Towards Unifying Vulnerability Information for Attack Graph Construction

  • Sebastian Roschke
  • Feng Cheng
  • Robert Schuppenies
  • Christoph Meinel
Part of the Lecture Notes in Computer Science book series (LNCS, volume 5735)


Attack graph is used as an effective method to model, analyze, and evaluate the security of complicated computer systems or networks. The attack graph workflow consists of three parts: information gathering, attack graph construction, and visualization. To construct an attack graph, runtime information on the target system or network environment should be monitored, gathered, and later evaluated with existing descriptions of known vulnerabilities. The output will be visualized into a graph structure for further measurements. Information gatherer, vulnerability repository, and the visualization module are three important components of an attack graph constructor. However, high quality attack graph construction relies on up-to-date vulnerability information. There are already some existing databases maintained by security companies, a community, or governments. Such databases can not be directly used for generating attack graph, due to missing unification of the provided information. This paper challenged the automatic extraction of meaningful information from various existing vulnerability databases. After comparing existing vulnerability databases, a new method is proposed for automatic extraction of vulnerability information from textual descriptions. Finally, a prototype was implemented to proof the applicability of the proposed method for attack graph construction.


Textual Description Automatic Extraction Security Goal Attack Graph Integrity Violation 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Schneier, B.: Attack Trees: Modeling Security Threats. Journal Dr. Dobb’s Journal (December 1999),
  2. 2.
    Sheyner, O., Haines, J., Jha, S., Lippmann, R., Wing, J.M.: Automated Generation and Analysis of Attack Graphs. In: Proceedings of the 2002 IEEE Symposium on Security and Privacy (S&P 2002), pp. 273–284. IEEE Press, Washington (2002)CrossRefGoogle Scholar
  3. 3.
    Noel, S., Jajodia, S.: Managing attack graph complexity through visual hierarchical aggregation. In: Proceedings of Workshop on Visualization and Data Mining for Computer Security (VizSEC/DMSEC 2004), pp. 109–118. ACM, Washington (2004)CrossRefGoogle Scholar
  4. 4.
    Ou, X., Govindavajhala, S., Appel, A.: MulVAL: A Logic-based Network Security Analyzer. In: Proceedings of 14th USENIX Security Symposium, p. 8. USENIX Association, Baltimore (2005)Google Scholar
  5. 5.
    Secunia Advisories, (accessed March 3, 2009)
  6. 6.
    OSV Database, Open source vulnerability database. OSVDB, (accessed March 2009)
  7. 7.
    Mitre Corporation, Common vulnerabilities and exposures. CVE, (accessed March 2009)
  8. 8.
    Mitre Corporation, Open Vulnerability and Assessment Language, OVAL, (accessed March 3, 2009)
  9. 9.
    SecurityFocus, Security Focus Bugtraq, (accessed March 2009)
  10. 10.
    ISS, X-force, (accessed March 2009)
  11. 11.
    NIST, National Vulnerability Database, NVD, (accessed March 3, 2009)
  12. 12.
    US CERT, US-CERT vulnerability notes database, (accessed March 2009)
  13. 13.
    Mell, P., Scarfone, K., Romanosky, S.: A complete guide to the common vulnerability scoring system version 2.0 (2007), (accessed March 3, 2009)
  14. 14.
    Mitre Corporation, CVE-2008-4250 (accessed March 2009)Google Scholar
  15. 15.
    Franqueira, V.N.L., van Keulen, M.: Analysis of the nist database towards the composition of vulnerabilities in attack scenarios. Technical Report TR-CTIT-08-08, University of Twente, Enschede (February 2008)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2009

Authors and Affiliations

  • Sebastian Roschke
    • 1
  • Feng Cheng
    • 1
  • Robert Schuppenies
    • 1
  • Christoph Meinel
    • 1
  1. 1.Hasso Plattner Institute (HPI)University of PotsdamPotsdamGermany

Personalised recommendations