Abstract

The security risk of a network against unknown zero day attacks has been considered as something unmeasurable since software flaws are less predictable than hardware faults and the process of finding such flaws and developing exploits seems to be chaotic. In this paper, we propose a novel security metric, k-zero day safety, based on the number of unknown zero day vulnerabilities. That is, the metric counts at least how many unknown vulnerabilities are required for compromising a network asset, regardless of what vulnerabilities those are. We formally define the metric based on a model of relevant network components. We then devise algorithms for computing the metric. Finally, we discuss how to apply the metric for hardening a network.