text:
.class Lcom/android/server/NetworkScoreService$1;
.super Landroid/content/BroadcastReceiver;
.source "NetworkScoreService.java"

# annotations
.annotation system Ldalvik/annotation/EnclosingClass;
    value = Lcom/android/server/NetworkScoreService;
.end annotation

.annotation system Ldalvik/annotation/InnerClass;
    accessFlags = 0x0
    name = null
.end annotation

# instance fields
.field final synthetic this$0:Lcom/android/server/NetworkScoreService;

# direct methods
.method constructor <init>(Lcom/android/server/NetworkScoreService;)V
    .locals 0

    iput-object p1, p0, Lcom/android/server/NetworkScoreService$1;->this$0:Lcom/android/server/NetworkScoreService;

    invoke-direct {p0}, Landroid/content/BroadcastReceiver;-><init>()V

    return-void
.end method

# virtual methods
.method public onReceive(Landroid/content/Context;Landroid/content/Intent;)V
    .locals 6

    const/16 v5, -0x2710

    invoke-virtual {p2}, Landroid/content/Intent;->getAction()Ljava/lang/String;

    move-result-object v0

    const-string/jumbo v2, "android.intent.extra.user_handle"

    invoke-virtual {p2, v2, v5}, Landroid/content/Intent;->getIntExtra(Ljava/lang/String;I)I

    move-result v1

    invoke-static {}, Lcom/android/server/NetworkScoreService;->-get0()Z

    move-result v2

    if-eqz v2, :cond_0

    const-string/jumbo v2, "NetworkScoreService"

    new-instance v3, Ljava/lang/StringBuilder;

    invoke-direct {v3}, Ljava/lang/StringBuilder;-><init>()V

    const-string/jumbo v4, "Received "

    invoke-virtual {v3, v4}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v3

    invoke-virtual {v3, v0}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v3

    const-string/jumbo v4, " for userId "

    invoke-virtual {v3, v4}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v3

    invoke-virtual {v3, v1}, Ljava/lang/StringBuilder;->append(I)Ljava/lang/StringBuilder;

    move-result-object v3

    invoke-virtual {v3}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v3

    invoke-static {v2, v3}, Landroid/util/Log;->d(Ljava/lang/String;Ljava/lang/String;)I

    :cond_0
    if-ne v1, v5, :cond_1

    return-void

    :cond_1
    const-string/jumbo v2, "android.intent.action.USER_UNLOCKED"

    invoke-virtual {v2, v0}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z

    move-result v2

    if-eqz v2, :cond_2

    iget-object v2, p0, Lcom/android/server/NetworkScoreService$1;->this$0:Lcom/android/server/NetworkScoreService;

    invoke-virtual {v2, v1}, Lcom/android/server/NetworkScoreService;->onUserUnlocked(I)V

    :cond_2
    return-void
.end method


Response: A history of testicular cancer has been suggested to have an association with an increased risk of developing prostate cancer (PCa) in epidemiologic studies. We hypothesized that there may be an increased risk of developing intermediate to high-risk prostate cancer as well.
Response: 147,044 men with melanoma and 32,435 men with testicular cancer were identified. Prostate cancer was diagnosed in 3,205 men in total. The cumulative incidence of all prostate cancer by age 80 was 2.8% in the control melanoma cohort and 12.6% in the case cohort of men with history of testicular cancer (p<0.0001 for KM survival curves, Figure 1). For intermediate/high-risk disease, the incidence was 1.1% versus 5.8% for each cohort respectively (p<0.0001 for KM survival curves, Figure 2). No association with prostate cancer was seen with non-seminomatous versus seminomatous germ cell tumors. Upon multivariate analysis, testis cancer was associated with an increased risk of all prostate cancer (HR 4.7, p<0.0001) and intermediate/high-risk PCa (HR 5.2, p<0.0001) when controlling for race and radiation history.
Dr. Johnson: We observed that, over the past two decades, there has been an increase in the incidence of testicular cancer in Hispanic American adolescents and young adults (AYAs) between 15 and 39 years of age. This increase is seen in both major subtypes of testicular cancer and affects Hispanic AYA patients with all stages of disease at the time of diagnosis. No comparable increase was observed in non-Hispanic white AYA,s or in older American men regardless of Hispanic ethnicity. Between 1992 and 2010, the incidence of testicular cancer in AYA Hispanics has increased 58% in contrast to just 7% in non-Hispanic white AYAs.


text:
How South Africa is building its BPO credentials globally
South Africa is starting to compete with the big outsourcing-provider countries, but issues involving infrastructure, skills and cost structure persist.
By Bianca Wright
CIO	 Nov 11, 2020 9:00 pm PST
South Africa's emergence as a real international player in the field of business process outsourcing has been a long journey. Technology professionals have been making predictions about its BPO growth and potential for more than 15 years, yet — overshadowed by the larger, more established players like India and the Philippines — it has not been top of mind when companies think of outsourcing.
This is changing, though; a number of recent reports have placed South Africa in the big leagues when it comes to outsourcing. "South Africa is now the third-largest emerging BPO geography, competing with India and the Philippines," according to a recent survey by BPO consultancy Outsource Accelerator.
South Africa's reputation as a BPO destination has been growing for a number of years. It was named "Offshoring Destination of the Year" at the Global Sourcing Association (GSA) Awards in 2018 and it has ranked in the top five of the most attractive BPO locations in the world for three years in a row in the annual Front Office BPO Omnibus Survey conducted by Ryan Strategic Advisory. In 2020, it ranked second after the Philippines.
There is a large amount of interest from North America in South Africa at the moment as an alternative service delivery point, compared to the Philippines or India, says Peter Ryan, BPO analyst and principal at Ryan Strategic Advisory.
Language capabilities strengthen BPO position
"It's really the only other scalable English language option anywhere in the world in the offshore," Ryan says. "And I truly think that the providers are rising to the occasion, the industry association is rising to the occasion and the energy and enthusiasm is something that you don't find in many other places and this is really, I think, a key selling point for the country."
While there is a shortage thoughout sub-Saharan Africa of trained professionals who can meet the demands of IT jobs, South Africa has been at the forefront of efforts in the region to remedy the skills gap.
"Government and private sector efforts to build digital skills capacity among South Africa's youth over the past five years are bearing fruit," according to non-profit organisation Business Process Enabling South Africa (BPESA). "This, together with other initiatives have favourably positioned the country as a global destination for outsourced projects."
Agesan Rajagopaul, a partner at McKinsey and co-author of their report titled Driving economic recovery in South Africa's BPO industry, has been working on a three-year programme with small businesses on job creation, focused on three sectors: agricultural processing, manufacturing, and BPO. Through industry body BPESA, McKinsey has connected with various BPO companies with high growth potential to help them grow, access new markets, help them cut costs and improve efficiency.
Cost efficiency plays a big role in outsourcing
Rajagopaul describes South Africa's BPO positioning as being partially built on cost effectiveness — with the exchange rate falling against the pound and dollar there's been a drastic improvement in competitiveness. He says that South Africa has struck a balance with this, because you don't want to be too low cost and take advantage of employees. More importantly, Rajagopaul says that South Africa is known for its efficiency and quality. "It's not just the neutrality of the accent, it's also the ways that South African call centre and BPO agents are known to engage with customers."
South Africa is being seen to play in the same space as the stalwarts of outsourcing, India and the Philippines. Amazon's recent investment in 3,000 new virtual jobs in South Africa, to service customers in the US and Europe, is indicative of this.
Rajagopaul says BPESA's work to showcase South Africa has played a role and the growth in investment and partnerships from places like the UK has also evidenced a change of perspective on South Africa's BPO.
It's not all positives, though. South Africa is facing some real problems that could shake it from its position as a BPO provider of choice. Notably, rumours of a split in BPESA, with the Western Cape taking its own path, have caused concerns.
Infrastructure issues loom large
Reputational issues are a core threat to South Africa's positioning in BPO as well. South Africa's infrastructure issues around electricity provision, load shedding and water, for example, have made headlines around the world, something that, Ryan says, has surprised South Africans.
Load shedding is much less of a cost issue and more of a reliability issue. Paul Swainson, managing executive of partnerships at CCI South Africa, a BPO contact centre provider in South Africa and Kenya, explains that whilst South Africa's central power and water infrastructure require some investment, CCI, like many others, have put in place their own solutions such as UPS (uninterrupted power supply) facilities, power generators, water storage and harvesting facilities in all their buildings, to ensure a seamless consumer and employee experience.
"The overall technology and transport infrastructure are world-class in South Africa, combined with the great quality of our workforce, making South Africa a destination of choice to BPO & IT outsourcing," Swainson says.
But there are other issues too. "Take a look at the anti-immigration riots that happened a few months ago as well; those didn't go unnoticed in different parts of the world," Ryan says. He adds that accessibility could be an issue if national airline SAA goes under. "We know that they're teetering on the edge of bankruptcy right now. The government keeps having to bail them out, but the same problems keep happening."
Rajagopaul also cautions that in as much as the exchange rate has been a benefit for South Africa, the BPO sector needs to use this opportunity to create a stronger structural cost advantage going forward. "You don't want to be so dependent on an exchange rate benefit, but you want to actually create the structural strength to be competitive on your own, without that," Rajagopaul says. And as with most sectors, the pandemic has also had an impact with some struggling to make the move to home working.
Looking beyond end-user services
For Ryan, it is clear that South Africa's outsourcing sector needs to stake out very clearly two to three non-end-customer areas and focus on those. "They are not India and they shouldn't try to be," he says. He adds that while there is scalability, it is not massive scale, as South Africa is half the size of the Philippines and a 10th the size of India. There are good levels of education in engineering and STEM, but demand for those graduates will be high across a range of sectors.
"If the outsourcing industry is going to be competitive it needs to find higher value niche areas it can focus on," Ryan says. "A great example I think is legal process outsourcing, where South Africa has made great strides in terms of being able to position themselves as a country that can do legal work for the US or Canada, or the UK or Australia. It's that type of work that they should really be looking at making real moves around." McKinsey's Rajagopaul agrees, adding that there also need to be continued investment in skills building to support this.
Despite all this Ryan believes the benefits outweigh the risks. "South Africa is very much on an upward trajectory in terms of its BPO and IT services value proposition," he says. "Where it needs to be is in a position that it can draw in investment that is going to ensure long-term, scalable, niche value-add roles that will help develop the economy further."
Continue reading for free
Create your free Insider account or sign in to continue reading.	Learn more

