Variability meets security : qantitative security modeling and analysis of highly customizable attack scenarios

Beek, Maurice H. ter;Legay, Axel;Lafuente, Alberto Lluch;Vandin, Andrea
(2020) VaMoS ’20: 14th International Working Conference on Variability Modelling of Software-Intensive Systems — Location: Magdeburg Germany

Files

vamos2020.pdf
  • Open Access
  • Adobe PDF
  • 1.55 MB
Download

Details

Authors
  • Beek, Maurice H. ter
    Author
  • Legay, AxelUCLouvain
    Author
  • Lafuente, Alberto Lluch
    Author
  • Vandin, Andrea
    Author
Abstract
We present a framework for quantitative security modeling and analysis of highly customizable attack scenarios, which resulted as a spin-off from our research in software product line engineering. The graphical security models are based on attributed attack-defense diagrams to capture the structure and properties of vulnerabilities, defenses and countermeasures - with notable similarities to feature diagrams - and on probabilistic models of attack behavior, capable of capturing resource constraints and attack effectiveness. In this paper, we provide an overview of the framework that is described in full technical detail in twin papers, which present the formal syntax and semantics of the domain-specific language and showcase the associated tool with advanced IDE support for performing analyses based on statistical model checking. The properties of interest range from average cost and success probability of attacks to the effectiveness of defenses and countermeasures. Here we illustrate the capabilities of the DSL and the tool by applying them to an example scenario from the security domain. This shows how techniques from variability modeling can be applied to security. We conclude with a vision and roadmap for future research.
Affiliations

Citations

  • APA
  • Chicago
  • FWB

Beek, M. H. t., Legay, A., Lafuente, A. L., & Vandin, A. (2020). Variability meets security : qantitative security modeling and analysis of highly customizable attack scenarios. Proceedings of the 14th International Working Conference on Variability Modelling of Software-Intensive Systems. Published. VaMoS ’20: 14th International Working Conference on Variability Modelling of Software-Intensive Systems, Magdeburg Germany. https://doi.org/10.1145/3377024.3377041