Situation Calculus and Graph Based Defensive Modeling of Simultaneous Attacks

Samarji, Layal; Cuppens, Frédéric; Cuppens-Boulahia, Nora; Kanoun, Waël; Dubus, Samuel

doi:10.1007/978-3-319-03584-0_11

Cited by 9 publications

(5 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The main drawback of this approach is the inability to evaluate the impact of selected responses over its dependent services. Samarji et al 7 propose to combine graph theory and a new formal description of individual, coordinated, and concurrent attacks in order to model attack graphs that cover the 3 attacks types. The approach uses situation calculus to automatically generate attack graphs that leverage response systems means to estimate the global risk inferred by simultaneous ongoing attacks, and to reason about appropriate responses.…”

Section: Related Workmentioning

confidence: 99%

Hypergraph‐driven mitigation of cyberattacks

González-Granadillo

Doynikova

Kotenko

et al. 2018

Internet Technology Letters

View full text Add to dashboard Cite

We extend a mitigation model that evaluates individual and combined countermeasures against multistep cyberattack scenarios. The goal is to anticipate the actions of an attacker that wants to disrupt a given system (eg, an information system). The process is driven by a hypergraph formalism, enforced with a stateful return on response investment metric that optimally evaluates, ranks, and selects appropriate countermeasures to handle ongoing and potential attacks. KEYWORDSattack graphs, countermeasure selection, mitigation, network security, return on security investment, security metrics INTRODUCTIONQuantitative financial metrics are useful in cybersecurity to evaluate mitigation plans and select the best countermeasures to handle attack scenarios. 1 The main drawback is the management of stateful meta-data, for example, how countermeasures deployed at time t−1 shall be considered when evaluating a new group of countermeasures at time t. We argue that a plausible solution is the combination of quantitative financial metrics together with attack graph formalisms. (2,3) The challenge is data management, effective processing, and visual perception when dealing with huge size attack graphs. An application of the hypergraphs allows us to reduce the size of processed attack graph by combining multiple links within 1 node. 4 In this letter, we propose to integrate a stateful quantitative financial metric, based on return on investment (ROI)-like concepts, together with a hypergraph model, in order to evaluate, rank, and select optimal countermeasures based on financial and threat impact assessment functions. The resulting solution is evaluated at each state of the system while considering the already deployed countermeasures and the effects of adding or suppressing other security actions. Section 2 and 3 provide the background and review some related work. Section 4 proposes our solution. Section 5 describes the hypergraph-driven reduction of our attack graph model. Section 6 discusses limitations and advantages of our proposal. Section 7 concludes the paper. BACKGROUNDThe return on response investment (RORI) metric proposed in Reference 1 is extended toward a new stateful return on response investment metric (hereinafter denoted as StRORI). We assume a dynamic security monitoring process, where detection tools are permanently inspecting system and network events, in order to identify attack instances. To ease the presentation of the StRORI metric, we assume a discrete monitoring system based on temporal snapshots. Each snapshot provides a list with the different nodes affected in the attack scenario, as well as all the remainder security parameters. We propose to use attack graph Internet Technology Letters. 2018;1:e38.wileyonlinelibrary.com/journal/itl2

show abstract

Section: Related Workmentioning

confidence: 99%

Hypergraph‐driven mitigation of cyberattacks

González-Granadillo

Doynikova

Kotenko

et al. 2018

Internet Technology Letters

View full text Add to dashboard Cite

show abstract

“…In order to achieve this goal, attacking sources, controlled by one or several attacking entities, may cooperate by resource sharing, task allocation, synchronization,etc. Many works focus on complex attack and the way to design them as in [14] where the authors define a formal description of individual and coordinated attacks.…”

Section: Security Eventsmentioning

confidence: 99%

“…Security countermeasures and their limitations [1] system is unable to process all the incoming messages, the other part of attackers captures those messages as an ITS server and manipulates them. We use the modelisation of complex attacks described in [14] to define an example of complex attack in automotive system (CXA) corresponding to the type "Coordinated Attack with Load Accumulation -CALA". CALA is defined in [14] as a coordinated attack in which attackers accumulate their capabilities.…”

Section: An Example Of Complex Attack In Automotive Systemmentioning

confidence: 99%

“…We use the modelisation of complex attacks described in [14] to define an example of complex attack in automotive system (CXA) corresponding to the type "Coordinated Attack with Load Accumulation -CALA". CALA is defined in [14] as a coordinated attack in which attackers accumulate their capabilities. This offers execution of the attack in a distributed and simultaneous way.…”

Section: An Example Of Complex Attack In Automotive Systemmentioning

confidence: 99%

See 1 more Smart Citation

Metric for Security Activities Assisted by Argumentative Logic

Bouyahia

Idrees

Cuppens-Boulahia

et al. 2015

Data Privacy Management, Autonomous Spontaneous Security, and Security Assurance

Self Cite

View full text Add to dashboard Cite

Abstract. Recent security concerns related to future embedded systems make enforcement of security requirements one of the most critical phases when designing such systems. This paper introduces an approach for efficient enforcement of security requirements based on argumentative logic, especially reasoning about activation or deactivation of different security mechanisms under certain functional and non-functional requirements. In this paper, the argumentative logic is used to reason about the rationale behind dynamic enforcement of security policies.

show abstract

“…Kordy et al [12,13] proposed that attack trees be modeled in propositional logic, but in this model attacks can be freely duplicated and contracted which goes against the process nature of an attack tree. However, linear logic restores this natural interpretation without loosing the process interpretation of attack trees and without having to resort to complicated notation unlike models similar to the situation calculus [17]. By connecting attack trees to logic we can also tap into the long standing research and development of automation, for example, SAT, SMT, proof search, etc.…”

Section: Introductionmentioning

confidence: 99%

An Intuitionistic Linear Logical Semantics of SAND Attack Trees

Eades

2018

Preprint

View full text Add to dashboard Cite

In this paper we introduce a new logical foundation of SAND attack trees in intuitionistic linear logic. This new foundation is based on a new logic called the Attack Tree Linear Logic (ATLL). Before introducing ATLL we given several new logical models of attack trees, the first, is a very basic model based in truth tables. Then we lift this semantics into a semantics of attack trees based on lineales which introduces implication, but this can be further lifted into a dialectica model which ATLL is based. One important feature of ATLL is that it supports full distributivity of sequential conjunction over choice.

show abstract

Situation Calculus and Graph Based Defensive Modeling of Simultaneous Attacks

Cited by 9 publications

References 10 publications

Hypergraph‐driven mitigation of cyberattacks

Hypergraph‐driven mitigation of cyberattacks

Metric for Security Activities Assisted by Argumentative Logic

An Intuitionistic Linear Logical Semantics of SAND Attack Trees

Contact Info

Product

Resources

About