redpajama_set_name: RedPajamaCommonCrawl


text:
This article is more than 1 month old
Children at risk of strep A in England could be given preventive antibiotics
'Rare' blanket measure may be used at primary schools after at least nine UK deaths from bacterial infection
The UK Health Security Agency said prescribing antibiotics to children in a school or nursery exposed to non-invasive strep A was rare. Photograph: Danny Lawson/PA
Jamie Grierson and Kevin Rawlinson
Tue 6 Dec 2022 10.37 EST First published on Tue 6 Dec 2022 03.36 EST
Primary schoolchildren at risk from a severe form of strep A could be given preventive antibiotics as a blanket measure, in a move described as "rare" by health officials.
At least nine children have died due to complications from strep A bacterial infections since September, with one senior health official suggesting the early start to the strep A season in the UK could be a knock-on effect to immunity levels caused by Covid measures, although others have downplayed the impact lockdowns may have had.
Most strep A infections are mild, with a sore throat or a skin infection that can be treated easily with antibiotics the most common characteristics, and deaths are rare.
In extreme cases, strep A can develop into an invasive group A streptococcal infection (iGAS), which can be fatal. Officials have noticed an increase in iGAS cases this year, particularly in children under 10.
On Tuesday, the schools minister, Nick Gibb, told GB News preventive antibiotics could be given to children in England at schools affected by strep A infections.
He said: "Lord Markham said in the House of Lords yesterday that the UK Health Security Agency are monitoring the position and are considering those kind of issues in those schools where there is an infection.
"This is an ongoing situation, the UKHSA are involved very closely with those schools and they will be providing further advice later on. But that may well be an option for those particular schools where there is an infection."
The plan was floated by the health minister Nick Markham in the Lords on Monday.
The Conservative peer said: "We have given instructions to doctors that where necessary they should be proactively prescribing penicillin as the best line of defence on this, and also where there is a spread in primary schools, which we know is the primary vector for this, whether they should be working with local health protection teams, and sometimes actually look at the use of antibiotics on a prophylactic basis."
On Tuesday, a primary school in Belfast said a five-year-old girl had died after a severe case of strep A, the ninth child to die from the infection in the UK in recent weeks.
Tributes were paid to Stella-Lily McCorkindale, with Black Mountain primary school calling her a "very bright and talented little girl, and very popular with both staff and children, and will be greatly missed by everyone at school". A statement released by the school spoke of its "tragic loss" and said "the thoughts of the entire school are with the pupil's family and friends at this difficult time".
It added: "To assist in supporting our pupils and staff at this sad time, additional trained staff from the Education Authority critical incident response team have been engaged and will be providing support to the school.
"We recognise that this news may cause worry amongst our school community and we want to reassure parents that we continue to work closely with the Public Health Agency at this time."
GPs generally avoid mass prescription of antibiotics as it can build up resistance to serious infections in the population.
The UKHSA said the measure of prescribing antibiotics to children in a school or nursery exposed to non-invasive strep A was rare.
The agency added the move was considered only in "exceptional circumstances" by the outbreak control team (OCT) on a "case-by-case basis".
"There is no good evidence of (antibiotics') effectiveness in routine outbreak control in this setting (involving children who have been contacts of non-invasive strep A)," the UKHSA said.
"It can be considered in exceptional circumstances by the OCT, for example when there are reports of severe outcomes, or hospitalisations. In school and nursery settings, antibiotic chemoprophylaxis is not routinely recommended for contacts of non-invasive (group A streptococcus) GAS infection."
A pupil at Morelands primary school in Waterlooville, Hampshire, became the eighth child known to have died with the invasive form of strep A. On Tuesday, it was reported a ninth child had died, in Northern Ireland.
Adam Finn, a professor of paediatrics at the University of Bristol, told Times Radio it was important to "get the balance right".
"On the one hand not alarm people whose children are mildly ill, and there are a lot of mildly ill children around at the moment, and at the same time help people and support people to seek care and attention when their children become seriously ill – relentlessly sicker and sicker as the hours go by. Those are the children that need to be urgently seen."
He said children with "run of the mill" viral infections could feel unwell and then better again, and "things go up and down", and they continue to eat and drink.
"Children who have got invasive bacterial infection, they don't have those episodes of feeling better – they just get worse and worse," he said.
Illnesses caused by the group A strep bacteria include the skin infection impetigo, scarlet fever and strep throat.
There has been a big increase in scarlet fever cases. There were 851 reported from 14-20 November, compared with an average of 186 for the same timeframe in previous years.
Symptoms of scarlet fever include sore throat, headache and fever, along with a fine, pinkish or red body rash with a sandpapery feel.
On Tuesday, Scotland's health secretary, Humza Yousaf, said the number of strep A infections in the country has increased, but there have been no deaths from the condition.
In Ireland, an investigation was launched into the death of a child to see if it was linked to strep A infection. Dr Éamonn O'Moore, director for national health protection at the HSE and the Health Protection Surveillance Centre, confirmed that strep A could be linked to the four-year-old child's death.


Traditional foldable butler tray in piano black finish.
The exclusive design of the Rudolph Butler Tray Piano Black renders it a discerning quality to serve drinks and snacks while bringing a vintage charm to your setting.
This butler tray absorbs design elements of a bygone era in its classic framework which can be seen in spindle-style legs of the foldable X-shaped base.
A flat countertop can be created by flattening the panels provided at the edges transforming the tray from a lipped drinks tray to a functional table surface.
This serving unit is hand crafted using mahogany wood and MDF to create a lightweight, foldable design that can be stacked away in a corner to save space when not in use.
It is enveloped in a piano black finish and it can be easily placed near any seating area that needs a serving station or a side table.
Please note: Every product is handmade by skilled professionals, rendering them a uniqueness of their own.


Poultry meat production has crossed 120 thousand metric tons mark today, with the introduction of newer species of birds like quail, duck and turkey in the country in addition to the chicken population already existing. There is no exact estimate as to indicate what percentage of this total is actually derived from turkey alone. However, one thing is clear that the farmers living around the cosmopolitan cities of the country are slowly realising the utility of turkey growing.


The paddles look like new. The item "Vintage Elgin 6 qt glass butter churn" is in sale since Wednesday, November 28, 2018. This item is in the category "Collectibles\Kitchen & Home\Kitchenware\Butter Churns". The seller is "pacro_7" and is located in Sequim, Washington. This item can be shipped to United States.


text:
Animal Chuki explores the roots of Latin American music, immersing you into an experimental dance ritual, between folklore and synthesizers.
The Peruvian producers of Tropical Bass, Andrea Campos and Daniel Valle-Riestra, started their project in 2012. The same year, they joined the records company Folcore (Spain), and released their first EP "NATIVA". In 2013, after having remixed the international artist La Yegro, and collaborating in the album ZZK Sound Vol.3, Animal Chuki signed with ZZK Records (Argentina), and delivered its second EP "CAPICÚA". Back from a South American tour in 2014, the duet records its first album "FRUTERO" and so goes to conquer major European stages.
Regularly participating in the biggest parties in Peru as TOMA! Beats Psicotropicales, Fiesta con CH, Fiestas Puro Cachascan and the festival Selvámonos, their recent participation to the festival Hermoso Ruido 2014 (Bogotá, Colombia) has been praised. Warmly welcomed to the TransMusicales of Rennes in December 2014 (France), the obsessive rhythm of the duet is then spread over a European tour, taking them from the Clandestino Festival (Sweden) to the Guacamayo (Spain) and marking stops to some huge clubs in Paris, Barcelone & Berlin such as the Zur Wilden Renate.
Animal Chuki Folcore 007


text:
\section{\label{app:ma-def-example}Mitigation Actions - Example}
    \input{sections/ma_def_example.tex}

\end{document}

\section{\label{sec:ag-background}Attack Graphs}
An attack graph a structured representation of the vulnerabilities present in the system and their interactions with each other or system assets.
A graph-based network vulnerability analysis was first introduced by Philips and Swiler in 1998~\cite{phillips1998graph}.
In their proposed model each node in the graph represents a possible attack state (which is a combination of the current state of the host, the attacker access level, and effects of the attack so far), while edges represent an action that causes a change in the state (for example, the attacker exploits another vulnerability).
In the following decade the research on attack graphs focused mainly on enhancing the underlining models so that attack scenarios can be represented more accurately and efficiently~\cite{sheyner2002automated,jajodia2005topological,ingols2006practical,ou2006scalable} as well as enhance existing attack graph models with defenses~\cite{bistarelli2006defense,bistarelli2006strategic,roy2012attack,kordy2012attack}.

In this research we opt to use the MulVAL (a logic-based security analyzer) reasoning engine~\cite{ou2005mulval}, which is a popular, publicly available, easy to use, and extendable attack graph analysis tool.
MulVAL uses the Prolog language to represent the pre- and post conditions for exploiting a vulnerability, which allows straight forward countermeasure modeling and their automatic association to attack steps.
MulVAL\footnote{MulVAL tool: \url{http://www.arguslab.org/software/mulval.html}} models the interactions between software bugs and network configurations and automates information gathering by deploying host-based scanners.
An example of an attack graph generated by MulVAL is presented in Figure \ref{fig:mulval-example-ag}.
MulVAL models this information using the Datalog language \cite{ou2005mulval}, which is a subset of the Prolog logic programming language.

Datalog consists of \emph{predicates} -- atomic formulas of the form:
\[
    p(t_1,...,t_k)
\]
where, each $t_i$ can be: (1) a constant (starting with a lower-case), (2) a variable (starting with an upper-case), or (3) a wild card ("\_").
For example, the following predicate states that the attacker (\textit{attacker}) can execute code in \textit{dbServer} under some permissions (\textit{Perm}).

\begin{equation*}
        execCode(attacker, dbServer, Perm).
\end{equation*}

Predicates are used to construct \textit{rules} that are represented using Horn clauses as follows:
\[
    P_0 :- P_1,...,P_n
\]
which are translated as: "if the predicates $P_1,...,P_n$ are true, then predicate $P_0$ is also true".
The left part of the clause ($P_0$) is called the \textit{head} and the right part ($P_1,...,P_n$) is called the \textit{body}.
Rules with no body are called \textit{facts}.
For example, the following rule indicates that a principal can use some host (\textit{SrcHost}) to access another (\textit{DstHost}) via network using a specific protocol (\textit{Prot}) and port (\textit{Port}, if he/she has a local access to \textit{SrcHost} and both host-based and network-based access controls allows the communication (\textit{aclH} and \textit{aclNW} predicates).
\begin{equation*}
\footnotesize
\begin{split}
netAccess&(Principal,SrcHost,DstHost,Prot,Port):- \\
		& localAccess(Principal,SrcHost,SrcUser), \\
		& aclH(SrcHost,SrcUser,SrcHost,DstHost,Prot,Port), \\
		& aclNW(SrcHost,DstHost,Prot,Port).
\end{split}
\end{equation*}

MulVAL's logical attack graph is defined as: $AG = (N_r, N_p, N_d, E, \mathcal{L}, \mathcal{G})$.
There are three node types: derivations ($N_r$), primitive facts ($N_p$), and derived facts ($N_d$).
Derivation nodes correspond to rules and represent the logic for a fact to become true (visualized as circles); primitive facts correspond to the inputs describing the specific system (visualized as rectangles); and derived facts) are the results of applying rules on the primitive facts (visualized as diamonds).

