Vigo, Roberto and Nielson, Flemming and Nielson, Hanne Riis - Discovering, quantifying, and displaying attacks

lmcs:2178 - Logical Methods in Computer Science, April 27, 2017, Volume 12, Issue 4
Discovering, quantifying, and displaying attacks

Authors: Vigo, Roberto and Nielson, Flemming and Nielson, Hanne Riis

In the design of software and cyber-physical systems, security is often perceived as a qualitative need, but can only be attained quantitatively. Especially when distributed components are involved, it is hard to predict and confront all possible attacks. A main challenge in the development of complex systems is therefore to discover attacks, quantify them to comprehend their likelihood, and communicate them to non-experts for facilitating the decision process. To address this three-sided challenge we propose a protection analysis over the Quality Calculus that (i) computes all the sets of data required by an attacker to reach a given location in a system, (ii) determines the cheapest set of such attacks for a given notion of cost, and (iii) derives an attack tree that displays the attacks graphically. The protection analysis is first developed in a qualitative setting, and then extended to quantitative settings following an approach applicable to a great many contexts. The quantitative formulation is implemented as an optimisation problem encoded into Satisfiability Modulo Theories, allowing us to deal with complex cost structures. The usefulness of the framework is demonstrated on a national-scale authentication system, studied through a Java implementation of the framework.


Source : oai:arXiv.org:1607.07720
DOI : 10.2168/LMCS-12(4:5)2016
Volume: Volume 12, Issue 4
Published on: April 27, 2017
Submitted on: November 25, 2014
Keywords: Computer Science - Cryptography and Security,Computer Science - Logic in Computer Science,68Q60


Share

Consultation statistics

This page has been seen 301 times.
This article's PDF has been downloaded 205 times.