×

A polytope-based approach to measure the impact of events against critical infrastructures. (English) Zbl 1350.68023

Summary: This paper provides a method to calculate the impact of cyber attacks and security countermeasures in a multi-dimensional coordinate system. The method considers the simulation of services, attacks and countermeasures in at least one dimensional coordinate system, the projection of which originates geometrical instances (e.g., lines, squares, rectangles, hyper-cubes). Such instances are measured through geometrical operations (i.e., length, area, volume, hyper-volume), so that we determine the impact of complex attacks arriving on the system, as well as the impact of the implementation of single and/or multiple countermeasures selected to mitigate the effects of such detected attacks. As a result, we are able to measure the size of cyber events, which allows us to determine the mitigation level of the incidents, as well as, residual risks, and potential collateral damages. A case study of a critical infrastructure system is provided to show the applicability of the model.

MSC:

68M10 Network design and communication in computer systems
68P25 Data encryption (aspects in computer science)
68U05 Computer graphics; computational geometry (digital and algorithmic aspects)

Software:

NVD
PDF BibTeX XML Cite
Full Text: DOI

References:

[1] Roberts, B., The macroeconomic impacts of the 9/11 attack: evidence from real-time forecasting, (2009), Homeland Security, Office of Immigration Statistics, Working paper
[2] Coxeter, H. S.M., Regular complex polytopes, (1991), Cambridge University Press · Zbl 0732.51002
[3] Hanson, Andrew J., Geometry for N-dimensional graphics, (1994), Academic Press, Inc.
[4] Saad, Y.; Schultz, M. H., Topological properties of hyper-cubes, (1985), Research report YALEU/DCS/RR - 389
[5] Kendall, M. G., A course in the geometry of n dimensions, (1961), Hafner Publishing Company · Zbl 0103.12002
[6] Kalam, A. A.E.; Baida, R. E.; Balbiani, P.; Benferhat, S.; Cuppens, F.; Deswarte, Y.; Miege, A.; Saurel, C.; Trouessin, G., Organization based access control, (8th International Workshop on Policies for Distributed Systems and Networks, (2003))
[7] Li, N.; Tripunitara, M., Security analysis in role-based access control, ACM Trans. Inf. Syst. Secur., 9, 4, 391-420, (2006)
[8] Cuppens, F.; Cuppens-Boulahia, N., Modeling contextual security policies, Int. J. Inf. Secur., 7, 4, 285-305, (2008)
[9] Cuppens, F.; Cuppens-Boulahia, N.; Miege, A., Modelling contexts in the or-BAC model, (19th Annual Computer Security Applications Conference, (2003))
[10] Preda, S.; Cuppens, F.; Cuppens-Boulahia, N.; Garcia-Alfaro, J.; Toutain, L., Dynamic deployment of context-aware access control policies for constrained security devices, J. Syst. Softw., 84, 7, (2011)
[11] Gonzalez Granadillo, G.; Garcia-Alfaro, J.; Debar, H., Using a 3D geometrical model to improve accuracy in the evaluation and selection of countermeasures against complex cyber attacks, (Proceedings of the 11th EAI International Conference on Security and Privacy in Communication Networks, (2015)), 26-29
[12] Gonzalez Granadillo, G.; Jacob, G.; Debar, H., Attack volume model: geometrical approach and application, (Proceedings of the 10th International Conference on Risks and Security of Internet and Systems, (2015))
[13] Information Sciences Institute, University of Southern California, DOD standard Internet protocol, (1980)
[14] Touch, J., Updated specification of the ipv4 ID field, (2013)
[15] Deering, S.; Hinden, R., Internet protocol, version 6 (IPv6) specification, (1995)
[16] Cotton, M.; Vegoda, L.; Bonica, R.; Haberman, B., Special-purpose IP address registries, (2013)
[17] Cotton, M.; Eggert, L.; Touch, J.; Westerlund, M.; Cheshire, S., Internet assigned numbers authority (IANA) procedures for the management of the service name and transport protocol port number registry, (2011)