An edge $e \in E$ can connect between a primitive or derived fact and a derivation ($e \in \{(N_p \cup N_d)\times N_r\}$), or between a derivation and a derived fact ($e \in \{N_r \times N_d\}$).

The derivation nodes imply an \textit{and} relation between their incoming nodes, which indicate the preconditions for performing the corresponding actions. The derived fact nodes, on the other hand, imply an \textit{or} relation between their incoming nodes, which represent the various ways that lead to the same consequence.

The attack graph also consists of a mapping between nodes and their labels, i.e., the predicates they represent ($\mathcal{L}$), and the node representing the attacker's goal ($\mathcal{G}$).

Attacks are simulated by querying the Datalog program, which is a collection of facts and rules describing a specific system, for the predicate representing the attacker's goal. For example, querying for $execCode(attacker, dbServer, root)$, will indicate whether the attacker can execute code with root privileges on \textit{dbServer}.
The attack graph is constructed based on the trace generated by this query, as described by Ou \emph{et al. } in \cite{ou2006scalable}.
\section{\label{sec:conclusion}Conclusion and Future Work}
We present a heuristic approach towards the security countermeasure selection problem.
Our approach uses an attack graph-based risk assessment process that enables countermeasure selection that consider the network topology, the vulnerabilities found, and the interactions between them; thus provides more accurate and applicable suggestions.
Moreover, we provide an automated method for identifying which countermeasure can eliminate each step in each attack path.
Our approach also explicitly specifies the network position where each countermeasure should be applied.

We model the countermeasure selection problem as a graph path finding problem and used a heuristic solver (A*) to find an optimal solution: a plan (i.e., set of countermeasures and their deployment position) that minimizes the risk in the system as much as possible within the given budget limitation.
The results show that our approach was able to provide solution very close to our expectations.
Moreover, since we use an attack graph-based risk assessment, the plans suggested strive to block each attack path as soon as possible (i.e., in its initial stages).
The proposed plans are also redundant when the budget permits, and may provide suggestions for multiple countermeasures that tackle the same vulnerability or attack path to enhance the security of the system.

Currently, our approach filters out countermeasures that contradict the organization policy (i.e, not blocking ports of legitimate services).
In future work, we aim to extend it to consider operators' preferences.
This can be done as part of the relevant countermeasure identification phase (e.g., in case that the operator doesn't want to deploy a specific countermeasure on a specific host), or by introducing another cost component to make one countermeasure preferable over the other during the search.
Another aspect that should taken into account is shared costs (e.g., one antivirus licence can cover multiple hosts), which significantly affects the algorithm's decisions.
\section{\label{sec:eval}Evaluation}
To demonstrate and evaluate our proposed countermeasure selection process, we modeled the IT network presented in Figure \ref{fig:eval-env}, which contains vulnerabilities that both an external and internal attacker can exploit. We generated an attack graph illustrating all of the different attack paths using MulVAL with our extended modeling, and applied the countermeasure selection process for different budgets.
The heuristic search algorithm we applied is A*
The following subsections describe the modeled network and attacks, and present the results of the selection process for different budgets.

\begin{figure*}[t]
    \centering
    \includegraphics[scale=0.45]{Figures/evaluation_env.png}
    \caption{Evaluation environment.}
    \label{fig:eval-env}
\end{figure*}

\subsection{Evaluation Environment}
Figure \ref{fig:eval-env} illustrates an organization's IT network which serves as the evaluation environment for the proposed countermeasure selection process.
The network consists of five subnets in total:

\begin{itemize}
    \item DMZ -- contains two web servers (\textit{Web Server 1} and \textit{Web Server 2}), an e-mail server (\textit{Email Server}) and a database (\textit{DB3}). The DMZ is fully accessible from the Internet.
    \item DB subnet (\textit{SubnetDB}) -- contains the organization's internal databases: \textit{DB1} and \textit{DB2}, which contain sensitive information regarding the organization's clients.
    \item Subnets 1-3 -- contain four hosts each that represents different departments in the organization.
\end{itemize}

Router \textit{R1} connects the DMZ, DB subnet and the internal subnets (via \textit{R2}) with the Internet.
A vulnerable version of ARP is used across the organization network for intra-subnet communication.
Note that in the current network setup the DMZ is not configured properly since there are no restrictions on external access to the DMZ hosts and there is no separation between the DMZ to the internal subntes.

Employees are allowed to use FTP to transfer data inside the internal network (i.e., among hosts in subnets 1-3), and can access the database servers as part of their work.
The database servers (\textit{DB1} and \textit{DB2}) run Oracle database software and accept requests on port 1521.
Note that \textit{DB1} is not patched properly and runs a vulnerable version of the Oracle database software (CVE-2016-3609), which allows data theft.
In addition, \textit{Host11} accepts remote desktop connections from any location in the network.

Remote operators can use an external host (\textit{Support PC}) to connect hosts in the DMZ via Telnet for remote operations.
The servers in the DMZ also run vulnerable applications: \textit{Web Server 1} runs a vulnerable Apache HTTP server version (CVE-2005-1344) that allows arbitrary code execution upon exploitation; and \textit{Web Server 2} runs a vulnerable Apache Subversion (CVE-2015-5343) that leads to denial of service when exploited.

We consider two types of attackers: internal and external.
The internal attacker is located in \textit{Host23} that is a part of the internal network (\textit{Subnet2}), while the external attacker is located in the \textit{AttackerHost} that is connected to the Internet.
The external attacker can infiltrate into the network by exploiting the vulnerability in \textit{Web Server 1} that allows code execution and can grant him/her with local access to that server, or by obtaining user credentials to \textit{Email Server} by eavesdropping the Telnet communication between \textit{SupportPC} and \textit{Email Server}.
In both cases the attacker is assumed to gain at least one user account in advance: \textit{host11User}, which allows him/her to open RDP connection to \textit{Host 11}.

To summarize, the attacker's goals are as follows:

\begin{enumerate}
    \item Steal sensitive information from \textit{DB1}.
    \item Spoof the communication between two internal hosts (\textit{Host12} and \textit{Host22}) and see the contents of the data transferred.
    \item Read or send fake e-mails by obtaining local access to \textit{Email Server}.
    \item Tamper with the organization's website by executing  malicious code on \textit{Web Server 1}.
    \item Deny users from accessing the organization's Subversion server (\textit{Web Server 2}) and disrupt their work.
\end{enumerate}

Table \ref{tab:eval-av} describes all of the ways an attacker can gain access to each asset in the network.

\input{Tables/attack_vectors.tex}

\subsection{Results}
To mitigate the risk in the network described above, we consider the countermeasures specified in Table \ref{tab:eval-cm}.
The costs were assigned in a way that reflects the complexity and the effort required to deploy each type of countermeasure.
There are four cost levels: \$10, \$50, \$300, and \$1000.

\begin{table}[t]
    \centering
    \caption{Countermeasures used for evaluation.}
    \scriptsize
    \begin{tabular}{|c|c|c|c|}
        \hline\multirow{2}{*}{Product} & \multirow{2}{*}{Type} & \multicolumn{2}{c|}{Cost (\$)} \\
        \cline{3-4}
         & & Deploy & Update \\
         \hline
         Cisco Next-Gen Firewall & Network-based firewall & 1000 & 10 \\
         \hline
         ZoneAlarm & Host-based firewall & 300 & 10 \\
         \hline
         Snort & Network-based IPS & 1000 & 10 \\
         \hline
         Wazuh & Host-based IPS & 300 & 10 \\
         \hline
         McAfee Antivirus & \multirow{2}{*}{Antivirus} & \multirow{2}{*}{50} & \multirow{2}{*}{--} \\
         \cline{1-1}
         Kaspersky Antivirus & & & \\
         \hline
         Various & Patch & -- & 10 \\
         \hline
    \end{tabular}
    \label{tab:eval-cm}
\end{table}

Note that when searching for a plan, the algorithm considers only countermeasures for which the cost stands within the budget limitation; e.g., for budget of \$100 the algorithm will not consider host-based IPS as an option, since its cost (\$300) is higher than the specified budget.
This means that when evaluating a budget that corresponds to one of the cost levels, the search space increases.
Moreover, legitimate services (i.e., the HTTP server in \textit{Web Server 1}, the Apache Subversion in \textit{Web Server 1}, FTP for data transfer, and the communication with the database servers) are crucial to the organization's operation, thus cannot be blocked; Telnet and RDP on the other hand, are less critical, thus can be restricted.

We analyze separately the results for external and internal attack scenarios.
The best way to secure the network, for both external and internal threats, is: (1) patch the vulnerabilities in \textit{Web Server 1}, \textit{Web Server 2}, and \textit{DB1}; (2) install a network-based IPS on router \textit{R2}; and (3) install a network-based firewall to restrict the RDP communication between the internal subnets and the DMZ and the Telnet communication between external devices and the DMZ hosts (or replace with more protected protocol such as SSH, however this countermeasure is currently not modeled).
The deployment cost of this plan is \$2030.

\input{Tables/results.tex}

We examined the countermeasure plans generated for different budgets ranging from \$10 to \$2100.
The plans for each tested budget are presented in Table \ref{tab:plans-per-budget}.
Figure \ref{fig:eval-risk-budget} presents the risk level under the deployment of each generated plan for each attack scenario.
The plot presents the risk for the plans suggested only for budgets \$50-\$1000.
Note that the plans for budgets \$1100-\$2100 also eliminate completely the risk in the system, thus not included in the plot.

\begin{figure}
    \centering
    \includegraphics[scale=0.55]{Figures/risk_budget.png}
    \caption{Risk per budget.}
    \label{fig:eval-risk-budget}
\end{figure}

The suggested plans demonstrate the great advantage of using an attack graph-based risk assessment.
The attack graph specifies the actions that the attacker should take from his/her initial position to his/her goals.
This enables to capture stepping stones that are common to multiple attack paths and to understand which countermeasure can eliminate attack paths as soon as possible.
One can see that as the budget increases, the algorithm chooses the countermeasure not only by the amount of risk they mitigate and cost, but also according to the attack steps; i.e., the algorithm strives to block the attack as early as possible.
For example, consider budgets \$10-\$20, which permit patching/updating one or two devices.
The plan for budget \$10, in both scenarios, includes patching only \textit{Web Server 1} since it introduces the highest amount of risk.
However, the plans for budget \$20 differ.For the external attacker, the DMZ servers (\textit{Web Server 1}, \textit{Web Server 2}, and \textit{Email Server}) are the stepping stones in his/her way towards the internal network; thus, in this scenario, the risk they introduce is higher compared to the vulnerabilities in the external and the algorithm suggest to further patch \textit{Web Server 2}.
On the other hand, in the internal attack scenario, the attacker is more accessible to the internal hosts, thus the algorithm suggest to further patch \textit{DB1}.
This is also evident in the plans suggested for budget \$400.
For both scenarios, patching \textit{Web Server 1}, \textit{Web Server 2}, and \textit{DB1} eliminate most of the attack vectors.
In the internal attack scenario, the only attack goal that survives the patching is spoofing the communication between \textit{Host12} and \textit{Host 22}, since the attacker can still log in to \textit{Host 11} (using RDP) and execute the attack; while in the external attack scenario, the attacker can still exploit the vulnerable communication with the \textit{Email Server} to compromise it, and also to further execute the spoofing attack. As can be seen in the results, the algorithm succeed to capture this information and suggested to extend the plan with a host-based firewall on \textit{Host11} to restrict RDP connections and host-based IPS on \textit{Email Server} accordingly.

