A Hybrid Expert System for IT Security Risk Assessment

Transcription

1 A Hybrid Expert System for IT Security Risk Assessment Andrew L.S. Gordon, Ivan Belik, Shahram Rahimi 1, Department of Computer Science, Mailcode 4511 Southern Illinois University, Carbondale, IL, USA [agordon, ivanbelik, Abstract The uncertainty and unexpectedness of security risk makes it exceedingly challenging to assess and monitor. This paper outlines a hybrid approach which factors in the uncertainty, unexpectedness and complexity of risk. In this work, IT security risk in an organization is evaluated using and expert system which utilizes fuzzy reasoning and certainty factors. Since often the value of risk comes with some level of believe, uncertainty is calculated and presented as part of the output in the system. Keywords: risk assessment, expert systems, fuzzy logic 1 Introduction Risk consists of the likelihood of an event combined with its consequences [1]. It can also be described as the analysis of the likelihood of loss due to a particular threat against a specific asset in relation to any safeguards to determine vulnerabilities [9]. Risk is an inevitable activity that is a part of our daily lives. There is no universal description of the term risk, while different specialists give different interpretation of this term. One of the most general definitions is that risk is the combination of the probability of an event and its consequence when there is at least the possibility of negative consequences [7]. Any attempt to assess, manage and mitigate risk must take into consideration the unpredictable and uncertain nature of risk. The assessment of risk in an environment such as IT security is very complicated, a critical process that has become an integral part of business, education and government entities. The level of risk associated with threats and vulnerability is influenced by the likelihood that this event can occur, the security measures in place to mitigate the risk and the impact the occurrence of this event can have on the institution. There have been several attempts to model risk using expert systems. Each approach has been shown to work well in some specific cases or to a particular profession. This is true as in many instances risk perception and assessment varies from culture to culture. The dynamic culture of risk makes it complex to model and the evolutionary nature of risk requires new approaches as new threat develops. Below is a brief summary of similar works modeling risk. s: factors are used to manage uncertainty in rule based systems [6]. It is an important factor in risk assessment when the level of certainty is ascertained. Risk calculation is never definite regardless of the method used. Therefore, any risk assessment method must account for an extent to which the result presented is true. Risk can be characterized in two aspects: the level of risk and the certainty of this level to be realized. factors provide a simple alternative to probabilistic models such as Bayes Theorem [6]. There are many models of certainty factors; however, we restrict this work to the certainty factors being 0 for no support for the evidence and 1 for total support for the evidence. An application of methods based on utilization of certainty factors is given by David E. Heckerman and Edward H. Shortliffe in [10]. This paper demonstrated that the certainty-factor model (CF model) can be used efficiently in rule-based systems. In this work, it is shown that fusion of CF model with classical probabilistic theory helps to reach an advanced belief-network representation by overcoming many limitations of the CF model. Belief Based Risk Assessment: Belief based risk assessment is based on the fact that risk can be modeled using belief calculation which is suitable for situations where there is some certainty about whether a proposition is true or false. This type of risk modeling is done based on subjective logic [2]. Subjective logic is the type of probabilistic logic that explicitly takes uncertainty and belief ownership into account [3]. The opinion triangle is used to express the relationship between belief, disbelief and uncertainty. Subjective logic improves on reasoning frameworks such as binary as it takes into account ignorance. This improves risk assessment by the inclusion of ignorance which is reflected in the results so the results become more realistic and there is some level of ignorance about risk that is modeled by the subjective logic. The realization of belief based model is given by Josang and Knapskog in [2]. According to this paper, the belief based model of risk assessment uses subjective beliefs about threats and vulnerabilities as input parameters, and uses the belief calculation of subjective logic to combine them. As a result the high level of reflection for real uncertain risks is approached.

