrics calculation; (3) report generation. The last phase of event processing can be divided into the following stages: (1) attack graph modification in accordance with the network changes; (2) security event processing and the malefactor model recognition; (3) report generation. The proposed technique is a new theoretical result which, on the one hand, takes into account the advantages of attack graphs usage and, on the other hand, proposes a comprehensive and effective implementation of this approach for near real-time systems. The paper also presents the experiments results that show that the preliminary analysis of the computer network and the construction of the attack graphs takes the most part of the time. The next steps (attack graphs modification, security metrics calculation and event processing) use significantly less amount of time - for the network of 500 hosts it takes just a few seconds. These results confirm the theoretical assumptions of the paper and prove the possibility of applying the proposed technique for the systems operating in near real time mode. The rest of paper contains a comparison of the proposed technique and the existing approaches that are used for security analysis. Comparative analysis showed that the proposed technique is comparable with existing approaches and outperforms them according to some metrics.