Note that as the budget increases, the plans also become redundant (i.e., contain several countermeasures that tackle the same vulnerability).
These redundancies suggest to protect the system's assets with multiple layers of protection.

For example, besides patching a specific vulnerability in \textit{Web Server 1}, the code execution can be detected by antivirus software; thus, starting from budget of \$100, installing antivirus software on \textit{Web Server 1} is included in the suggested plans together with patching it.
Another example is restricting the incoming/outgoing communication to/from hosts that expose vulnerable services.
The suggested plans for budget \$800 include host-based firewalls.
In the internal scenario, a firewall for \textit{Web Server 1} is suggested to restrict its RDP communication with \textit{Host11}, in addition to suggesting to install firewall on \textit{Host11} to restrict incoming RDP connections.
In the external scenario, it is suggested to restrict the outgoing Telnet communication from the \textit{Support PC} by a host-based firewall on top of installing host-based IPS on the \textit{Email Server} to identify suspicious logins.

Another interesting result is the plan suggested for budget \$300.
In the internal scenario, the only attack goal that survives the patching is spoofing the communication between \textit{Host12} and \textit{Host 22}, since the attacker can still log in to \textit{Host 11} (using RDP) and execute the attack.
To thwart this attack, a host-based firewall can be installed on \textit{Host 11} to prevent RDP connections.
On the other hand, in the external scenario, the attacker's access to the internal subnets depends solely on exploiting the vulnerabilities in the DMZ servers.
At this point, only \textit{Email Server} is not patched and can grant the attacker access to the internal network.
This attack vector can be eliminated by installing a host-based IPS on \textit{Email Server}.
As mentioned above, host-based firewall on \textit{Host11} (for the internal scenario) and host-based IPS on \textit{Email Server} (for the external scenario) are the two countermeasures that can eliminate all of the remaining risk in the system after patching all possible vulnerabilities (i.e., the plan for budget \$30).
However, the three patches reduces more risk than just a firewall or IPS, thus the algorithm suggested patching over firewall or IPS.
The reason that the plan doesn't include antivirus software as in the plans for \$100-\$200, is the fact that these plans have the same f-value and g-value (because they cover the same vulnerabilities and are within the budget limitation), thus the cheapest plan is preferred (see subsection \ref{subsec:astar}).

The plans for budget \$2100 contain many of the countermeasures we expected to see; however, the algorithm didn't suggest on the expected network-based solutions.
The plan suggested for the internal scenario includes: all three patches, both antivirus software for \textit{Web Server 1}, host-based firewalls for \textit{Host11} and \textit{WebServer1} to restrict RDP connections to \textit{Host11}, and a network-based firewall between \textit{Subnet2} and \textit{Subnet1} (also to restrict RDP connections to \textit{Host11}.
The plan suggested for the external scenario includes: all three patches, both antivirus software for \textit{Web Server 1}, a host-based IPS for \textit{Email Server}, host-based firewalls for \textit{Support PC} and \textit{Email Server} (to restrict Telnet), \textit{Host11} and \textit{Web Server 1} (to restrict RDP).
The network modeling we used to generate the attack graph considers firewalls to control the communication between only two subnets.
Thus our approach proposes to place a network-based firewall between the Internet and DMZ, and between the DMZ and \textit{Subnet 1}.
Since there are only three types of communication to block between the Internet and DMZ, the algorithm prefers to place three host-based solutions (that cost \$900) over a network-based solution (that costs \$1000).
A network-based firewall solution was nor selected to control the communication between the Internet and DMZ due to its cost.

Note that currently there is no preference for countermeasure of the same type; e.g., one antivirus software is not preferred over the other, thus the algorithm recommendation on the specific antivirus software is random.
This can be changed by introducing preference criterion to the countermeasure modeling and integrating it in the risk assessment or during the search.

\begin{figure}
    \centering
    \includegraphics[scale=0.55]{Figures/ag_vs_eq_exec_budget.png}
    \caption{Calculating risk using equations vs. regenerating attack graph.}
    \label{fig:ag_vs_eq_exec_time}
\end{figure}

\subsubsection{Attack graph regeneration vs. risk equations}
Unlike other methods (e.g., \cite{santhanam2013identifying,chung2013nice,kotenko2016dynamic}), we avoid regenerating the attack graph when evaluating the effectiveness of a countermeasure plan, since it is computationally heavy.
Instead, we suggest to represent the attack graph and the countermeasures that can eliminate each node as mathematical equations, where the variables correspond to the implementation of each possible countermeasure, and just substitute them with suitable values according to a given plan (see Subsection \ref{subsec:risk-eq}).

Figure \ref{fig:ag_vs_eq_exec_time} illustrates the difference in the execution time for calculating the risk when using our approach and regeneration of the attack graph under different plans.
We measured the attack graph regeneration time by executing the MulVAL tool (as we do in the risk assessment phase) with various input files simulating the application of different countermeasure plans, and took the minimal time as reference.
This means that computing the risk for \textbf{each} expanded node during the search will take at least this minimal time measurement.
Note the this measurement is an under estimation of the real attack graph generation time.
As can be observed, regenerating the attack graph to compute the risk is significantly less efficient than our suggested approach.

\subsubsection{Attack graph-based vs. traditional risk assessment}
Traditional risk assessment process, such as performed in \cite{viduto2012novel}, is mostly manual.
The first step is to gather information about the network and its vulnerabilities.
This information is crossover with public data sources, e.g., NVD and CVSS.
Next, a threat analysis is performed.
This step includes identifying potential threat sources and associate the discovered vulnerabilities to threats. The likelihood of a risk acting over a vulnerability is estimated based on the organization's history.
Finally, a list of generic countermeasures is generated. Each countermeasure has its cost (that consist of purchase cost, operational cost, training cost, and man power) and a score that represents its impact on the vulnerabilities that was found (which is usually the base CVSS score).
The countermeasures are chosen by the severity scaling of vulnerabilities; i.e., the vulnerabilities with the highest CVSS score are treated first.

The evaluation network contains four vulnerabilities with CVEs: (1) CVE-1999-0667 with CVSS score 10; (2) CVE-2005-1344 with CVSS score 7.5; (3) CVE-2015-5343 with CVSS score 7.6; and (4) CVE-2016-3609 with CVSS score 9.
Moreover, the Telnet protocol is vulnerable since it is not encrypted.
This is a vulnerability in the protocol's design, thus doesn't have a specific CVE and required to be scored by an expert.
Since it allows stealing users' credentials, it is reasonable to be assigned with the maximum score of 10.

If we were to perform a traditional risk assessment to the evaluation network, we would choose to fix the vulnerabilities in the following order: (1) CVE-1999-0667 and Telnet; (2) CVE-2016-3609; (3) CVE-2015-5343; and lastly CVE-2005-1344.
This means that we will first fix the vulnerabilities on the internal hosts and only then the vulnerability in the DMZ host.
However, when considering an external attacker, many of the attack vector can be eliminated by fixing the DMZ hosts vulnerabilities, which have less severely ranked.

The most severe vulnerability is the ARP spoof (CVE-1999-0667).
To fix this, the protocol should be replaced, or defense mechanisms should be installed all on hosts in all subnets.
Fixing this vulnerability is important but also entails high expenses.
However, note that in order for an external attacker to reach the internal network, he/she is required to first gain access to one of the hosts in the DMZ.
Thus, the attacker can be prevented from reaching the internal network by fixing the vulnerabilities in these hosts, although most of them are less severe than the internal network vulnerabilities.
Note that fixing these vulnerabilities is also likely to be less expensive, since it requires to patch two hosts and to change or restrict the communication with a specific host.

These insights cannot be reached without considering the network topology, thus choosing countermeasures based just on vulnerabilities' severity doesn't guarantee an optimal plan.
This is exactly the missing information that is captured by attack graphs.
Since attack graphs illustrate the paths from the attacker's initial position to his/her goal, it captures the fact that fixing the DMZ hosts first will eliminate the paths to the internal hosts (this step will appear at the beginning of the path); and this is reflected in the plans that our algorithm provides.
\section{\label{sec:heuristic}Heuristic Algorithm}
In this section, we present a heuristic approach for finding a countermeasure plan for a specific system under a given budget limitation that minimizes the risk in the system as much as possible.
This approach is based on the attack graph-based risk assessment products described in~\ref{subsec:risk-eq}.
Following is a formal definitions of the problem and a description of a heuristic solver that solves it.

\subsection{\label{subsec:problem-def}Problem Definition}
We suggest to model the countermeasure selection problem as a graph path finding problem and use a heuristic solver to find an optimal solution as defined by Pohl in \cite{pohl1970heuristic}.
Given a set of countermeasures ($CM$) and a budget limitation ($Budget$), we define the path finding problem as follows:

\begin{itemize}
    \item $X = \{x_1,x_2, ... ,x_n\}$ is the set of nodes (also referred to as \textit{states}), where $x_i = \{cm_{ID}^{pos} | cm_{ID} \in CM\}$ for $1 \leq i \leq n$; $pos$ corresponds to the network position where the countermeasure should be deployed.
    \item $E = \{(x_i,x_j)|x_i,x_j \in X, x_j \in \Gamma(x_i)\}$ is the set of edges between the nodes in $X$, where $\Gamma$ is the mapping between a node to its successor.
    \item $\Gamma(x) = \{x_1,x_2, ... , x_{|x_i|} |\forall k, 1 \leq k \leq |x_i|: x_{i_k}=x \setminus \{x[k]\}\}$ is the successor mapping (also referred to as \textit{expand function}). The successors of a specific node are created by omitting one countermeasure each time.
    \item The initial node contains all of the available and relevant countermeasures to reduce the risk in the system.
    \item A terminal node (also referred to as \textit{goal node}) is a node $x$ such that $Cost(x)=\sum_{i=1}^{|x|}Cost(x[i]) \leq Budget$; i.e., the cost of deploying the countermeasure plan it represents stands within the budget limitation.
    \item $f(x) = g(x) + h(x)$ reflects the estimated risk to the system under the deployment of a subset of the countermeasures in $x$ (also referred to as \textit{f-value}); where $g(x)$ is the risk to the system under the deployment of all countermeasures in $x$ (also referred to as \textit{g-value}), and $h(x)$ is an estimation of the risk added by removing countermeasures from $x$ in order to comply with the given budget limitation (also referred to as \textit{h-value}).
\end{itemize}

\subsection{\label{subsec:astar}Heuristic Solver}
To solve the path finding problem defined above and find an optimal countermeasure plan, we used the A* algorithm.
A* is a best-first search algorithm that aims to find a path from a given initial node to a goal node with the smallest possible cost (i.e., the sum of the path's edges cost is the smallest).
In our context, the sum of a path corresponds to the risk in the system under the deployment of the plan represented by the goal node; i.e., each edge corresponds to the new risk introduced to the system by omitting a countermeasure.

