Probabilistic risk assessment for security requirements: A preliminary study

Proceedings - 2011 5th International Conference on Secure Software Integration and Reliability Improvement, SSIRI 2011

Volumn , Issue , 2011, Pages 11-20

  Lee, Seok Won ^a  

^a UNIVERSITY OF NEBRASKA LINCOLN   (United States)

Author keywords

Accreditation; Bayesian network; Certification; Probabilistic risk assessment; Security requirements; Sensitivity analysis

Indexed keywords

ASSESSMENT MODELS; CAUSAL RELATIONSHIPS; CERTIFICATION; DECISION MAKING PROCESS; DOMAIN EXPERTISE; EXPLICIT MODELS; MODEL-DRIVEN; OPERATIONAL ENVIRONMENTS; PROBABILISTIC RISK ASSESSMENT; SECURITY CERTIFICATION; SECURITY REQUIREMENTS; SOCIOTECHNICAL; SOFTWARE BEHAVIOR;

ACCREDITATION; BAYESIAN NETWORKS; C (PROGRAMMING LANGUAGE); RATING; RISK PERCEPTION; SENSITIVITY ANALYSIS;

RISK ASSESSMENT;

EID: 80052916591     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SSIRI.2011.12     Document Type: Conference Paper

References (34)

1. Common Criteria, Ver. 2.1. ISO/IEC 15408-1, 1999.
2. DoD Instruction 5200.40: DITSCAP, 1997.
3. DoDI 8500.2. IA Implementation, 2003.
4. Vulnerability Analysis of Certificate Validation Systems, www.corestreet.com.
5. Aagedal, J.O. and den Braber, F., Model-based risk assessment to improve enterprise security. in Proc. of the 6th Int'l Enterprise Distributed Object Computing Conf., (2002), 51-62.
6. Butler, S.A., Security Attribute Evaluation Method: A Cost-Benefit Approach. in, (2002), 232.
7. da Costa, P.C.G. and Laskey, K.B., Multi-Entity Bayesian Networks Without Multi-Tears. George Mason University, SEOR (2005).
8. Davis, T. Federal Computer Security Report Card Grades 2004 Press Release, Government Reform Committee, 2004.
9. Ekelhart, Fenz, Klemen and Weippl, Security Ontologies: Improving Quantitative Risk Analysis. in, (2007), 156a.
10. Elliott, R.J., Aggoun, L. and Moore, J.B. Hidden Markov Models: Estimation and Control, Springer-Verlag, Berlin, 1995.
11. Ernst and Young. Report on the Widening Gap 8th annual Global Information Security Survey, Netherland, 2005.
12. Feather, M. and Cornford, S. Quantitative risk-based requirements reasoning. Requirements Engineering, 8 (4). 248-265.
13. Feather, M.S., Maynard-Zhang, P. and Kiper, J.D. Modeling uncertainty in requirements engineering decision support, Pasadena, CA: Jet Propulsion Laboratory, NASA, 2005.
14. Fenton, N. and Neil, M. A Critique of Software Defect Prediction Models IEEE Transactions on Software Engineering, 1999, 675-689.
15. Fenton, N. and Neil, M. Making Decisions: Using BNs and MCD, CS Dept., Queen Mary and Westfield College, London, 2000.
16. Gandhi, R.A. and Lee, S.-W., Discovering and Understanding Multidimensional Correlations among Certification Requirements with application to Risk Assessment. Req Engg Conf. (2007), 231-240.
17. Getoor, L., Friedman, N., Koller, D. and Pfeffer, A. Learning Probabilistic Relational Models Relational Data Mining, Berlin: Springer-Verlag, Saso Dzeroski and Nada Lavrac (ed.), 2001.
18. Gilks, W., Thomas, A. and Spiegelhalter, D.J. A language and program for complex Bayesian modeling The Statistician, 1994.
19. Gregoriades, A. and Sutcliffe, A. Scenario-based assessment of nonfunctional requirements. IEEE Trans on Soft Engg, 31 (5). 392-409.
20. Grenander, U. Elements of Pattern Theory, Johns Hopkins 1996.
21. Hu, Y., Chen, J., Huang, J., Liu, M.A.L.M. and Xie, K.A.X.K., Analyzing Software System Quality Risk Using Bayesian Belief Network. in Granular Computing, 2007. GRC 2007.
22. Hui, A.K.T. and Liu, D.B. A Bayesian Belief Network Model and Tool to Evaluate Risk and Impact in Software Development Projects Reliability and Maintainability, 2004 Annual Symposium, 2004, 297-301.
23. Koller, D. and Pfeffer, A. Object-Oriented Bayesian Networks Uncertainty in Artificial Intelligence: Proceedings of the Thirteenth Conference, San Francisco, CA, Morgan Kaufmann., 1997.
24. Laskey, K.B. MEBN: A language for first-order Bayesian knowledge bases. Artificial Intelligence, 172 (2-3).2005, 140-178.
25. Lee, S.W., Muthurajant, D., et al. Building decision support problem domain ontology from natural language requirements for software assurance. IJSEKE, 16 (6). 851-884.
26. Littlewood, B., Popov, P. and Strigini, L. Assessment of the reliability of fault-tolerant software: A Bayesian approach. Computer Safety, Reliability and Security, Proceedings, 1943. 294-308.
27. Littlewood, B. and Wright, D. The Use of Multilegged Arguments to Increase Confidence in Safety Claims for Software-Based Systems: A Study Based on a BBN Analysis of an Idealized Example. IEEE Transactions on Software Engineering, 33 (5). 347-365.
28. Mkpong-Ruffin, I., Umphress, D., Hamilton, J. and Gilbert, J. Quantitative software security risk assessment model ACM workshop on Quality of protection, Alexandria, Virginia, USA, 2007.
29. Neil, M. The SERENE Method Manual versoin 1.0, 1999.
30. Neil, M., Fenton, N. and Nielsen, L. Building large-scale Bayesian networks. Knowledge Engineering Review, 15 (3). 257-284.
31. Report, U.G. Department of Homeland Security Needs to Fully Implement its Security Program 05-700, 2005.
32. Verdon, D. and McGraw, G. Risk Analysis in Software Design IEEE Security & Privacy Magazine, 2004, 79-84.
33. Voas, J. Certifying software for high-assurance environments. IEEE Software, 16 (4). 48-54.
34. Yacoub, S.M. and Ammar, H.H. A methodology for architecture-level reliability risk analysis. IEEE Trans on Soft Engg, 28 (6). 529-547.