CHeSS: A Configuration Health Scoring System and Its Application to Network Devices

The behavior of nearly all cyber systems including network devices is dependent on a set of configuration parameters. Improper setting of the configuration parameters could result in sub-optimal performance, security vulnerabilities, functional issues, reduced availability, etc. Existing work on device vulnerability and configuration management techniques are geared towards after-fact discovery, as they relate to post-analysis metrics and methods. Currently, there are no effective metrics to express the quality of a configuration of a device. In this paper we propose such a health index targeting multiple metrics including performance, security and availability and specialize them for network devices such as routers and switches. We extend our approach to use a knowledge repository to better refine the health index, which improves with an increase in available data.