To perform the search, the algorithm maintains two sets: open list and closed list.
The closed list contains all of the nodes that were already selected to participate in a path, while the open list holds all of the potential nodes to continue a path.
In each iteration, the algorithm selects the best node from the open list and adds it to its corresponding path.
It also expands the open list with all of the candidate nodes to continue this path (i.e., the result of applying the expand function on the selected node).
The open list is implemented as a priority queue that sorts the nodes by their f-value.
Algorithm~\ref{alg:astar_solver} presents the A* solver for the countermeasure selection problem.

\begin{algorithm}[t]
\caption{A* Solver}\label{alg:astar_solver}
\scriptsize
    \begin{algorithmic}[1]
        \State\textbf{Inputs:}
            \State $\qquad$ $RiskEq \gets RiskEquations$
            \State $\qquad$ $initial \gets RelevantCountermeasures$
            \State $\qquad$ $\text{B} \gets \text{Budget}$
        \State\textbf{Initialize:}
            \State $\qquad$ $\text{OpenList} \gets PriorityQueue()$
            \State $\qquad$ $\text{ClosedList} \gets []$
        \Procedure{A*-Solver($RiskEq$ , $initial$, $B$)}{}
            \State $OpenList.add(initial)$
            \While {$!OpenList.isEmpty()$}
                \State $plan \gets OpenList.poll()$
                \If {$plan \in ClosedList$}
                    \Continue
                \EndIf
                \If {$Cost(plan) \leq B$ }
                        \State \Return $plan$
                \EndIf
                \State $ClosedList.append(plan)$
                \ForEach {$cm \in plan$}
                    \State $newPlan \gets plan \setminus \{cm\}$
                    \If {$!(newPlan \in OpenList) \&\& !(newPlan \in ClosedList)$ }
                        \State $OpenList.add(newPlan)$
                    \EndIf
                \EndFor
            \EndWhile
        \EndProcedure
    \end{algorithmic}
\end{algorithm}

Note that A* can advance in multiple paths simultaneously, while guided by the f-values towards the best solution.
In our context, the f-value of a node represents the estimated risk in the system under the deployment of a subseset of the plan represented by the node, which cost is equal or lower than the given budget.

To help further guide the search towards a cost-effective solution, the open list is sorted as follows:

\begin{enumerate}
    \item by the f-value -- the lower the better; the plan that can be reduced while introducing as little risk as possible is preferred.
    \item by the g-value -- the higher the better; if the estimate risk introduced by a subset of two plans is similar, the plan that already introduces the greater risk is preferred (this implies that the risk introduced by removing countermeasures is smaller, thus closer to a goal).
    \item by the deployment cost -- the lower the better; if two plans have the exact same risk estimation, the cheaper plan is preferred, since it is closer the budget.
\end{enumerate}

The f-value is calculated based on the current risk in the system (g-value) and the estimated risk to be introduces to the system by removing countermeasures from the current plan towards the budget limitation (h-value). The h-value is computed in two steps as follows:

    \noindent \textbf{ (1) Estimate the minimal amount of countermeasures to remove:} given a node $n = \{C_j=cm_{ID}^{pos} |\forall cm_{ID} \in CM\}$, sort in descending order the deployment costs of the participating countermeasures: $costs_n=\{Cost(C_j) |\forall C_j \in n\}$, and count the top countermeasures (denoted by $X$) required to remove in order to reduce the current plan's cost to the budget.

    \noindent \textbf{(2) Estimate the minimal risk introduced by removing $X$ countermeasures:} given the same node $n$, we define: $n^{-C_j}=n\setminus\{C_j\}$, which is essentially a version of the plan $n$ after removing the countermeasure $C_j$.
    Then, for each $C_j\in n$ we compute the risk introduced by removing each of the countermeasures in $n$: $risks_n=\{\Delta_n^{C_j}=Risk(n^{-C_j})-Risk(n)|\forall C_j \in n\}$, and sort them in ascending order.
    Finally, the minimal risk estimated to be added to the system is the sum of the top $X$ values in $risks_n$.

We demonstrated the heuristic calculation using the attack graph in Figure~\ref{fig:mulval-example-ag}.
Consider the plan $n = \{C_3,C_4,C_5\}$, and a maximal deployment budget of \$50.
First, the costs of $n$'s countermeasures (as specified in Table \ref{tab:example-cm}) are sorted in descending order: $costs_n=\{50,10,10\}$; the total deployment cost of $n$ is \$70.
If we were to remove the countermeasure that costs \$50 (i.e., $C_4$) from $n$, the new plan's deployment cost will correspond to the budget ($70-50=20 \leq 50$).
Thus, at least one countermeasure should be removed, i.e., $X=1$.

Second, we compute the risk differences ($\Delta_n^{C_j}, j\in \{3,4,5\}$) according to Equation \ref{eq:risk-eq-example}:

\begin{subequations}
    \footnotesize
\[
    \begin{array}{ll}
        n = \{C_3,C_4,C_5\}, & Risk(n) = (0.37 \cdot 0 \cdot 0 \cdot 1 \cdot 1) + (0.65 \cdot 0 \cdot 1 \cdot 1) \\
        n^{-C_3} = \{C_4,C_5\}, & Risk(n^{-C_3}) = (0.37 \cdot 0 \cdot 0 \cdot 1 \cdot 1) + (0.65 \cdot 1 \cdot 1 \cdot 1)  \\
        n^{-C_4} = \{C_3,C_5\}, & Risk(n^{-C_4}) = (0.37 \cdot 1 \cdot 0 \cdot 1 \cdot 1) + (0.65 \cdot 0 \cdot 1 \cdot 1)  \\
        n^{-C_5} = \{C_3,C_4\}, & Risk(n^{-C_5}) = (0.37 \cdot 0 \cdot 1 \cdot 1 \cdot 1) + (0.65 \cdot 0 \cdot 1 \cdot 1)  \\
    \end{array}
\]
    \begin{gather*}
        \Delta_n^{C_3} = 0.65,~~\Delta_n^{C_4} = 0,~~\Delta_n^{C_5} = 0
    \end{gather*}
\end{subequations}

According to the above computation, we get that: $risks_n=\{0,0,0.65\}$.
Thus the minimal risk for removing one countermeasure from plan $n$ is 0, i.e. $h(n)=0$.

Note that this heuristic is admissible.
When assessing the risk to be added by a one-countermeasure reduced plan, we essentially inspect the effect of each countermeasure individually, which can be lower or equal to the effect of multiple countermeasures.
This ensures to not over-estimate the risk introduced.
Considering the removal of all possible combinations of countermeasures in $X$ is computationally heavy and thus not feasible.
\section{Introduction}
In recent years we have witnessed a rapid growth in the number of vulnerabilities discovered in popular systems and applications.
When thousands of vulnerabilities revealed every month, risk management procedures must be performed automatically and continuously.

A traditional information security risk management process includes three main phases: identification, assessment and treatment.
The identification phase begins with identifying system assets (e.g., databases, servers, data, applications, and network elements).
Next, the threats to these assets should be explored (e.g., unauthorized access, misuse of information, loss of data).
When exploring system threats, it is essential to consider both an internal and external threat actors.
The last step in this phase is monitoring the system and assets in order to identify security vulnerabilities.

In the assessment phase, the identified assets, threats and vulnerabilities are aggregated into attack paths that an attacker can take in order to compromise a system asset (i.e, a realization of one or multiple threats).
For each attack path, both the \textit{impact} to the system (i.e., the damage caused when successfully exploited) and the \textit{likelihood} (probability) of occurrence should be determined.
This probability is usually determined by considering the prerequisites and consequences of exploiting security vulnerabilities, as well as the attacker's potential lateral movements.
These two metrics define the risk for a given attack path, which is essentially the product of likelihood and impact.
The outcome of this phase is the attack surface of the system, which is represented by the different attack paths a threat actor can take to compromise system assets.
The overall risk of the system is calculated by accumulating the risk introduced by all attack paths in the attack surface.

The treatment phase involves prioritizing and implementing the appropriate security countermeasures for reducing the risk of the system.
Since eliminating all of the risk is impractical, an optimal countermeasure deployment should reduce the risk to an acceptable level with a given allocated budget.
The outcome of this phase is usually a prioritized list of countermeasures, and the residual risk in the system after implementing those countermeasures.

Previous works for selecting the optimal countermeasure deployment can be classified into two main approaches.
The first approach utilizes the common vulnerability scoring system (CVSS)\footnote{CVSS: \url{https://www.first.org/cvss}} (e.g., \cite{viduto2012novel}),
which provides for each vulnerability a score reflecting its severity.
The score is derived from the exploitability (e.g., attack complexity, required privileges) and impact of the vulnerability (i.e., compromising confidentiality, integrity, or availability).
This approach, however, ignores the prerequisites for exploiting a vulnerability (e.g., a port that should be open in the organization firewall); does not consider the attacker lateral movement as well as the potential involvement of a vulnerability in multiple attack paths; and does not distinguish internal from external threat actors.
Therefore, although the main benefit of this approach is its efficiency (calculating the accumulated risk in a system using CVSS is very fast);
a countermeasure selection process which is based solely on CVSS cannot produce an optimal countermeasure deployment, since it is based on a limited risk assessment method.

The second approach utilizes attack graphs (e.g., \cite{chung2013nice,kotenko2016dynamic,santhanam2013identifying}).
An attack graph is a structured representation of the relationships between vulnerabilities and system assets, and between different vulnerabilities.
Attack graphs (e.g., logical attack graph) can also represent the prerequisites and consequences of vulnerabilities, as well as the attacker's potential lateral movements (see Section~\ref{sec:ag-background} for more details).
When generating an attack graph, the identified security vulnerabilities are aggregated into attack paths, which specify the actions a threat actor can take in order to compromise system assets.
Using attack graphs, the risk can be evaluated with respect to specific assets and threat actors.
Hence, a risk assessment method that is based on attack graph is more accurate.
However, the computational complexity for generating an attack graph is polynomial with the size of the network and the number of vulnerabilities, thus generating an attack graph is a highly time consuming task.
Therefore, while a countermeasure selection process that is based on attack graphs can potentially provide an optimal countermeasure deployment, a naive implementation of such process on which the attack graph is re-generated at every step of the selection process is not practical.
In addition, current methods for countermeasure selection that are based on an attack graph modeling are limited because they do not consider the network topology nor vulnerabilities in network protocols.

