Roberto Vigo ; Flemming Nielson ; Hanne Riis Nielson - Discovering, quantifying, and displaying attacks

lmcs:2178 - Logical Methods in Computer Science, April 27, 2017, Volume 12, Issue 4 -
Discovering, quantifying, and displaying attacks

Authors: Roberto Vigo ; Flemming Nielson ; Hanne Riis Nielson

    In the design of software and cyber-physical systems, security is often perceived as a qualitative need, but can only be attained quantitatively. Especially when distributed components are involved, it is hard to predict and confront all possible attacks. A main challenge in the development of complex systems is therefore to discover attacks, quantify them to comprehend their likelihood, and communicate them to non-experts for facilitating the decision process. To address this three-sided challenge we propose a protection analysis over the Quality Calculus that (i) computes all the sets of data required by an attacker to reach a given location in a system, (ii) determines the cheapest set of such attacks for a given notion of cost, and (iii) derives an attack tree that displays the attacks graphically. The protection analysis is first developed in a qualitative setting, and then extended to quantitative settings following an approach applicable to a great many contexts. The quantitative formulation is implemented as an optimisation problem encoded into Satisfiability Modulo Theories, allowing us to deal with complex cost structures. The usefulness of the framework is demonstrated on a national-scale authentication system, studied through a Java implementation of the framework.

    Volume: Volume 12, Issue 4
    Published on: April 27, 2017
    Accepted on: October 23, 2016
    Submitted on: November 25, 2014
    Keywords: Computer Science - Cryptography and Security,Computer Science - Logic in Computer Science,68Q60

    2 Documents citing this article


    Consultation statistics

    This page has been seen 612 times.
    This article's PDF has been downloaded 630 times.