Reference : Modelling Attack-defense Trees Using Timed Automata
Scientific congresses, symposiums and conference proceedings : Paper published in a book
Engineering, computing & technology : Computer science
Security, Reliability and Trust
http://hdl.handle.net/10993/29225
Modelling Attack-defense Trees Using Timed Automata
English
Gadyatskaya, Olga mailto [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) >]
Hansen, R. R. [> >]
Larsen, K. G. [> >]
Legay, A. [> >]
Olesen, M. C. [> >]
Poulsen, D. B. [> >]
2016
Proc. of FORMATS
Springer
LNCS 9884
Yes
No
International
14th International Conference on Formal Modeling and Analysis of Timed Systems (FORMATS)
from 24-08-2016 to 26-08-2016
Quebec City
Canada
[en] attack trees ; timed automata ; security modelling
[en] Performing a thorough security risk assessment of an organisation has always been challenging, but with the increased reliance on outsourced and off-site third-party services, i.e., ``cloud services'', combined with internal (legacy) IT-infrastructure and -services, it has become a very difficult and time-consuming task. One of the traditional tools available to ease the burden of performing a security risk assessment and structure security analyses in general is attack trees, a tree-based formalism inspired by fault trees, a well-known formalism used in safety engineering.

In this paper we study an extension of traditional attack trees, called attack-defense trees, in which not only the attacker's actions are modelled, but also the defensive actions taken by the attacked party. In this work we use the attack-defense tree as a goal an attacker wants to achieve, and separate the behaviour of the attacker and defender from the attack-defense-tree. We give a fully stochastic timed semantics for the behaviour of the attacker by introducing attacker profiles that choose actions probabilistically and execute these according to a probability density. Lastly, the stochastic semantics provides success probabilitites for individual actions. Furthermore, we show how to introduce costs of attacker actions. Finally, we show how to automatically encode it all with a network of timed automata, an encoding that enables us to apply state-of-the-art model checking tools and techniques to perform fully automated quantitative and qualitative analyses of the modelled system.
Interdisciplinary Centre for Security, Reliability and Trust - SnT
European Commission - EC
Researchers ; Professionals ; Students ; General public
http://hdl.handle.net/10993/29225
10.1007/978-3-319-44878-7_3
The original publication is available at http://link.springer.com/chapter/10.1007%2F978-3-319-44878-7_3
FP7 ; 318003 - TRESPASS - Technology-supported Risk Estimation by Predictive Assessment of Socio-technical Security

File(s) associated to this reference

Fulltext file(s):

FileCommentaryVersionSizeAccess
Limited access
chp%3A10.1007%2F978-3-319-44878-7_3.pdfPublisher postprint890.99 kBRequest a copy

Bookmark and Share SFX Query

All documents in ORBilu are protected by a user license.