In this paper, we suggest a heuristic method for selecting, given a budget limitation, the optimal countermeasure deployment.
The optimal countermeasure deployment is defined as the set of countermeasures, which minimizes the risk of the system within budgetary limitation.
In the proposed methods, the risk to the system is represented using an enhanced attack graph model, which in addition to software vulnerabilities considers physical network topology and vulnerabilities in network protocols.
The benefit of using this model is three-fold.
First, it provides an accurate representation of the risk to the system, which considers attacks on network protocols (such as ARP spoofing, DNS spoofing and SYN flooding).
Second, it support advanced types of communication such as wireless communication, and thus it can be used to model cyber-attacks on networks that include IoT devices.
Third, it allow us to consider the network positions of each countermeasure.

In order to find the optimal countermeasure deployment efficiently, we model the problem as shortest path finding problem, designed an admissible heuristic to reduce the search space, and used the A* solver to find an optimal solution.
Because re-generating the attack graph at each iteration of the search process is impractical, we introduce the notion of \textit{risk equation} i.e., the risk introduced by exploiting an asset, together with possible countermeasures that can eliminate this risk; which enables us to evaluate the risk of the system under different countermeasure deployments without re-generating the attack graph.
For these reasons, the proposed method provides a more accurate and efficient countermeasure deployment planning process.

\section{\label{sec:mitigation-action}Mitigation Action and Countermeasure Modeling}
\subsection{Overview}
In this work, we define countermeasures as specific security products (e.g., Palo Alto Firewall) that are mainly characterized by two attributes: the defense mechanism they implement and the set of mitigation actions they provide.
A defense mechanism defines a family of security products (e.g., Firewall, antivirus).
Mitigation action, on the other hand, is a specific functionality that is provided by the countermeasure and is not associated with a specific security product (e.g., update a Firewall rule to disable/enable specific communication).

Note that a security breach can be eliminated by different mitigation actions.
For example, code execution due to vulnerability in a local program could be eliminated by both patching the vulnerable program or installing an anti-virus to prevent it.
The categorization of countermeasures in both general (defence mechanism) and specific (mitigation action) attributes allows more efficient matching process between security issues and countermeasure.

The following sections provide detailed description of the countermeasures and mitigation actions modeling.
Moreover, Section~\ref{subsec:ma} presents a methodology for defining specific mitigation actions based on MulVAL attack graph modeling.

\subsection{\label{subsec:ma}Mitigation action}
Our modeling of mitigation actions is inspired by LAMBDA~\cite{cuppens2006anti}, and consists of the following fields:

\begin{itemize}
    \item ID -- unique identifier.
    \item Countermeasure type: the defense mechanism corresponding to the mitigation action.
    \item Action -- description of the mitigation action.
    \item Post-conditions -- the cancelled conditions and side-effects of applying the action.
    \item Pre-conditions -- the conditions that must be met in order to apply the action.
    \item Position -- pointer to the location of the new security product in the network.
\end{itemize}

The pre- and post-conditions are represented by the same Prolog predicates that are used to generate the attack graph.
The primary post-condition represents the fact that is cancelled by the mitigation action (thus it is written in negation).
Other post-conditions are optional and represent the ``side-effects" of performing the mitigation action.
The pre-conditions represent the conditions that must hold in order to perform the mitigation action.
We chose to represent the mitigation actions' pre- and post-conditions using Prolog predicates in order to be able to automatically match them with each attack graph node, and also to use the corresponding query traces to infer the network position that the mitigation action should be applied.
Examples for specific mitigation actions representation is presented in Appendix~\ref{app:ma-def-example}.
Following is a description of a methodology for modeling mitigation actions based on a given Prolog program (i.e., attack graph modeling).

\subsubsection{Modeling Methodology}
The process of defining mitigation actions is illustrated in Figure~\ref{fig:ma-methodology}.
First, defense mechanisms are enumerated in order to create a general set of remedies (denoted by $DM$), which are then associated with all of the predicates they can eliminate.
Note that $DM_{p_i}$ is the set of defense mechanisms that can eliminate the fact represented by predicate $p_i$.
In this work, we consider the following defense mechanisms: firewall (host and network based), software patch, antivirus software, and intrusion prevention system (host and network based).

Next, the conditions that enable the existence of the facts represented by the predicate $p_i$ are identified.
We distinguish between two cases: (1) primitive predicates or predicates that are derived by only one rule (referred to as single-rule predicates) and (2) predicates that are derived by multiple rules (referred to as multi-rule predicates).
Predicates of the first case represent only one possible scenario, thus we consider only the pre-conditions of the defense mechanism.
For example, \textit{vulHost} is a primitive predicate that indicates the existence of a specific vulnerability in a specific program running in some host:
\[
    vulHost(Host, VulID, Program, Range, Consequence).
\]
A vulnerability can be handled by two defense mechanisms from our set: software patch or network-based IPS.
Each of them requires that there exists a patch/IPS rule that can identify the specific vulnerability (denoted by \textit{VulID}).

Predicates of the second case might represent more than one possible scenario that leads to the same consequence.
In this case, all of the rules are first grouped by their pre-conditions such that the rules in each group (denoted by $g^{p_i}_j$) represent similar scenarios.
Each group is a candidate for a mitigation action, and the set of common pre-conditions is part of the corresponding mitigation action's pre-conditions.
For example, \textit{aclNW} is a predicate that describes network communication:
\[ aclNW(SrcHostOrSubnet, DstHostOrSubnet, Protocol, Port). \]
This predicate describes four different types of communications: (1) between two hosts (inside the same subnet or between subnets); (2) between two subnets; (3) between a  specific host and an entire subnet; and (4) between an entire subnet and a specific host.
Thus, the rules deriving the \textit{aclNW} are divided into four groups, which can be cancelled by a network-based firewall.
Note that the post-condition for each predicate $p_i$ is the predicate itself (i.e., the fact that is cancelled by the mitigation action).

Finally, mitigation action instances are created from the combination of the previously extracted scenarios and the defense mechanisms that can eliminate them.
Note that for defense mechanism that requires installation (e.g., firewall or IPS) two mitigation actions are created -- for the case that the defense mechanism should be installed (in this case another pre-condition is added to indicate that it is not installed yet) and for the case that it is installed and needs to be updated (in this case another pre-condition is added to indicate that the defence mechanism exists).
A detailed example of defining mitigation actions for the \textit{vulHost} and \textit{aclNW} predicates is given in Appendix~\ref{app:ma-def-example}.

Mitigation actions also contain a specification of how to extract the network position where to deploy the defense mechanism from the corresponding query trace.
The deployment position can be one of the following: (1) the vulnerable host (e.g., installing an HIPS or patching a program; (2) an existing security product (e.g., updating a firewall rule or an NIPS); and (3) a network position (e.g., when installing a new firewall to separate two existing subnets).

\begin{figure}
\includegraphics[scale=0.30]{Figures/mitigationModel.png}
	\caption{Mitigation action definition methodology.}
    \label{fig:ma-methodology}
\end{figure}

\subsection{Countermeasures}
Countermeasures are characterized by more technical details regarding security products such as: cost, manufacturer, and are associated to the set of mitigation actions they support.
Each product can support one or more mitigation actions and consists of the following fields:

\begin{itemize}
    \item ID -- unique identifier.
    \item Manufacturer -- the name or identifier of the manufacturing company (e.g., Cisco).
    \item Product ID -- the name or identifier of the specific product of the manufacturing company (e.g., Snort).
    \item Deployment Cost -- the cost of the product and the deployment expenses.
    \item Coin -- the currency of the deployment cost value (e.g., USD).
    \item Mitigation Action IDs -- list of mitigation action id's supported by the product.
\end{itemize}

The modeling of new countermeasures is based on market research.
New countermeasures are added if new products appear on the market.
The products modeled must provide one or more mitigation actions.
Note that new types of security products can also lead to the creation of new mitigation actions.
In light of our modeling method, by modeling mitigation actions and countermeasures from a group of existing security product types, we prevent the creation of imbalance between the two.
\section{\label{sec:related-work}Related Work}
One approach for countermeasure selection is to recommend mitigation for specific events, as presented by Cuppens \emph{et al. }~\cite{cuppens2006anti}.
They suggest a decision support system to assist security administrators in selecting appropriate countermeasures, which is implemented as part of an intrusion detection system (IDS).
The system holds a repository of previously observed attacks and countermeasures that are represented in LAMBDA (LAnguage to Model a dataBase for Detection of Attacks) -- a generic language used to describe attacks in terms of pre and post conditions.
Countermeasures are represented in LAMBDA as follows: the pre-condition represents a system state that requires to apply the countermeasure and the post-condition which is the system state after applying the countermeasure (usually the negation of the pre-condition).
The authors defined the concepts of \textit{correlation} and \textit{anti-correlation}.
Two instances are correlated if the post-condition of one supports the pre-conditions of the other (i.e., these instances represent attack steps in a multistage attack scenario).
Two instances are not-correlated if the post-condition of one contradicts the pre-conditions of the second (i.e., one instance represents a countermeasure that prevents the other instance that represents an attack).
The countermeasure recommendation process is triggered by alerts raised by the IDS.
Upon an alert, future attack steps are identified by searching the repository for correlations, while countermeasures are identified by searching for anti-correlations.

In this work, we use LAMBDA for the representation of mitigation actions.
The structure of LAMBDA (i.e., the pre and post conditions) is very similar to MulVAL's attack graph modeling, which also represents attacks according to pre and post conditions (see Section \ref{sec:ag-background}).
Thus, enables easy representation and mitigation actions to attack graph nodes matching (see Subsection \ref{subsec:cm-id}).

Other approaches suggest selecting a countermeasure plan to reduce the global risk in a system, and not just to mitigate a specific event.
Viduto~\emph{et al. }~\cite{viduto2012novel} presented an approach for recommending efficient countermeasure set in terms of both cost and risk.
Their approach is divided into two parts: (1) risk assessment process that results in an initial countermeasure set, and (2) an optimization process that refines the selected set using a multi-objective optimization algorithm (Tabu-search).
The risk assessment process consists of 11 steps, during which: the organization's assets are identified and scanned for vulnerabilities and existing exploits; vulnerabilities are mapped to their impact based on their CVSS scores and are matched to threats identified in the organization; a likelihood table is computed to indicate the probability for a threat to materialize given that the attacker exploited a vulnerability; finally, the total risk in the system is computed and an initial countermeasure set ids selected from a predefined generic list.
In the second phase of their approach, the initial countermeasure set is used as the initial state to the heuristic multi-objective Tabu search algorithm, which finds a countermeasure set that minimizes both the countermeasures implementation cost and the risk in the system.
Although their approach is designed to consider the two major aspects in countermeasure selection, the mitigated risk mitigated and and cost, the risk assessment process is mostly manual and requires experts' knowledge.

