The rampant occurrence of cybersecurity breaches imposes substantial
limitations on the progress of network infrastructures, leading to compromised
data, financial losses, potential harm to individuals, and disruptions in
essential services. The current security landscape demands the urgent
development of a holistic security assessment solution that encompasses
vulnerability analysis and investigates the potential exploitation of these
vulnerabilities as attack paths. In this paper, we propose Prometheus, an
advanced system designed to provide a detailed analysis of the security posture
of computing infrastructures. Using user-provided information, such as device
details and software versions, Prometheus performs a comprehensive security
assessment. This assessment includes identifying associated vulnerabilities and
constructing potential attack graphs that adversaries can exploit. Furthermore,
Prometheus evaluates the exploitability of these attack paths and quantifies
the overall security posture through a scoring mechanism. The system takes a
holistic approach by analyzing security layers encompassing hardware, system,
network, and cryptography. Furthermore, Prometheus delves into the
interconnections between these layers, exploring how vulnerabilities in one
layer can be leveraged to exploit vulnerabilities in others. In this paper, we
present the end-to-end pipeline implemented in Prometheus, showcasing the
systematic approach adopted for conducting this thorough security analysis.

网络安全威胁，安全评估，漏洞分析，攻击利用，攻击路径