Modelling attack-defense trees using timed automata

Olga Gadyatskaya, René Rydhof Hansen, K.G. Larsen, Axel Legay, Mads Chr. Olesen, Danny Bogsted Poulsen

    Research output: Chapter in Book/Report/Conference proceedingConference contributionAcademicpeer-review

    22 Citations (Scopus)
    1 Downloads (Pure)

    Abstract

    Performing a thorough security risk assessment of an organisation has always been challenging, but with the increased reliance on outsourced and off-site third-party services, i.e., “cloud services‿, combined with internal (legacy) IT-infrastructure and -services, it has become a very difficult and time-consuming task. One of the traditional tools available to ease the burden of performing a security risk assessment and structure security analyses in general is attack trees, a tree-based formalism inspired by fault trees, a well-known formalism used in safety engineering. In this paper we study an extension of traditional attack trees, called attack-defense trees, in which not only the attacker’s actions are modelled, but also the defensive actions taken by the attacked party. In this work we use the attack-defense tree as a goal an attacker wants to achieve, and separate the behaviour of the attacker and defender from the attack-defense-tree. We give a fully stochastic timed semantics for the behaviour of the attacker by introducing attacker profiles that choose actions probabilistically and execute these according to a probability density. Lastly, the stochastic semantics provides success probabilitites for individual actions. Furthermore, we show how to introduce costs of attacker actions. Finally, we show how to automatically encode it all with a network of timed automata, an encoding that enables us to apply state-of-the-art model checking tools and techniques to perform fully automated quantitative and qualitative analyses of the modelled system.
    Original languageUndefined
    Title of host publication14th International Conference on Formal Modeling and Analysis of Timed Systems, FORMATS 2016
    Place of PublicationSwitzerland
    PublisherSpringer
    Pages35-50
    Number of pages16
    ISBN (Print)9783319448770
    DOIs
    Publication statusPublished - 17 Aug 2016
    Event14th International Conference on Formal Modeling and Analysis of Timed Systems, FORMATS 2016 - Quebec, Canada
    Duration: 24 Aug 201626 Aug 2016
    Conference number: 14

    Publication series

    NameLecture notes in computer science
    PublisherSpringer International Publishing
    Volume9884
    ISSN (Print)0302-9743
    ISSN (Electronic)1611-3349

    Conference

    Conference14th International Conference on Formal Modeling and Analysis of Timed Systems, FORMATS 2016
    Abbreviated titleFORMATS
    CountryCanada
    CityQuebec
    Period24/08/1626/08/16

    Keywords

    • EWI-27275
    • IR-101600
    • METIS-318542
    • EC Grant Agreement nr.: FP7/318003

    Cite this