[18] Touch, J.; Kojo, M.; Lear, E.; Mankin, A.; Ono, K.; Stiemerling, M.; Eggert, L., Service name and transport protocol port number registry, (2013)
[19] Norman, T., Risk analysis and security countermeasure selection, (2010), CRC Press, Taylor & Francis Group
[20] Federation of American Scientists, Special operations forces intelligence and electronic warfare operations. appendix D: target analysis process, (1991), available at
[21] Manadhata, P., An attack surface metric, (2008), School of Computer Science Carnegie Mellon University, PhD thesis
[22] Manadhata, P.; Wing, J.; Flynn, M.; McQueen, M., Measuring the attack surfaces of two FTP daemons, (2nd ACM Workshop on Quality of Protection, (2006))
[23] Manadhata, P.; Wing, J., An attack surface metric, IEEE Trans. Softw. Eng., (2010)
[24] Howard, M., Mitigate security risks by minimizing the code you expose to untrusted users, (2004), MSDN Magazine
[25] Howard, M.; Wing, J., Measuring relative attack surfaces, (Computer Security in the 21st Century, (2005)), 109-137
[26] Burago, D.; Burago, Y.; Ivanov, S., A course in metric geometry, vol. 33, (2001), The American Mathematical Society · Zbl 0981.51016
[27] Blonder, B.; Lamanna, C.; Violle, C.; Enquist, B. J., The n-dimensional hyper-volume, J. Glob. Ecol. Biogeogr., (2014)
[28] Mathai, A. M., An introduction to geometrical probability. distributional aspects with applications, vol. 1, (1999), Gordon and Breach Science Publishers · Zbl 0968.60001
[29] Spiegel, Murray R., Mathematical handbook of formulas and tables, Schaum’s Outline series in Mathematics, (1968), McGraw-Hill Book Co.
[30] Department of Defense USA, Modeling and simulation (M&S) verification, validation, and accreditation (VV&A), (2009), DoD Instruction 5000.61
[31] Cook, D.; Skinner, J., How to perform credible verification, validation, and accreditation for modeling and simulation, J. Defense Softw. Eng., (2005)
[32] Ling, Y.; Mahadevan, S., Quantitative model validation techniques: new insights, J. Reliab. Eng. Syst. Saf., 111, 217-231, (2013)
[33] Mason, S.; Hill, R.; Mönch, L.; Rose, O.; Jefferson, T.; Fowler, J., How to build valid and credible simulation models, (Proceedings of the 2008 Winter Simulation Conference, (2008))
[34] National Institute of Standards and Technology (NIST), National vulnerability database CVE-1999-0510, consulted on January, 2016
[35] National Institute of Standards and Technology (NIST), National vulnerability database CVE-1999-0510, consulted on January, 2016
[36] National Institute of Standards and Technology (NIST), National vulnerability database CVE-1999-0510, consulted on January, 2016
[37] Kordy, B.; Piètre-Cambacedes, L.; Schweitzer, P., DAG-based attack and defense modeling: don’t miss the forest for the attack trees, Comput. Sci. Rev., (2014) · Zbl 1300.68026
[38] Kordy, B.; Pouly, M.; Schweitzer, P., A probabilistic framework for security scenarios with dependent actions, (11th International Conference on Integrated Formal Methods, iFM 2014, LNCS, vol. 8739, (2014)), 256-271
[39] Kordy, B.; Mauw, S.; Radomirovic, S.; Schweitzer, P., Attack-defense trees, J. Log. Comput., 24, 1, 55-87, (2014) · Zbl 1311.68062
[40] Gonzalez-Granadillo, G.; Garcia-Alfaro, J.; Alvarez, E.; El-Barbori, M.; Debar, H., Selecting optimal countermeasures for attacks against critical systems using the attack volume model and the RORI index, Comput. Electr. Eng. J., 47, 13-34, (2015)
This reference list is based on information provided by the publisher or from digital mathematics libraries. Its items are heuristically matched to zbMATH identifiers and may contain data conversion errors. It attempts to reflect the references listed in the original paper as accurately as possible without claiming the completeness or perfect precision of the matching.