Abstract
Cyber attacks are the core of any security assessment of ICT-based systems. One of the more promising research fields in this context is related to the representation of the attack patterns. Several are the models proposed to represent them; these models usually provide a generic representation of attacks. Conversely, the experience shows that attack profiles are strongly dependent upon several “boundary conditions”. This paper defends that from the security assessment perspective, it is necessary to integrate the knowledge contained in the attack patterns with “boundary” knowledge related to vulnerability of the target system and to the potential threats. In this paper, after a characterization of this “boundary knowledge”, we propose an n-dimensional view of the attack tree approach, integrating information on threats and vulnerabilities. Moreover, we show how to use this view to derive knowledge about the security exposure of a target system.
This is a preview of subscription content, log in via an institution to check access.
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Aslam, T., Krsul, I., Spafford, E.H.: Use of a taxonomy of security faults. In: Proceedings of the Nineteenth NIST-NCSC National Information Systems Security Conference, pp. 551–560 (1996)
Kumar, S.: Classification and Detection of Computer Intrusions. Ph.D thesis, Department of Computer Science, Purdue University, West Lafayette, Indiana (1995)
Howard, J.: An Analysis of Security Incidents on the Internet, 1989–1995. Ph.D thesis, Department of Engineering and Public Policy, Carnegie Mellon University, Pittsburgh, Pennsylvania (1997)
Jajodia, S., Noel, S., O’Berry, B.: Topological Analysis of Network Attack Vulnerability. In: Kumar, V., Srivastava, J., Lazarevic, A. (eds.) Managing Cyber Threats: Issues, Approaches and Challenges. Kluwer Academic Publisher, Dordrecht (2004)
Jones, A., Ashenden, D.: Risk Management for Computer Security: Protecting Your Network & Information Assets. Elsevier, Amsterdam (2005)
Code of Practice for Information Security Management. International Standard (ISO/IEC) 17799:2000
Alberts, C., Dorofee, A.: Managing Information Security Risks: The OCTAVE (SM) Approach. Addison Wesley Professional, Reading (2002)
Masera, M., Nai Fovino, I., Sgnaolin, R.: A Framework for the Security Assessment of Remote Control Applications of Critical Infrastructure. ESReDA 29th Seminar, Ispra (2005)
Masera, M., Nai Fovino, I.: Models for Security Assessment and Management. In: Proceeding of the International Workshop on Complex Network and Infrastructure Protection 2006, Rome, Italy (2006)
Alhazmi, O., Malaiya, Y., Ray, I.: Security Vulnerabilities in Software Systems: A Quantitative Perspective. In: Jajodia, S., Wijesekera, D. (eds.) Data and Applications Security 2005. LNCS, vol. 3654, pp. 281–294. Springer, Heidelberg (2005)
Bishop, M.: Computer Security Art and Science. Addison Wesley, Reading (2004)
Bugtraq vulnerability database, http://securityfocus.com
Steffan, J., Schumacher, M.: Collaborative attack modeling. In: Proceeding of the Symposium on Applied Computing, Madrid, Spain, pp. 253–259 (2002)
Tidwell, T., Larson, R., Fitch, K., Hale, J.: Modeling Internet Attacks. In: Proceeding of the 2001 IEEE Workshop on Information Assurance and Security. United States Military Academy, West Point (2001)
McDermott, J.: Attack Penetration Testing. In: Proceeding of the 2000 New Security Paradigm Workshop, ACM SigSAC, pp. 15–22. ACM Press, New York (2000)
Helmer, G., Wong, J., Slagell, M., Honavar, V., Miller, L., Lutz, R.: A Software Fault Tree Approach to Requirements Analysis of an Intrusion Detection System. In: Proceedings of the first Symposium on Requirements Engineering for Information Security (2001)
Schneier, B.: Modeling Security Threats, Dr. Dobb’s Journal (2001), https://www.schneier.com/paper-attacktrees-ddj-ft.html
Daley, K., Larson, R., Dawkins, J.: A Structural Framework for Modeling Multi-Stage Network Attacks. In: Proceedings of the International Conference on Parallel Processing Workshops. ICPP Workshops, pp. 5–10 (2002)
Masera, M., Nai Fovino, I.: Modelling Information Assets for Security Risk Assessment in Industrial settings. In: 15th EICAR Annual Conference (2006)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2006 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Fovino, I.N., Masera, M. (2006). Through the Description of Attacks: A Multidimensional View. In: Górski, J. (eds) Computer Safety, Reliability, and Security. SAFECOMP 2006. Lecture Notes in Computer Science, vol 4166. Springer, Berlin, Heidelberg. https://doi.org/10.1007/11875567_2
Download citation
DOI: https://doi.org/10.1007/11875567_2
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-45762-6
Online ISBN: 978-3-540-45763-3
eBook Packages: Computer ScienceComputer Science (R0)