Penetration testing is a well-established practical concept for the
identification of potentially exploitable security weaknesses and an important
component of a security audit. Providing a holistic security assessment for
networks consisting of several hundreds hosts is hardly feasible though without
some sort of mechanization. Mitigation, prioritizing counter-measures subject
to a given budget, currently lacks a solid theoretical understanding and is
hence more art than science. In this work, we propose the first approach for
conducting comprehensive what-if analyses in order to reason about mitigation
in a conceptually well-founded manner. To evaluate and compare mitigation
strategies, we use simulated penetration testing, i.e., automated
attack-finding, based on a network model to which a subset of a given set of
mitigation actions, e.g., changes to the network topology, system updates,
configuration changes etc. is applied. Using Stackelberg planning, we determine
optimal combinations that minimize the maximal attacker success (similar to a
Stackelberg game), and thus provide a well-founded basis for a holistic
mitigation strategy. We show that these Stackelberg planning models can largely
be derived from network scan, public vulnerability databases and manual
inspection with various degrees of automation and detail, and we simulate
mitigation analysis on networks of different size and vulnerability.

本文提出了一种基于模拟渗透测试的、用于系统化分析网络安全弱点并给出防范策略的方法。该方法利用系统化分析的手段，通过自动攻击寻找系统漏洞并及时进行配置调整等行动来最大限度地减小攻击者的成功率，为企业的网络安全监控提供了有力支持。