Ter Beek M. H. Legay A., Lluch Lafuente A., Vandin A.
Graphical security models Attack-defense trees Quantitative security Statistical model checking Formal analysis tools Variability models
We present a framework for quantitative security modeling and analysis of highly customizable attack scenarios, which resulted as a spin-off from our research in software product line engineering. The graphical security models are based on attributed attack-defense diagrams to capture the structure and properties of vulnerabilities, defenses and countermeasures--with notable similarities to feature diagrams--and on probabilistic models of attack behavior, capable of capturing resource constraints and attack effectiveness. In this paper, we provide an overview of the framework that is described in full technical detail in twin papers, which present the formal syntax and semantics of the domain-specific language and showcase the associated tool with advanced IDE support for performing analyses based on statistical model checking. The properties of interest range from average cost and success probability of attacks to the effectiveness of defenses and countermeasures. Here we illustrate the capabilities of the DSL and the tool by applying them to an example scenario from the security domain. This shows how techniques from variability modeling can be applied to security. We conclude with a vision and roadmap for future research.
Source: VaMoS'20 - 14th International Working Conference on Variability Modelling of Software-Intensive Systems, pp. 11:1–11:9, Magdeburg, Germany, 5-7 February 2020
Publisher: ACM Press, New York, USA
@inproceedings{oai:it.cnr:prodotti:416789, title = {Variability meets security: quantitative security modeling and analysis of highly customizable attack scenarios}, author = {Ter Beek M. H. Legay A. and Lluch Lafuente A. and Vandin A.}, publisher = {ACM Press, New York, USA}, doi = {10.1145/3377024.3377041}, booktitle = {VaMoS'20 - 14th International Working Conference on Variability Modelling of Software-Intensive Systems, pp. 11:1–11:9, Magdeburg, Germany, 5-7 February 2020}, year = {2020} }
backend.orbit.dtu.dk
Archivio della ricerca della Scuola Superiore Sant'Anna
Online Research Database In Technology
dl.acm.org