Guiding threat analysis with threat source models

Proceedings of the 2007 IEEE Workshop on Information Assurance, IAW

Volumn , Issue , 2007, Pages 262-269

  Clark, K ^a   Lee, C ^a   Tyree, S ^a   Hale, J ^a  

^a NONE

Author keywords

Adversary profiling; Attack graphs; Threat analysis; Threat modeling

Indexed keywords

COMPUTATIONAL COMPLEXITY; GRAPH THEORY; RISK ANALYSIS; RISK MANAGEMENT; SAFETY ENGINEERING;

ATTACK GRAPHS; COGNITIVE COMPLEXITY; INFORMATION ASSURANCE (IA); SOURCE MODELING; THREAT ANALYSIS;

RISK ASSESSMENT;

EID: 48749106465     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/IAW.2007.381942     Document Type: Conference Paper

References (27)

1. "Know your enemy," tech. rep., Honeynet Project, 2000.
2. J. Lowry, R. Valdex, and B. Wood, "Adversary modeling to develop forensic observables," tech. rep., BBN.
3. M. Rogers, "Psychological crime scene analysis - cyber crime scenes." www.cyberforensics.purdue.edu, 2004.
4. T. Parker, E. Shaw, E. Stroz, M. Devost, and M. Sachs, Cyber Adversary Characterization. Syngress, 2004.
5. G. Stoneburner, A. Goguen, and A. Feringa, "Risk mangement guide for information technology systems." NIST Special Publication 800-30.
6. S. Evans, D. Heinbuch, E. Kyule, J. Piorkowski, and J. Wallner, "Risk-based systems security engineering: Stopping attacks with intention," Security and Privacy, vol. 2, no. 6, 2004.
7. D. Kewley and J. Lowry, "Observations on the effects of defense in depth on adversary behavior in cyber warfare," tech. rep., BBN.
8. B. Bell, E. Santos, and S. Brown, "Making adversary decision modeling tractable with intent inference and information fusion," in Proceedings of the 11th Conference on Computer Generated Forces and Behavioral Representation, pp. 532-542, May 2002.
9. R. Moore, J. Williams, and C. McCain, "Intelligence preparation of the information battlespace- a methodical approach to cyber defense planning," in Proceedings of the 2001 IEEE Workshop on Infromation Assurance and Security, pp. 134-141, IEEE, June 2001.
10. M. McCrabb and J. Caroli, "Behavioral modeling and wargaming." www.mors.org.
11. P. Ammann, J. Pamula, R. Ritchey, and J. Street, "A host-based approach to network attack chaining analysis," in Twenty-First Annual Computer Security Applications Conference, pp. 72-84, IEEE, December 2005.
12. O. Sheyner and J. Wing, "Tools for generating and analyzing attack graphs," in Proceedings of Workshop on Formal Methods for Components and Objects, pp. 344-371, 2004.
13. J. Dawkins, C. Campbell, R. Larson, K. Fitch, and T. Tidwell, "Modeling network attacks: Extending the attack tree paradigm," in Proceedings of the Third Annual International Systems Security Engineering Association Conference, pp. 109-118, March 2002.
14. R. Zakeri, R. Shariari, R. Jalili, and R. Sadoddin, "Modeling TCP/IP Networks Topology for Network Vulnerability Analysis," in Proceedings of the International Symposium on Telecommunications, pp. 653-658, 2005.
15. th International Symposium of Formal Methods Europe (FME '03), no. 2805 in LNCS, pp. 914-940, Springer-Verlag, September 2003.
16. R. Baldwin, "Kuang: Rule-based security checking," tech. rep., MIT, Lab for Computer Science Programming Systems Research Group, Cambridge, MA, May 1994.
17. X. Ou, S. Govindavajhala, and A. Appel, "MulVAL: A logic-based network security analyzer," in 14th Usenix Security Symposium, pp. 113-128, Usenix, IEEE, August 2005.
18. B. Schneier, "Attack trees: Modeling security threats," Dr. Dobb's Journal, pp. 21-29, December 1999.
19. R. Ritchey and P. Ammann, "Using model checking to analyze network vulnerabilities," in Proceedings of the 2000 IEEE Symposium on Security and Privacy, pp. 156-165, 2000.
20. O. Sheyner, J. Haines, S. Jha, R. Lippmann, and J. Wing, " Automated generation and analysis of attack graphs," in Proceedings of the IEEE Symposium on Security and Privacy, pp. 273-284, 2002.
21. S. Cheetancheri, "Model checking and expert system approaches to attack graphs," tech. rep., University of California, Davis, Davis, CA, August 2004.
22. S. Jha, O. Sheyner, and J. Wing, "Minimization and reliability analyses of attack graphs," in Proceedings of the Computer Security Foundations Workshop, pp. 49-63, 2002.
23. J. Dawkins, Heuristics for scalable compound exposure analysis: A foundation for a comprehensive security risk assessment. PhD thesis, University of Tulsa, May 2005.
24. K. Ingols, R. Lippmann, and K. Piwowarski, "Practical attack graph generation for network defense," in Proceedings of the 22nd Annual Computer Security Applications Conference, pp. 121-130, December 2006.
25. G. Cohen, M. Meiseles, and E. Reshef, "System and method for risk detection and analysis in a computer network," October 2005. United States Patent No. 6,952,779.
26. P. Ammann, D. Wijesekera, and S. Kaushik, "Scalable graph-based network vulnerability analysis," in Proceedings of the 9th ACM Conference on Computer and Communications Security, pp. 217-224, 2002.
27. U. Lindqvist, S. Chrung, and R. Valdez, Correlated Attack Modeling. Washington, DC: Storming Media LLC, 2003.