Large-Scale Intranet Security Assessment Based on Bayesian Attack Graphs Using System Audit Logs

Large-scale dynamic intranet environments are characterized by constantly changing configurations, evolving user behaviors, and diverse assets that increase vulnerability pathways. These factors undermine the effectiveness of Bayesian attack graphs and reveal the limitations of traditional security methods that rely on static assumptions. To address these challenges, this paper proposes a novel Bayesian attack graph method designed for large-scale, active intranet security assessments. It captures real-time intranet changes by extracting system audit logs and generates attack graphs with MulVAL, ultimately resulting in a time-spanning understanding of potential security risks. Furthermore, it identifies direct-risk paths by eliminating weak dependencies between actions and estimates the likelihood of action execution based on expectations, thereby substantially reducing the computational complexity of Bayesian security analysis. To validate the proposed method, this paper conducts dynamic threat modeling and quantitative security analysis on an enterprise intranet using logs from over 1,000 hosts. The results demonstrate that the proposed method not only provides internal network security risk values at any given time but also identifies specific and observable potential attack paths. Furthermore, this study provides a reference framework for prioritizing vulnerability remediation based on changes in internal network security conditions