Graph Coarsening for Path Finding in Cybersecurity Graphs

Conference · Tue Jan 01 00:00:00 EST 2013

DOI:https://doi.org/10.1145/2459976.2459984· OSTI ID:1148631

Hogan, Emilie A.; Johnson, John R.; Halappanavar, Mahantesh

n the pass-the-hash attack, hackers repeatedly steal password hashes and move through a computer network with the goal of reaching a computer with high level administrative privileges. In this paper we apply graph coarsening in network graphs for the purpose of detecting hackers using this attack or assessing the risk level of the network's current state. We repeatedly take graph minors, which preserve the existence of paths in the graph, and take powers of the adjacency matrix to count the paths. This allows us to detect the existence of paths as well as find paths that have high risk of being used by adversaries.

• Research Organization: Pacific Northwest National Lab. (PNNL), Richland, WA (United States)
• Sponsoring Organization: USDOE
• DOE Contract Number: AC05-76RL01830
• OSTI ID: 1148631
• Report Number(s): PNNL-SA-90064
• Resource Relation: Conference: Proceedings of the Eighth Annual Cyber Security and Information Intelligence Research Workshop (CSIIRW 2013), January 8-10, 2013, Oak Ridge, Tennessee, Paper No. 7
• Country of Publication: United States
• Language: English