2 Fuzzy Based Risk Assessment: Fuzzy reasoning is based on the use of linguistic values such as very high risk, frequent occurrence as oppose to the use numeric values such as 80% or 65 %. This system of linguistic values makes it more likely to model the imprecision associated with the measuring of risk factors. Fuzzy expert systems have been used to calculate the risk of coronary heart disease, prostate cancer risk as well as the diagnosis and treatment of male impotence [4]. Fuzzy experts systems has been found to be very stable and is been widely used in the field of medicine for risk assessment. An application of fuzzy logic in risk assessment is explained in [11]. Proposed Fuzzy Decision Model of Risk Assessment through Fuzzy Preference Relations with Users Confidence-interval implements an extended method of risk assessment working with Pseudo-Order Preference Model (POPM) and fuzzy multiple-person decision making (MPDM) theory. The higher-level model of risk assessment is developed as a consequence of implementation of different techniques. Hybrid Experts Systems: The use of one particular approach to reasoning can be limiting when dealing with risk assessment. Selection of a hybrid approach provides a more comprehensive view of the risk assessment process. For an example of a hybrid experts system [2] can be reviewed. In this work, the risk analysis of the European Monetary Union (EMU) is presented using new techniques of Hybrid Intelligent Decision Support Systems (HIDSS). These techniques are based on neural networks and rulebased agents in a dynamic environment. Fuzzified Dempster-Shafer theory: In the previous approaches outlined so far risk has been modeled based on uncertainty, ignorance or fuzzy reasoning. The integration of fuzzy logic into Dempster-Shafer theory provides a fuzzified belief system in which the bel and pls functions are fuzzified. This gives a multivalued approached to belief based reasoning making it more comprehensive. This kind of hybrid reasoning is applicable in the field of epidemiology [5]. In this case the degree of risk in an environment is ascertained by using the fuzzified Dempster-Shafer theory. This combination has also been used to model the risk from acts of terrorism [1]. This kind of combinations works in this case because for acts of terrorism there is a considerable level of epistemic uncertainty that must be captured. This combination of belief and fuzzy based reasoning does a good job for capturing this kind of information. The assessment of risk assessment is a process and not an event and therefore this continuous process. Below are the two factors needed to keep the risk assessment process effective: a. The Perception of Risk Changes: The level of perception of risk changes dependent on the frequency of risk. The more frequent risk is the more likely it will happen again. Also the lower the frequency of a threat goes the lesser the perception of risk resulting from this threat will be. We propose that fuzzy inference can take place offline to update the new perception of risk associated with each item based on frequency. b. The Process of Risk management is continuous: A fuzzy neural network can be used to learn the relationship between input variables to ensure that the pattern of risk change is monitored and the system adjusts itself to handle threat. This will ensure that the inference in the system is done with the pattern of risk taken into consideration. In general, it is important to create a conceptual model for IT security risk assessment, which can synthesize different approaches using different methods and mechanisms. Therefore, a Hybrid Expert System for IT Security risk assessment based on s and Fuzzy is proposed in this paper. 2 The Proposed Approach Calculation of a crisp value for risk is not always possible; consequently, linguistic description of risk is considered more efficient given the complex nature of risk. It is also important that the belief in risk be taken into consideration. As a result, we propose the use of fuzzy logic as well as the theory of certainty factor to carry out risk assessment. In our model, we have considered risk assessment in the context of a fuzzy logic system that includes three basic blocks (Figure 1): Input unit engine Output unit Input Risk Perception (Likelihood) Security Measures (Mitigation) Impact Cost (Likelihood) Engine Mamdani Fuzzy Based on s Figure 1. Conceptual Model of System Output Fuzzy Defuzzified

