Cost-benefit trade-off analysis using BBN for aspect-oriented risk-driven development

Proceedings of the IEEE International Conference on Engineering of Complex Computer Systems, ICECCS

Volumn , Issue , 2005, Pages 195-204

  Houmb, Siv Hilde ^a   Georg, Geri ^b   France, Robert ^b   Bieman, James ^b   Jürjens, Jan ^c  

^a NORWEGIAN UNIVERSITY OF SCIENCE AND TECHNOLOGY   (Norway)

^b Department of Computer Science   (United States)

^c TECHNICAL UNIVERSITY OF MUNICH   (Germany)

Author keywords

Aspect Oriented Modeling (AOM); Bayesian Belief Networks (BBN); Risk Driven Development (RDD); Trade off analysis

Indexed keywords

COST EFFECTIVENESS; RISK MANAGEMENT; SECURITY SYSTEMS;

ASPECT-ORIENTED MODELING (AOM); BAYESIAN BELIEF NETWORKS (BBN); RISK-DRIVEN DEVELOPMENT (RDD); SYSTEM FUNCTIONALITY; TRADE-OFF ANALYSIS;

COMPUTER NETWORKS;

EID: 27144534308     PISSN: 27708527     EISSN: 27708535     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (28)

1. EP-27046-ACTIVE, Final Prototype and User Manual, D4.2.2, Ver. 2.0, 2001-02-22., 2001.
2. R. M. Cooke. Experts in Uncertainty: Opinion and Subjective Probability in Science. Oxford University Press, 1991.
3. P.-J. Courtois, N. E. Fenton, B. Littlewood, M. Neil, L. Strigini, and D. R. Wright. Bayesian belief network model for the safety assessment of nuclear computer-based systems. Second year report part 2, Esprit Long Term Research Project 20072-DeVa, 1998.
4. K. Delic, M. Mazzanti, and L. Stringini. Formilizing engineering judgment on software dependability via belied netowrks. In DCCA-6, Sixth IFIP International Working Conference on Dependable Computing for Critical Applications, "Can We Rely on Computers?", Garmisch-Partenkirchen, Germany, 1997.
5. N. Fenton, B. Littlewood, M. Neil, L. Strigini, A. Sutcliffe, and D. Wright. Assessing dependability of safety critical systems using diverse evidence. IEEE Proceedings Software Engineering, 145(1), 1998.
6. N. Fenton and M. Neil. A critique of software defect prediction models. IEEE Transaction of Software Engineering, 25(5):675-689, 1999.
7. G. Georg, R. France, and I. Ray. An aspect-based approach to modeling security concerns. In Workshop on Critical Systems Development with UML (CSDUML'02). Dresden, Germany, October 2002.
8. B. A. Gran. The use of Bayesian Belief Networks for combining disparate sources of information in the safety assessment of software based systems. Doxtoral of engineering thesis 2002:35, Department of Mathematical Science, Norwegian University if Science and Technology, 2002. 2002:35.
9. S. H. Houmb, G. Georg, R. France, and D. Matheson. Using aspects to manage security risks in risk-driven development. In 3rd International Workshop on Critical Systems Development with UML, number TUM-I0415, pages 71-84. TUM, 2004.
10. S. H. Houmb, O. A. Johnsen, and T. Stalhane. Combining Disparate Information Sources when Quantifying Security Risks. In Proceeding of SCI 2004, RMCI 2004, Orlando, July 2004, 2004.
11. HUGIN. BBN Tool made by Hugin Expert A/S. Alborg, Denmark, 2004. http://www.hugin.dk.
12. ISO 15408:1999. Common Criteria for Information Technology Security Evaluation, Version 2.1, CCIMB-99-031 edition, August 1999. Part 1: Introduction and general model.
13. F. Jensen. An introduction to Bayesian Network. UCL Press, University College London, 1996.
14. E. Jonsson and T. Olovsson. A quantitative model of the security intrusion process based on attacker behavior. IEEE Trans. Software Eng., 4(25):235, April 1997.
15. J. Jürjens. Secure Systems Development with UML. Springer-Verlag, Berlin Heidelberg New York, 2004.
16. J. Jürjens and P. Shabalin. Tools for Critical Systems Development with UML. In N. Jardin Nunes, B. Selic, A. Silva, and A. Toval, editors, UML Modeling Languages and Applications. UML 2004 Satellite Activities, Lisbon, Portugal, October 11-15, 2004, Revised Selected Papers, volume 3297 of LNCS. Springer, 2004.
17. S. L. Lauritzen and D. J. Spiegelhalter. Local computations with probabilities on graphical structures and their application to expert systems (with discussion). Journal of the Royal Statistical Society, Series B 50(2): 157-224, 1988.
18. B. Littlewood, S. Brocklehurst, N. Fenton, P. Mellor, S. Page, D. Wright, J. Dobson, McDermid J., and D. Gollmann. Towards operational measures of computer security. Journal of Computer Security, 2:211-229, 1993.
19. B. Madan, K. Vaidyanathan, and K. Trivedi. Modeling and quantification of security attributes of software systems. In Proceedings of the International Conference on Dependable Systems and Networks (DSN'02), 2000.
20. K. Øien and P. R. Hokstad. Handbook for performing expert judgment. Technical report, SINTEF, 1998.
21. R. Ortalo and Y. Deswarte. Experiments with quantitative evaluation tools for monitoring operational security. IEEE Trans. Software Eng., 5(25):633-650, Sept/Oct 1999.
22. J. Pearl. Probabilistic Reasoning in Intelligent Systems: Network for Plausible Inference. Morgan Kaufmann, 1988.
23. RTCA/DO-178B. Software Considerations in Airborne Systems and Equipment Certification (Guideline). RCTA/DO, 1999.
24. SERENE: Safety and Risk Evaluation using Bayesian Nets. ESPIRIT Framework IV nr. 22187, 1999. http://www.hugin.dk/serene/.
25. Standards Australia, Strathfield. AS/NZS 4360:2004: Australian/New Zealand Standard for Risk Management, 2004.
26. K. Stølen, F. den Braber, T. Dimitrakos, R. Fredriksen, B. A. Gran, S. H. Houmb, Y. C. Stamatiou, and J. Ø. Aagedal. Model-based risk assessment in a component-based software engineering process: The CORAS approach to identify security risks. In F. Barbier, editor, Business Component-Based Software Engineering, pages 189-207. Kluwer, 2002. ISBN: 1-4020-7207-4.
27. D. Wang, B. B. Madan, and K. S. Trivedi. Security analysis of sitar intrusion tolerance system. In ACM SSRS'03. ACM Press, 2003.
28. T. Wu. The srp authentication and key exchange system, 2000. RFC 2945, Network Working Group.