Article

GSTF Journal on Computing (JoC)

, 5:1

First online:

Open Access This content is freely available online to anyone, anywhere at any time.

Analysis of Organizational Vulnerability using Social Network Analysis and Attack Graph

  • Supachai KanchanapokinAffiliated withKing Mongkut University of Technology
  • , Sirapat BoonkrongAffiliated withKing Mongkut University of Technology

Abstract

The purpose of this paper is to develop an approach to analyze organizational vulnerability caused by its employees. The proposed approach is adapted from general attack graph analysis approach and social network analysis approach. The attack graph, which is relationship graph in this proposed approach, is created from organization’s email logs and virus reports. The relationship graph is analyzed using shortest path analysis to discover all possible attack paths start from risky employees to target employee, and then grouped by path length for further actions based on security policy. The proposed approach was tested using datasets that are limited to only one month with assumption that weight on all edges are equal. This paper suggested further study to improve accuracy of the proposed approach using other mathematical methods such as shortest path analysis with weight or Markov Chains. The proposed approach could also be used by security audit in risk assessment process.

Keywords:

attack graph social network analysis shortest path graph theory IT policy security policy