Unlike Viduto \emph{et al. }, we follow previous works that suggested automating the risk assessment phase by using attack graphs.

Kijsanayothin and Hewett~\cite{kijsanayothin2010analytical} presented an analytical approach for using attack graphs for network protection.
Their approach chooses the most preferred countermeasures to eliminate attack paths using CP-Net (a graphical model for representing qualitative conditional preference relationship among decision variables).
However, it cannot provide a recommendation that satisfies a given budget.
Moreover, they don't consider the amount of risk each countermeasure mitigates.

Santhanam~\emph{et al. }~\cite{santhanam2013identifying} used preference graph to generate the most preferred and effective (in terms of attack paths elimination) countermeasure strategy.
They introduced the C$^3$I-net (credibility-constrained conditional importance network), which is based on the CI-net (conditional importance network) -- a language for representing ordinal preferences over a set of goods. In their approach, the C$^3$I-net is converted to a preference graph, which enables to iteratively discover the most preferred strategies. The effectiveness of each strategy is evaluated by generating an attack graph according to its effect. If the attacker's goals are satisfied, the strategy is considered effective. The optimal solution is the first discovered strategy that is also effective.

Chung~\emph{et al. }~\cite{chung2013nice} presented the network intrusion detection and countermeasure selection (NICE) framework.
NICE is a multi-phase distributed vulnerability detection, measurement, and countermeasure selection mechanism aimed at preventing virtual machines (VMs) in a cloud from being compromised.
The authors used a variation of MulVAL for generating the attack graph that is able to represent IDS alerts.
The attack graph is generated based on vulnerabilities discovered in offline or online scans and the alerts raised, and is regenerated upon the discovery of new vulnerabilities or countermeasure deployment.
Similar to \cite{cuppens2006anti} \emph{et al. }, countermeasures are selected per alert from a predefined countermeasures pool.
However, in this work, the probability of vulnerability exploitation (based on its CVSS base metric) is taken into consideration.
Upon an alert, the probabilities of the corresponding node and the rest of the nodes in the path to the goal are updated.
Based on these probabilities, the benefit of deploying each suitable countermeasure is calculated. Finally the optimal countermeasure is selected based on the return on investment (ROI) metric.

Gonzalez-Granadillo~\emph{et al. }~\cite{gonzalez2017attack} used the return on response investment (RORI) metric, which indicates the gain earned by implementing a countermeasure (i.e., response) relative to its cost, and introduced its stateful version (StRORI) that includes consideration in the system's state at the time of evaluation.
The authors present a mitigation model to handle ongoing and potential attack, which has two operation modes.
The first is the \textit{preventive mode}, during which an initial set of countermeasures is created based on attack graph nodes coverage.
The second is the \textit{reactive mode}, during which the risk associated with each attack graph node is updated based on reports of real attacks identified in the system, and new countermeasures are selected (based on the StRORI metric) and enforced.

Kotenko and Doynikova \cite{kotenko2016dynamic} defined a method for countermeasure selection that utilized attack graph-based metrics.
The attack graph used by their method is \cite{jajodia2005topological}.
Their method is based on many open standards (e.g., CVE, CVSS) and relies on existing countermeasures, such as firewalls and IDS, to provide information regarding security events.
Similar to \cite{cuppens2006anti,chung2013nice}, the recommendations are event-driven (i.e., the countermeasure selection process is triggered by a security event).
An attack graph is generate, based on the various information sources, to represent the system's security state.
Upon an event, attacker and attack related metric, (such as: attack probability, attacker skills, and attack impact) are calculated based on the attack graph. Then, a \textit{countermeasure index} is computed for each countermeasure, which reflects its benefit in light of the expected losses, and the countermeasure with the maximal index value is selected. To measure the countermeasure effectiveness, the attack probability metric is recalculated, which requires to modify the attack graph accordingly.

Table~\ref{tab:pre-work} summarizes the similarities and differences of the above mentioned methods and our approach.
We examine the works based on their definition of countermeasures (generic, e.g., use firewall of some brand, or specific actions, e.g., update a specific rule in a specific firewall instance), countermeasure-vulnerability matching method, and countermeasure selection considerations (minimizing the risk in the system, minimizing deployment cost, operator preferences, risk introduced by the countermeasure, and in which position should the countermeasure be placed).
Each of these works addressed one or more major considerations, however non of them provided an holistic solution to provide a detailed countermeasure plan that meets the organization's requirements.
Moreover, most of the works manually matched countermeasure to vulnerabilities, or didn't provide any details regarding their method.

\input{Tables/related_work.tex}

We aim to provide a method for constructing a countermeasure plan that: (1) is specific as possible (i.e., specifies where to deploy/perform each countermeasure/mitigation action), (2) meets the organization's budget, (3) corresponds as much as possible to the operator's preferences, and (4) minimizes as much as possible the risk in the system.
The risk introduced by countermeasures is not considered within the scope of this work.
In addition, unlike previous works, we distinguish between mitigation actions and countermeasures and consider them both.
This enables an efficient countermeasure-vulnerability matching as will be described in the following sections.
\section{\label{sec:risk-ass}Risk Assessment}
Before executing the search to find a cost-effective countermeasure plan, a risk assessment process should be conducted in order to estimate the current state of the system and understand what are the options to enhance it.
We chose to perform an attack graph-based risk assessment approach; more specifically we chose to use MulVAL~\cite{ou2005mulval} with our extended network modeling\footnote{Reference removed not to break the anonymity.}.

The following subsections describe how relevant countermeasures are identified based on the generated attack graph, and and alternative representation of the attack graph, which also incorporate the relevant countermeasures, that allows more efficient calculation of the system's risk under the deployment of a specific countermeasure plan.

\subsection{\label{subsec:cm-id}Identifying Relevant Countermeasures}
Countermeasures identification is a two steps process that is based on matching mitigation actions to the attack graph nodes.
The mitigation action matching process is also based on Prolog reasoning, similar to the attack graph generation~\cite{ou2005mulval}.
Note however, that the Prolog program used for this task is slightly different than the one used to construct the attack graph.

The Prolog program for mitigation action matching consists of the input used to generate the attack graph (i.e., facts about the system) and a set of rules that represent the various mitigation actions.
Each mitigation action (as defined in Section~\ref{sec:mitigation-action}) is converted into a rule in the following format:
\begin{equation}
    Postcondition :- Precondition_1, ... , Precondition_n
\end{equation}

where $Postcondition$ corresponds to the predicate that the mitigation action eliminates, with an additional argument to indicate the mitigation action ID:
\begin{equation}
    \label{eq:ma-postcond}
    p(t_1, ..., t_n) \Rightarrow p(MAID, t_1, ..., t_n)
\end{equation}

The preconditions on the other hand, remain the same as in the mitigation action description.
For example, consider the following predicate, which represents that a communication (using protocol \textit{Prot} on port \textit{Port}) between two subnets (\textit{SrcSubnet} and \textit{DstSubnet}) is enabled:

\begin{equation}
    aclNW(SrcSubnet, DstSubnet, Prot, Port)
\end{equation}

A possible mitigation action is updating a firewall rule and disable this communication.
The only precondition for applying this mitigation action is the existence of a firewall between those two subnets (represented by an \textit{isFirewall} predicate); thus, the rule representing this mitigation action is as follows (assuming this mitigation action's ID is 1):

\begin{equation}
    \label{eq:nb-fw-ma}
    \begin{split}
        aclNW&(1,SrcSubnet,DstSubnet,Prot,Port) :- \\
        & isFirewall(FW,SrcSubnet,DstSubnet).
    \end{split}
\end{equation}

Given an attack graph node, a query is sent to the Prolog program based on the node's description (according to Equation \ref{eq:ma-postcond}). The results of the query will contain all of the mitigation action IDs that can be applied to eliminate this node.

The next step is to understand where to perform the mitigation action in the network.
The network position is extracted based on the \textit{position} field of each mitigation action (see Section~\ref{sec:mitigation-action}) that instructs how to find the relevant arguments from the Prolog trace.
For example, the position of the mitigation action represented by Equation \ref{eq:nb-fw-ma} is the value of the \textit{FW} variable in the \textit{isFirewall} predicate.

Finally, after obtaining the relevant mitigation actions IDs, all of the corresponding countermeasures are retrieved from the countermeasures repository and construct the initial node of the search.
The network position of a countermeasure is similar to the position of its corresponding mitigation action.

\subsection{\label{subsec:risk-eq}Risk Calculation}
The risk in the system is computed using \textit{risk equations} that are derived from the attack graph during the pre-processing phase to the search.
The risk is measured by the ease of taking each attack path.
Risk equation is a mathematical representation that incorporates the risk introduced by the attacker's actions towards his/her goal and the possible countermeasures that can thwart these action.

\input{AttackGraph/mulval_example2.tex}

For example, consider the attack graph in Figure~\ref{fig:mulval-example-ag}, which illustrates a scenario of a remote attacker that exploits the lack of access control between the Internet and a vulnerable database server in order to crash it.
Two vulnerabilities present in the database server: CVE-2017-8714 with risk score of 0.37 and CVE-2019-2510 with risk score of 0.65.
We consider four types of mitigation actions: (1) update host-based firewall; (2) install network-based firewall; (3) patch a program; and (4) install Antivirus software.
Table~\ref{tab:example-cm} specifies the position and notation of these countermeasures.

\begin{table}[t]
        \centering
        \caption{Examples of countermeasures.}
        \scriptsize
        \begin{tabular}{|m{0.12\textwidth}|m{0.09\textwidth}|m{0.07\textwidth}|c|c|}
            \hline
             Countermeasure & Mitigation action & Position & Notation & Cost(\$)\\
             \hline
             Host-based firewall & update rule & $dbServer$ & $C_1$ & 20 \\
             \hline
             Network-based firewall & install new component & $internet$-$dbServer$ & $C_2$ & 500 \\
             \hline
             \multirow{2}{=}{Patch} & \multirow{2}{=}{Patch a program} & \multirow{2}{=}{$dbServer$} & $C_3$ & \multirow{2}{*}{10} \\
             \cline{4-4}
             & & & $C_5$ & \\
             \hline
             Antivirus & Install Antivirus software & $dbServer$ & $C_4$ & 50 \\
             \hline
        \end{tabular}
        \label{tab:example-cm}
    \end{table}

