Modeling attacks

Abstract

The aim of this paper is to develop a general conceptual model of attack progression that can be applied to modeling of computer and communication threat risks. This paper focuses on attacks that aim at overpowering the victim/prey to gain some benefi t. It examines existing models and introduces a new fl ow model to facilitate development of a general model of two-sided combat. The symmetry between the attacker's and defender's fl ow systems of signals, information, plans, decisions, and actions results in a single combat model incorporating the realms of both attacker and defender. Based on this conceptualization, it is possible to characterize the weak points and develop a map of vulnerabilities in the defender's system. Such a methodology of attack modeling provides a base for analysis in the fi elds of threat modeling and secure software development. Finally, this new model is applied to an SQL injection problem in web services to demonstrate implementation of a real system problem.

Towards a conceptual foundation for physical security: Case study of an IT department

“…Section 3 introduces a diagrammatic language (see refs. [21]- [28]) as a vehicle for depicting security machines with illustrative examples that are a new contribution. Section 4 utilizes this language to model the security aspects of the case study.…”

An Alternative Approach to Multiple Models: Application to Control of a Production Cell

“…FM has been utilized in many applications [9][10][11][12]. The example constructed at the end of the section is a new contribution.…”

“…This processing triggers (5) the creation (6) of ordered elements, an order that flows to the company system (7), where it is processed (8) to trigger (9) a Review of items (10). The Review flows (11) to the customer, where it is processed (12) to trigger (13) the creation of not approved (14) or approved (15). Not approved triggers the process to start again by sending another catalog to the customer (16).…”

Hardware attack risk assessment

“…Other examples of hardware attacks include data remanence [27], [28] and failure analysis [29]- [31]. Additional attacks are discussed in [1]- [4], [32]- [35].…”