[ACM Press the 6th International Workshop - Bolzano, Italy (2010.09.15-2010.09.15)] Proceedings of the 6th International Workshop on Security Measurements and Metrics - MetriSec '10 - Adversary-driven state-based system security evaluation
✍ Scribed by LeMay, Elizabeth; Unkenholz, Willard; Parks, Donald; Muehrcke, Carol; Keefe, Ken; Sanders, William H.
- Book ID
- 127320450
- Publisher
- ACM Press
- Year
- 2010
- Weight
- 300 KB
- Category
- Article
- ISBN
- 1450303404
No coin nor oath required. For personal study only.
✦ Synopsis
To provide insight on system security and aid decision-makers, we propose the ADversary VIew Security Evaluation (AD-VISE) method to quantitatively evaluate the strength of a system's security. Our approach is to create an executable state-based security model of a system. The security model is initialized with information characterizing the system and the adversaries attacking the system. The model then simulates the attack behavior of the adversaries to produce a quantitative assessment of system security strength. This paper describes the system and adversary characterization data that are collected as input for the executable model. This paper also describes the simulation algorithms for adversary attack behavior and the computation for the probability that an attack attempt is successful. A simple case study illustrates how to analyze system security using the ADVISE method. A tool is currently under development to facilitate automatic model generation and simulation. The ADVISE method aggregates security-relevant information about a system and its adversaries to produce a quantitative security analysis useful for holistic system security decisions.
📜 SIMILAR VOLUMES
This paper describes an approach for model-based testing which is completely based on standards, what constitutes an essential factor for its implantation in industrial software tools. The inputs of the process are models described in UML 2.0, whereas the outputs consist of artefacts of the UML Test