Attack graph-based security metrics: Concept, taxonomy, challenges and open issues

¹ Technical Computer Engineering Department, Al-Hadba University College, Mosul, Iraq
² Faculty of Information & Communication Technology, Universiti Teknikal Malaysia Melaka, Melaka, Malaysia
³ Department of Communication and Engineering, School of Electrical Engineering, College of Engineering, University Teknologi MARA, Shah Alam, Selangor, Malaysia
⁴ Department of Computer Engineering, College of Engineering, Mustansiryah University, 10047 Baghdad, Iraq
⁵ Ministry of Education/General Directorate of Curricula, Pure Science Department, Baghdad 10065, Iraq
⁶ Ministry of Education, Mosul, Iraq

^* Corresponding author: zaid.jm@hcu.edu.iq

Abstract

Context: Security issues have increased recently because of the increased use of networking. The researchers have proposed many models, approaches, and models, for example, attack graphs. The attack graph model is a valuable tool for vulnerability analysis as well as for displaying all network paths. In general, attack graphs can be utilized for a variety of purposes, including the calculation of security metrics. Nonetheless, in order to sufficiently safeguard networks, a technique for gauging the security degree provided by these activities is required, as “you cannot improve what you cannot measure.” The security level of a system or network is typically represented by network security metrics in qualitative and quantitative ways. The network security metrics are typically employed to evaluate a system's security level and meet security objectives. Aim: This study aims to present a review of attack graph-based security metrics and analyse the previous work. Provides the limitations and issues the researchers faced to improve this important research area. Methodology: The attack graph security metrics field was thoroughly investigated in all research, and four databases—ScienceDirect, Web of Science (WoS), Scopus, and IEEE—were used to collect data between 2001 and 2022. Results: 46 papers were founded on attack graph security metrics with different methods and techniques based on the exclusion and inclusion criteria. The results of the taxonomy created three significant categories: proposed, implemented, reviewed, and surveyed. We believe this study will aid in highlighting research ability, which will subsequently broaden and establish new research topics.