PENET: A practical method and tool for integrated modeling of security attacks and countermeasures

Computers and Security

Volumn 28, Issue 8, 2009, Pages 754-771

  Pudar, Srdjan ^a   Manimaran, G ^a   Liu, Chen Ching ^a  

^a Iowa State University   (United States)

Author keywords

Attack Modeling; Attack trees; Computer security; Cyber security; Petri nets; Software development; Survivability

Indexed keywords

ANALYSIS APPROACH; ATTACK TREE; COMPUTER SECURITY; CYBER SECURITY; CYBER-ATTACKS; DEPENDABILITY EVALUATION; DYNAMIC BEHAVIORS; INTEGRATED MODELING; MODELING APPROACH; MODELING CAPABILITIES; MODELING CONSTRUCT; PERFORMABILITY EVALUATION; PERFORMANCE METRICS; PETRI NET REPRESENTATIONS; PRACTICAL METHOD; REPARABILITY; RESEARCH EFFORTS; SECURITY ATTACKS; SECURITY EVALUATION; SOFTWARE DEVELOPMENT; SOFTWARE IMPLEMENTATION; STOCHASTIC MODELING; VULNERABLE SYSTEMS;

COMPUTER CRIME; COMPUTER SOFTWARE SELECTION AND EVALUATION; GRAPH THEORY; LAW ENFORCEMENT; NETWORK SECURITY; PETRI NETS; RESEARCH; SECURITY SYSTEMS; SOFTWARE DESIGN; STOCHASTIC SYSTEMS; TELECOMMUNICATION NETWORKS; TIME DOMAIN ANALYSIS;

MATHEMATICAL MODELS;

EID: 71849094936     PISSN: 01674048     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.cose.2009.05.007     Document Type: Article

References (21)

1. Ajmone Marsan M., Balbo G., and Conte G. A class of generalized stochastic Petri nets for the performance analysis of multiprocessor systems. ACM Transactions on Computer Systems 2 1 (1984)
2. Bistarelli S, Fioravanti F, Peretti P. Defense trees for economic evaluation of security investments, availability, reliability and security. ARES 2006. In: The first international conference on 20-22 April 2006; 2006. p. 8.
3. Bloom J., Clark C., Clifford C., Duncan A., Khan H., Papantoniou M., et al. PIPE (2004), Imperial College DoC Group Project
4. Dalton II GC, Mills RF, Colombi JM, Raines RA. Analyzing attack trees using generalized stochastic Petri nets. In: IEEE information assurance workshop June 21-23; 2006. pp. 116-23.
5. Dugan J.B., Bavuso S.J., and Boyd M.A. Dynamic fault-tree models for fault-tolerant computer systems. IEEE Transactions on Reliability 41 3 (1992) 363-377
6. Evans S., Heinbuch D., Kyule E., Piorkowski J., and Wallner J. Risk-based systems security engineering: stopping attacks with intention. IEEE Security and Privacy 02 6 (2004) 59-62
7. Casey Fung; Yi-Liang Chen; Xinyu Wang; Lee, J.; Tarquini, R.; Anderson, M.; et-al, Survivability analysis of distributed systems using attack tree methodology, Military Communications Conference. MILCOM 2005. In: IEEE, vol. 1, 17-20 October 2005; 2005. pp. 583-89.
8. Higuero MV, Unzilla JJ, Jacob E, Saiz P, Aguado M, Luengo D. Application of 'attack trees' in security analysis of digital contents e-commerce protocols with copyright protection, Security Technology. CCST '05. In: 39th Annual 2005 International Carnahan Conference on 11-14 October 2005; 2005. pp. 57-60.
9. Jonsson E., and Olovsson T. A quantitative model of the security intrusion process based on attacker behavior. IEEE Transactions on Software Engineering 23 4 (1997) 235-245
10. Madan BB, Gogeva-Popstojanova K, Vaidyanathan K, Trivedi KS. Modeling and quantification of security attributes of software systems, dependable systems and networks, 2002. In: Proceedings international conference on; 2002. pp. 505-14.
11. McDermott JP. Attack net penetration testing. In: Proceedings of the 2000 workshop on new security paradigms. (Ballycotton, County Cork, Ireland); 18-21 September 2000.
12. McQueen MA, Boyer WF, Flynn MA, Beitel GA. Quantitative cyber risk reduction estimation methodology for a small SCADA control system, system sciences. HICSS '06. In: Proceedings of the 39th annual Hawaii international conference on 04-07 January 2006, vol. 9; 2006. pp. 226-26.
13. Mirkovic J., Martin J., and Reiher P. A Taxonomy of DDoS attacks and DDoS defense mechanisms (2001), University of California Computer Science Department, Los Angeles, CA
14. Moore AP, Ellison RJ, Linger RC. Attack modeling for information security and survivability. Software Engineering Institute Technical Report CMU/SEI-2001; 2001.
15. Nicol D.M., Sanders W.H., and Trivedi K.S. Model-based evaluation: from dependability to security. IEEE Transactions on Dependable and Secure Computing 01 1 (2004) 48-65
16. Sallhammar K, Helvik BE, Knapskog SJ. Towards a stochastic model for integrated security and dependability evaluation, availability, reliability and security. ARES 2006. In: The first international conference on 20-22 April 2006; 2006. p. 8.
17. Schneier B. Attack trees: modeling security threats. Dr. Dobb's Journal (December 1999)
18. Ten C.-W., Liu C.-C., and Govindarasu M. Vulnerability assessment of cybersecurity for SCADA systems using attack trees (2007), Power Engineering Society General Meeting
19. Tridandapani S., Somani A.K., and Sandadi U.R. Low overhead multiprocessor allocation strategies exploiting system spare capacity for fault detection and location. IEEE Transactions on Computers 44 7 (1995) 865-877
20. Wang J. Timed Petri nets: theory and application (October 1998), Kluwer Academic Publishers, USA 290 pages
21. Wang H., Zhang D., and Shin K.G. Change-point monitoring for the detection of DoS attacks. IEEE Transactions on Dependable and Secure Computing 1 4 (2004) 193-208