Architecture-based self-protection

Abstract

Security features are often hardwired into software applications, making it difficult to adapt security responses to reflect changes in runtime context and new attacks. In prior work, we proposed the idea of architecture-based self-protection as a way of separating adaptation logic from application logic and providing a global perspective for reasoning about security adaptations in the context of other business goals. In this paper, we present an approach, based on this idea, for combating denial-of-service (DoS) attacks. Our approach allows DoS-related tactics to be composed into more sophisticated mitigation strategies that encapsulate possible responses to a security problem. Then, utility-based reasoning can be used to consider different business contexts and qualities. We describe how this approach forms the underpinnings of a scientific approach to self-protection, allowing us to reason about how to make the best choice of mitigation at runtime. Moreover, we also show how formal analysis can be used to determine whether the mitigations cover the range of conditions the system is likely to encounter, and the effect of mitigations on other quality attributes of the system. We evaluate the approach using the Rainbow self-adaptive framework and show how Rainbow chooses DoS mitigation tactics that are sensitive to different business contexts.

Design and Analysis of Self-protection: Adaptive Security for Software-Intensive Systems

“…These attacks exploit information exposed in one state of the system to compromise a later state that can be reached during or after adaptation. Moreover, risk identification and analysis is often performed at design time [122,227]. Runtime security analysis is required to cope with systems that adapt often and exhibit dynamic behavior.…”

“…P-III refers to enhancing security-aware adaptation with countermeasure selection. Countermeasure selection and deployment approaches have been proposed before, however, these approaches often are limited in either the kind of countermeasures that can be applied [94,204,227] or in the types of systems that they can protect. To the best of our knowledge, we lack a solution that follows a holistic approach taking into account the possible component and countermeasure configurations available to protect a software system, analyzes their effects, compatibility and costs, and identifies the best available configuration to be deployed.…”

“…The authors finally demonstrate how to incorporate their approach into Rainbow [94], a well known and adopted architecture-based self-adaptation framework. Schmerl et al [227] build upon the previous work and provide a methodology to compose security-related tactics into higher level strategies to respond to DoS attacks. They base their solution in utility theory and combine security strategies with business qualities to select the strategy that better fits the business context.…”

“…The patterns are implemented in a well-known exemplar SAS, by employing the Rainbow framework. In an extension of this work [227], DoS-related tactics are composed to mitigate DoS attacks and the utility-based reasoning provided in Rainbow is used to choose the best strategies to apply in the system. In contrast to the above approaches, we take into account the security risks of components' vulnerabilities while selecting a strategy to apply in the system.…”

“…Yuan et al [282] provide an architecturebased approach to self-protecting systems and proposed architectural patterns to protect a system. In an extension of that work, the authors in [227] analyzed adaptations from availability point of view to be able to mitigate DoS attacks. In the network security community, researchers have proposed a few approaches for security analysis of dynamic networks [5,92,283,284].…”