A Quantitative Assessment Method of System Defense Capability Based on Attack Surface

A multitude of incidents, such as data leakage, cyber fraud, phishing, Trojan viruses, and DDoS attacks, present grave threats to the privacy, property, and security of individuals and organizations. To address these challenges effectively, it is imperative to employ scientific and efficient techniques for network security assessment, which play a vital role in augmenting the security performance of network systems and bolstering their resilience against attacks. In this paper, we propose a quantitative assessment methodology for evaluating the defense capability of network security, based on the concept of attack surfaces. Through the construction of a hierarchical model to represent attacks, we successfully mitigate the intricacies and scale-related issues associated with attack graphs. Additionally, our approach leverages the wealth of system information available to the assessor by constructing attack surfaces, enabling the simulation of attacks and the analysis of the defense strategy from an adversarial perspective. This methodology facilitates a more objective and comprehensive assessment of the security status of a system, ensuring a proactive and robust defense against potential threats.