Evaluating damage from cyber attacks: a model and analysis

Accurate recovery from a cyber attack depends on fast and perfect damage assessment. For damage assessment, traditional recovery methods require that the log of an affected database must be scanned starting from the attacking transaction until the end. This is a time-consuming task. Our objective in this research is to provide techniques that can be used to accelerate the damage appraisal process and produce a correct result. We have presented a damage assessment model and four data structures associated with the model. Each of these structures uses dependency relationships among transactions, which update the database. These relationships are later used to determine exactly which transactions and exactly which data items are affected by the attacker. A performance comparison analysis obtained using simulation is provided to demonstrate the benefit of our model.