Optimizing network microsegmentation policy for cyber resilience. (January 2023)

• Record Type: Journal Article
• Authors: Noel, Steven; Swarup, Vipin; Johnsgard, Karin
• Other Names: Bagrodia Rajive guest-editor.
• Is Part Of: Journal of defense modeling and simulation. Volume 20:Number 1(2023)
• Page Start: 57
• Page End: 79
• Publication Date: 2023-01
• Subjects: Security policy optimization -- attack graphs -- genetic algorithms; Military art and science -- Computer simulation -- Periodicals; 355.0011305
• DOI: 10.1177/15485129211051386
• Languages: English
• ISSNs: 1548-5129

Abstract

This paper describes an approach for improving cyber resilience through the synthesis of optimal microsegmentation policy for a network. By leveraging microsegmentation security architecture, we can reason about fine-grained policy rules that enforce access for given combinations of source address, destination address, destination port, and protocol. Our approach determines microsegmentation policy rules that limit adversarial movement within a network according to assumed attack scenarios and mission availability needs. For this problem, we formulate a novel optimization objective function that balances cyberattack risks against accessibility to critical network resources. Given the application of a particular set of policy rules as a candidate optimal solution, this objective function estimates the adversary effort for carrying out a particular attack scenario, which it balances against the extent to which the solution restricts access to mission-critical services. We then apply artificial intelligence techniques (evolutionary programming) to learn microsegmentation policy rules that optimize this objective function.