Model-based validation of an intrusion-tolerant information system

Abstract

An increasing number of computer systems are designed to be distributed across both local and wide-area networks, performing a multitude of critical information-sharing and computational tasks. Malicious attacks on such systems are a growing concern, where attackers typically seek to degrade quality of service by intrusions that exploit vulnerabilities in networks, operating systems, and application software. Accordingly, designers are seeking improved techniques for validating such systems with respect to specified survivability requirements. In this regard, we describe a model-based validation effort that was undertaken as part of a unified approach to validating a networked intrusiontolerant information system. Model-based results were used to guide the system's design as well as to determine whether a given survivability requirement was satisfied.

Challenging the Mean Time to Failure: Measuring Dependability as a Mean Failure Cost

“…Similar metrics of security, such as the Mean Time To Detection (of a security vulnerability), abreviated by MTTD, and the Mean Time To Exploitation (of a security vulnerability), abbreviated by MTTE, have also been proposed [12]. In this paper we submit a tentative challenge to these metrics, by highlighting their shortcomings and suggesting appropriate remedies.…”

Simulation-Based Validation for Smart Grid Environments: Framework and Experimental Results

“…Also, measuring the indicator level may be subjective. Other researchers have taken different approaches such as agent-based [13,14], model-based [15,16], and attack-scenario-based [17] evaluation. Even though these approaches demonstrated interesting evaluation results, their work omitted real use cases.…”

Simulation-based validation for smart grid environments

“…Also, measuring the indicator level may be subjective. Other researchers have taken different approaches such as agent-based [17,22], model-based [24,21], and attack-scenario-based [16]. Even though these approaches demonstrated interesting evaluation results, their work omitted real use cases.…”