Algorithm \ref{alg:build-risk-eq} describes the process of building the risk equations for a given attack graph (denoted by $AG$), that builds the equations for each node in the attack graph. It maintains two sets: $processed$ that keeps all of the nodes that were already processed (i.e, their equation was constructed), and $unprocessed$ that keeps all of the remaining nodes. In each iteration a processable node (i.e., a node that all of its parents are processed) is chosen and its equation is constructed, until all nodes are processed.

\begin{algorithm}
	\caption{Build Risk Equations.}
	\scriptsize
	\label{alg:build-risk-eq}
	\begin{algorithmic}[1]
        \State $processed \gets \{Risk(n) | n \in AG_{LEAF}\}$
        \State $unprocessed \gets AG \setminus AG_{LEAF}$
        \While{$!unprocessed.isEmpty()$}
            \While{$!unprocessed.hasProcessableNode()$}
                \State $n \gets unprocessed.pop()$
                \State $n.updateMA()$
                \If{$\forall k \in n_{in}, k \in processed$}
                    \State $processed \gets processed \cup \{Risk(n)\}$
                \Else
                    \State $unprocessed.push(n)$
                \EndIf
            \EndWhile
            \State $removeCycles(AG)$
        \EndWhile
	\end{algorithmic}
\end{algorithm}

Note that if the attack graph contains cycles, the iteration will never finish.
Cycles are caused by OR nodes that are derived by some interaction rule and also lead to a pre-condition for the same rule.
To break these cycles, the algorithm identifies unprocessed OR nodes with more than one parent that at least one of them is processed, and removes the edges between the unprocessed AND parents to the unprocessed OR node.
\begin{equation}
\scriptsize
    Risk(LEAF) = \left( \prod_{m \in LEAF_{CM}} m \right) \cdot P(LEAF)
    \label{eq:leaf-prob}
\end{equation}

\begin{equation}
\scriptsize
    Risk(AND) = \prod_{n \in AND_{in}} Risk(n)
    \label{eq:and-prob}
\end{equation}
\begin{equation}
\scriptsize
    \begin{split}
    Risk&(OR) =  \left( \prod_{m \in OR_{CM}} m \right) \cdot \left( \sum_{i=1}^{R} Risk(OR_{in}[i]) - \right. \\
    & \left. \sum_{i_1<i_2} Risk(OR_{in}[i_1]) \cdot  Risk(OR_{in}[i_2]) + \cdots + \right. \\
    & \left. (-1)^{R} \cdot \sum_{i_1<\cdots<i_{R-1}} Risk(OR_{in}[i_1])\cdot ... \cdot Risk(OR_{in}[i_{R-1}]) +  \right. \\
    & \left. (-1)^{R+1}\cdot \prod_{i=1}^{R} Risk(OR_{in}[i]) \right) \\
    & \\
    & where, ~ R = |OR_{in}|
    \end{split}
    \label{eq:or-prob}
\end{equation}

\begin{equation}
\scriptsize
    m =
    \begin{cases}
        0, & \text{if countermeasure m is implemented} \\
        1, & \text{if countermeasure m is \textbf{not} implemented}
    \end{cases}
    \label{eq:m-value}
\end{equation}

The implementation of the $Risk$ function is given in Equations \ref{eq:leaf-prob}, \ref{eq:and-prob}, \ref{eq:or-prob}, and \ref{eq:m-value}.
If the given attack graph node represents a vulnerability, then its risk score is calculated according to the vulnerability's CVSS score.
Otherwise, the node's risk score is 1 (we assume than any other fact can be materialized in any situation).

The risk score of a vulnerability node represents its probability to be exploited, and is calculated according to the following CVSS metrics, which provides information about the pre-conditions of vulnerability exploitation that is not represented in the attack graph:

\begin{equation}
\scriptsize
    Risk(n) =
    \begin{cases}
        AC \cdot UI,& \text{if CVSS v.3} \\
        AC \cdot Au, & \text{if CVSS v.2}
    \end{cases}
\end{equation}

CVSS provides both qualitative and quantitative values for the metrics it defines, these values are fixed and are given in the CVSS specification.
The values of the above mentioned exploitability metrics are in the range [0,1], thus $Risk(n)\in [0,1]$.
This enables us to consider this score as a probability in future calculations.

Equation \ref{eq:risk-eq-example} presents the calculation of the risk equation for the goal node (node 1) in the attack graph from Figure \ref{fig:mulval-example-ag}.

\begin{equation}
    \scriptsize
        \label{eq:risk-eq-example}
        \begin{split}
            R&isk(n_1) = Risk(n_{26}) + Risk(n_2)\\
                & = (C_4 \cdot Risk(n_{13})) + (Risk(n_8) \cdot Risk(n_3) \cdot Risk(n_9) \cdot Risk(n_{11}) \cdot Risk(n_{10})) \\
                & = (C_4 \cdot Risk(n_{14})) + (Risk(n_4) \cdot (0.65 \cdot C_3) \cdot C_1) \\
                & = (C_4 \cdot (Risk(n_{15}) \cdot Risk(n_{16}) \cdot Risk(n_{12}) \cdot Risk(n_8))) + (0.65 \cdot C_3 \cdot C_1 \cdot \\
                & \qquad \cdot (Risk(n_6) \cdot Risk(n_5) \cdot Risk(n_7))) \\
                & = (C_4 \cdot ((0.37 \cdot C_5) \cdot Risk(n_{17}))) + (0.65 \cdot C_3 \cdot C_1 \cdot (C_2)) \\
                & = (C_4 \cdot (0.13 \cdot C_5 \cdot (Risk(n_{24}) \cdot Risk(n_{20}) \cdot Risk(n_{25}) \cdot Risk(n_{19}) \cdot Risk(n_{18})))) + \\
                & \qquad +(0.65 \cdot C_3 \cdot C_1 \cdot C_2) \\
                & = (C_4 \cdot (0.37 \cdot C_5 \cdot (Risk(n_{21}) \cdot C_1))) + (0.65 \cdot C_3 \cdot C_1 \cdot C_2) \\
                & = (C_4 \cdot (0.37 \cdot C_5 \cdot (C_1 \cdot (Risk(n_{22}) \cdot Risk(n_{23}) \cdot Risk(n_7))))) + (0.65 \cdot C_3 \cdot C_1 \cdot C_2) \\
                & = (C_4 \cdot (0.37 \cdot C_5 \cdot (C_1 \cdot (C_2)))) + (0.65 \cdot C_3 \cdot C_1 \cdot C_2) \\
                & = (0.37 \cdot C_4 \cdot C_5 \cdot C_1 \cdot C_2) + (0.65 \cdot C_3 \cdot C_1 \cdot C_2)
        \end{split}
    \end{equation}

redpajama_set_name: RedPajamaArXiv


text:
БРДМ-2ДИ «Хазар» () — один из вариантов модернизации советской БРДМ-2, разработанный в 2005 году на ГП «Николаевский ремонтно-механический завод».

История
Разработка бронемашины была начата с учётом опыта, полученного в 2003-2005 гг. украинским военным контингентом в Ираке (где в это же время польским военным контингентом использовались модернизированные BRDM-2M96i - с дополнительными люками и дизельными двигателями Iveco Aifo 8040).

27-30 сентября 2005 года демонстрационный образец БРДМ-2ДИ был представлен на выставке "Оружие и безопасность-2005" в Киеве.

В 2006 году были проведены испытания БРДМ-2ДИ с боевым отделением БУГ.

В 2007 году БРДМ-2ДИ вышла на этап государственных испытаний.

10 июля 2008 года вариант модернизации БРДМ-2 до уровня "Хазар" был запатентован.

К началу 2011 года машина прошла испытания.

24 августа 2014 года одна БРДМ-2ДИ участвовала в военном параде в Киеве.

Производство БРДМ-2ДИ было начато 29 декабря 2014 года на Николаевском бронетанковом заводе.

Описание
При изготовлении БРДМ-2ДИ используется уже готовый бронекорпус советского БРДМ-2 из складских запасов, который проходит ремонт, переоборудование и перекраску.

При переоборудовании БРДМ-2 в БРДМ-2ДИ демонтируют две пары пневматических колёс (предназначенных для преодоления траншей и окопов) и четыре гидравлических подъёмника, обеспечивающие их выдвижение. Объём топливных баков оставлен прежним.

На БРДМ-2ДИ установлен дизельный двигатель FPT IVECO Tector с предпусковым подогревателем, который позволил уменьшить расход топлива до 19 литров на 100 км и соответствует экологическим стандартам Евро-3. Как сообщил инженер-технолог Николаевского бронетанкового завода Александр Каплун, замена двигателя привела к необходимости замены моторной перегородки и переделке некоторых других корпусных деталей.

В бортах машины сделаны два дополнительных люка для высадки десанта.

Кроме того, на БРДМ-2ДИ установлено новое оборудование связи - цифровая радиостанция (Р-173 или Р-030У). При необходимости, на бронемашину могут быть установлены прибор ночного видения, тепловизор, система видеонаблюдения и спутниковый навигатор СН-3210 "Базальт-K".

Варианты и модификации
 стандартное исполнение - в качестве вооружения сохранены один 14,5-мм пулемёт КПВТ и один 7,62-мм пулемёт ПКТ
 модернизированный вариант «для разведчиков и спецназовцев» - вооружение составляют 7,62-мм пулемёт и 30-мм автоматический станковый гранатомёт, установленные на крыше, а также 7,62-мм пулемёт в передней установке у командира; также на бронемашину установлен комплект решётчатых противокумулятивных экранов. Сообщается, что этот вариант модернизации был разработан летом 2014 года Конструкторско-технологическим центром министерства обороны Украины в Киеве с учётом опыта, полученного при проведении спецоперации на востоке Украины. По состоянию на начало июля 2014 года, было начато изготовление одного прототипа

Дальнейшим развитием БРДМ-2ДИ стала разработанная в 2016 - 2017 гг. бронемашина БРДМ-НИК (получившая комплект навесной защиты и усиленную подвеску).

На вооружении
 :
 Государственная пограничная служба Украины — 29 октября 2014 для ГПСУ были заказаны две БРДМ-2ДИ «Хазар» с информационно-телекоммуникационными комплексами «СКІТА-04».
 Вооружённые силы Украины — в январе 2015 года было объявлено, что ещё несколько БРДМ-2ДИ заказаны министерством обороны Украины

Примечания

БРДМ-2
Бронетехника Украины

redpajama_set_name: RedPajamaWikipedia


It is already possible to track a person's movements with their phone. Governments can track spending habits from credit card statements and companies already tailor marketing to the way in which we use the internet. In order to follow a person around a city with cameras, a lot more are going to need to be installed but one has to question whether that will even be necessary.
TE Connectivity is one of the largest producers of security equipment. The share has experienced two two-year ranges in the course of its decade long advance. It hit a medium-term peak in January and has been pulling back all year. This is the largest pullback in a decade which is a major trend inconsistency. A short-term oversold condition is evident but a sustained move back above the trend mean will be required to question medium-term supply dominance.