𝔖 Bobbio Scriptorium
✦   LIBER   ✦

[ACM Press the 6th International Workshop - Bolzano, Italy (2010.09.15-2010.09.15)] Proceedings of the 6th International Workshop on Security Measurements and Metrics - MetriSec '10 - Adversary-driven state-based system security evaluation

✍ Scribed by LeMay, Elizabeth; Unkenholz, Willard; Parks, Donald; Muehrcke, Carol; Keefe, Ken; Sanders, William H.


Book ID
127320450
Publisher
ACM Press
Year
2010
Weight
300 KB
Category
Article
ISBN
1450303404

No coin nor oath required. For personal study only.

✦ Synopsis


To provide insight on system security and aid decision-makers, we propose the ADversary VIew Security Evaluation (AD-VISE) method to quantitatively evaluate the strength of a system's security. Our approach is to create an executable state-based security model of a system. The security model is initialized with information characterizing the system and the adversaries attacking the system. The model then simulates the attack behavior of the adversaries to produce a quantitative assessment of system security strength. This paper describes the system and adversary characterization data that are collected as input for the executable model. This paper also describes the simulation algorithms for adversary attack behavior and the computation for the probability that an attack attempt is successful. A simple case study illustrates how to analyze system security using the ADVISE method. A tool is currently under development to facilitate automatic model generation and simulation. The ADVISE method aggregates security-relevant information about a system and its adversaries to produce a quantitative security analysis useful for holistic system security decisions.


📜 SIMILAR VOLUMES


[ACM Press the 6th International Worksho
✍ Lamancha, Beatriz Pérez; Mateo, Pedro Reales; de Guzmán, Ignacio Rodríguez; Usao 📂 Article 📅 2009 🏛 ACM Press ⚖ 233 KB

This paper describes an approach for model-based testing which is completely based on standards, what constitutes an essential factor for its implantation in industrial software tools. The inputs of the process are models described in UML 2.0, whereas the outputs consist of artefacts of the UML Test