3 2.1 The Input Unit Figure 1 illustrates the overall view of the system from a conceptual point of view. The input of the systems is based on a fuzzy value as well as the level of belief in the fuzzy value (certainty factor). Risk is assessed based on the perception of the risk, the security measures in place to mitigate the risk and the likely impact should this vulnerability occur. The input unit consists of three groups of input data: a. Risk Perception (Likelihood) : Risk Perception describes the likelihood of the risk. The fuzzy set described by Figure 2 and Table 1 is used to model the likelihood of a threat or vulnerability taking place. The linguistic variables unlikely, possibly and likely are used to express the perceived likelihood of risk. Table 1. Fuzzy and certainty values for risk perception Notation Numerical Unlikely U [0.0, 4.0] 0.4 Possibly P [2.0, 8.0] 0.6 Likely L [6.0, 10.0] 0.8 Figure 3. Fuzzy Sets for Security measures c. Impact Cost: The cost associated with the occurrence of a threat or vulnerability has a significant impact on the level of risk associated with the event. The variables in Table 3 and the Fuzzy set in Figure 4 described the values used to measure the impact. The greater the impact cost the greater the contribution to the certainty of risk. Table 3. Fuzzy and certainty values for impact cost Notation Numerical Low cost LC [0.0, 4.0] 0.25 Moderate cost MC [3.0, 7.0] 0.5 Costly C [6.0, 10.0] 0.75 Figure 2. Fuzzy Sets for Risk Perception This perception (likelihood) can be changed overtime based on the frequency of the particular vulnerability. b. Security Measures (Mitigation): The measure of risk associated with a threat or vulnerability is affected by the efficacy of the mitigation measures in place to combat that threat or vulnerability. The linguistic variables in Table 2 and the fuzzy set in Figure 3 are used to measure the level of security. A threat with a greater measure of the security has a lower contribution to the certainty of risk. Table 2. Fuzzy and certainty values for security measures Numerical Notation Below average BA [0.0, 3.0] 0.9 Average A [2.0, 5.0] 0.65 Good G [4.0, 7.0] 0.3 Excellent E [6.0, 10.0] 0.2 Figure 4. Fuzzy Sets for Impact Cost The approach taken utilizes both fuzzy values as well as the belief in these values. This provides a two way approach to risk assessment. When risk is assessed there exist some amounts of certainty about the risk. This hybridization of fuzzy logic and certainty factors accommodates this fact. s for Input attributes: The three factors in our risk model, which are perception, impact and the mitigation measures can all contribute to the value of risk independently. The certainty factor of each risk factor may impact the other factors as well. For example, if impact is high and security measures are high then clearly the high security measure will lower the risk value. We model a direct relationship with the measure of the risk factor and its contribution to the risk. Table 4 shows the relationship between the measure of the risk factors and the

4 contribution made to the certainty of the risk. Later in this paper, the effect of these values on the certainty of the risk will be presented as well. An additional column has been added to the regular fuzzy table to account for the certainty. Table 4. The relationship between the linguistic values and the certainty contribution to the risk value Notation Numerical Unlikely U [0.0, 4.0] 0.4 Possibly P [2.0, 8.0] 0.6 Likely L [6.0, 10.0] The Engine Mamdani Fuzzy inferencing is used as the core of the reasoning process. The Mamdani-style fuzzy inference process is based on four steps [13]: 1. fuzzification of the input variables 2. rule evaluation 3. aggregation of the rule outputs 4. defuzzification As discussed earlier, the input of the system consists of Risk Perception (Likelihood), Security Measures (Mitigation) and Impact Cost. The Output consists of Fuzzy s and Defuzzified s. The inference process has been implemented based on Figure 1 model. Some sample rules of the Mamdani module are represented in Table 5. Table 5. Sample Rules of the Mamdani fuzzy inference module Rule # Content 1 If Risk Perception is likely AND Security if Good AND Impact is Low Cost THEN Risk is Low If Risk Perception is likely AND Security if Below Average AND Impact is Low Cost THEN Risk is Low If Risk Perception is unlikely AND Security if Good AND Impact is High Cost THEN Risk is Moderate Cost If Risk Perception is likely AND Security if Below Average AND Impact is High Cost THEN Risk is High Sample rules in Table 5 demonstrate the primary reasoning mechanism of the decision engine. The aggregation of the given rules is represented in Figure 5. on : As was mentioned earlier certainty factor was used to measure the certainty of a risk. It is clear that each risk factor can impact on the value of risk. Table 5 shows how each risk factor can affect the overall value of the risk. The impact of each factor on the overall risk value is represented in Table 6. Figure 5. Comparison of the outputs using inference module based on Risk Perception, Security Measures and Impact Cost Table 6. Demonstration of based on certainty s Rule E 1 E 2 E 3 min (E 1, E 2, E 3 ) Rule min (0.8, 0.3, 0.25) = 0.25 Rule min (0.8, 0.9, 0.25) = 0.25 Rule min (0.4, 0.3, 0.5) = 0.3 Rule min (0.8, 0.9, 0.75) = 0.75 Key to Evidence Let E 1 be the evidence of Risk Perception Let E 2 be the evidence of Security Measures Let E 3 be the evidence of Risk Impact Cost In the case of Rule 1(Table 6) it is quite clear that the value of risk is low. It is low despite the fact that there is strong support for the risk given that the perception is likely, good security is in place and the impact cost is low. In Rule 2 is also shown that one factor by itself does not improve the certainty of the risk. In this rule, the threat is likely to happen, and therefore, the security measures are not adequate; however, the impact is low and so the certainty of risk becomes small. Likewise in Rule 3 the certainty of the risk is small due to the other factors. Finally, with Rule 4 the situation is different since all of the risk factors are contributing their maximum to the certainty of risk. Consequently, it is quite clear that the certainty of the risk factor affects the certainty of risk. As described above, inference is performed based on the Mamdani system as well as utilization of certainty factors. 