Towards Efficient and Accurate Network Exposure Surface Analysis for Enterprise Networks

Abstract

Network exposure surface analysis aims to identify network assets that are exposed to the Internet and is critical for enterprise security. However, existing tools face two key challenges: combinatorial explosion in traditional packet testing, and high false positive rates in firewall-based static analysis. To address these issues, this paper proposes a network model-based approach to accurately characterize the forwarding behaviors of devices in enterprise networks, and performs network-level static analysis on the established graph model. Specifically, we construct a device-level forwarding graph using detailed element models for switches and firewalls, capturing the semantics of the forwarding information base, virtual routing and forwarding, virtual systems, and security zones. We further introduce a parallelized multi-threaded breadth-first search (MTBFS) algorithm to efficiently identify reachable assets from Internet-facing ingress interfaces. Experimental results demonstrate a 20× speedup over traditional methods in a large-scale enterprise network consisting of 7970 switches and 16 Internet-facing interfaces.