2.3 The Output Unit The risk measure is the combination of the risk likelihood, security measures in place and the impact cost. This system provides the linguistic variable described in Table 7 (concluded from Table 6) and Figure 6 as its output to express the fuzzy value of the risk. The second output from the system is the certainty on the fuzzy value of the

5 risk. This certainty factor is calculated based on the individual certainty factors. The third output is the defuzzified value of the risk which gives a crisp risk value. In fact, the procedure of the risk assessment is realized on this step. The risk assessment is classified as Low risk, Moderate risk and High risk. Table 7. Fuzzy set for risk output Notation Numerical Low risk LR [0.0, 4.0] Moderate risk MR [2.0, 8.0] High risk HR [6.0, 10.0] References [1] Darby, J., (2006), Evaluating Risk from Acts of Terrorism with Belief and Fuzzy Sets, Carnahan Conferences Security Technology, Proceedings th Annual IEEE International Oct Page(s): [2] Josang, A., Bradley, D., Knapskog, S. (2004), Belief-Based Risk Analysis, Conferences in Research and Practice in Information Technology, Vol. 32. Australian Computer Society, Inc, [3] Josang, A. (2007) Probabilistic Logic under Uncertainty, Conferences in Research and Practice in Information Technology (CRPIT), Vol. 65, Australian Computer Society, [online] [4] Allahverdi, N., Torun, S., Saritas, I. (2007), Design of a Fuzzy Expert System for determination of Coronary Heart Disease Risk, Proceedings of the 2007 international conference on Computer systems and technologies, ACM [5] Lucas, C., Asheghan, M., Kharazm, P. (2008), A New Decision Making Method Based on fuzzificated Dempster-Shafer Theory, A Sample Application in medicine, Control and automation, MED '06. 14th Mediterranean Conference on June 2006 Page(s):1 6 3 Conclusion Figure 6. Fuzzy Sets for Risk output Risk is an integral factor which should be considered when evaluating the functionality of different types of systems. The distinctive feature of this kind of systems is decision-making under various degree of uncertainty. Risk measurement depends on the degree of uncertainty that can lead to control lost or complete crash of the system in case of low robustness. As shown in this paper, risk depends on different factors which contribute to the value of the risk. Each of these factors impact cost, security measures and perception which could independently affect the level of risk. In this work, a hybrid system of fuzzy based reasoning and uncertainty factor was utilized to comprehensively manage the risk process for the purpose of ensuring that factors such as uncertainty and unexpectedness for risk are accounted for. Also we proposed a mechanism that can be used to monitor the risk assessment process. The process of risk assessment should be evaluated continuously as new threats and vulnerabilities are discovered. Risk assessment is a necessary stage in any system development and its related data should be materialized for creation of principles, methods and factors of system reliability. [6] Dudeck, J., Dan, Q., (1992), Some Problems Related with probabilistic interpretations for certainty factor, Computer based Medical Systems, 1992 Proceedings, 5 th Annual IEEE symposium on AI, Pages ( ). [7] ISO/IEC. Risk Management-Vocabulary-Guidelines for Use in Standards. ISO/IEC Guide 73, [8] Alberts, С., Dorofee, A., Marino, L. (March, 2008), Mission Diagnostic Protocol, Version 1.0: A Risk-Based Approach for Assessing the Potential for Success TECHNICAL REPORT CMU/SEI 2008-TR-005 ESC-TR , Pages (58-62) [9] Anderson, K. "Intelligence-Based Threat Assessments for Information Networks and Infrastructures: A White Paper", [10] Heckerman, David E., Shortliffe, Edward H. From s to Belief Networks To appear in Artificial Intelligence in Medicine, [11] Ping Wang, Kuo-Ming Chao, Chun-Lung Huang, Chi-Chun Lo, Chia-LingHu (2006), A Fuzzy Decision Model of Risk Assessment Through Fuzzy Preference Relations with Users Confidence-interval Proceedings of the 20th International Conference on Advanced Information Networking and Applications (AINA 06). [12] Kasabov, N., Deng, D., L. Erzegovezi, M. Fedrizzi, A. Beber Hybrid Intelligent Decision Support Systems for Risk Analysis and Prediction of Evolving Economic Clusters in Europe Kasabov, N. et.al. / Hybrid Intelligent Decision Support Systems. [13] Artificial Intelligence: A Modern Approach, 2nd Ed., by S. Russell and P. Norvig (Prentice Hall, 2003).