Proceedings of the Symposium and Bootcamp on the Science of Security最新文献_第3页

Software and attack centric integrated threat modeling for quantitative risk assessment 以软件和攻击为中心的定量风险评估集成威胁建模

Proceedings of the Symposium and Bootcamp on the Science of Security Pub Date : 2016-04-19 DOI: 10.1145/2898375.2898390

Bradley Potteiger, Gonçalo Martins, X. Koutsoukos

{"title":"Software and attack centric integrated threat modeling for quantitative risk assessment","authors":"Bradley Potteiger, Gonçalo Martins, X. Koutsoukos","doi":"10.1145/2898375.2898390","DOIUrl":"https://doi.org/10.1145/2898375.2898390","url":null,"abstract":"One step involved in the security engineering process is threat modeling. Threat modeling involves understanding the complexity of the system and identifying all of the possible threats, regardless of whether or not they can be exploited. Proper identification of threats and appropriate selection of countermeasures reduces the ability of attackers to misuse the system. This paper presents a quantitative, integrated threat modeling approach that merges software and attack centric threat modeling techniques. The threat model is composed of a system model representing the physical and network infrastructure layout, as well as a component model illustrating component specific threats. Component attack trees allow for modeling specific component contained attack vectors, while system attack graphs illustrate multi-component, multi-step attack vectors across the system. The Common Vulnerability Scoring System (CVSS) is leveraged to provide a standardized method of quantifying the low level vulnerabilities in the attack trees. As a case study, a railway communication network is used, and the respective results using a threat modeling software tool are presented.","PeriodicalId":163427,"journal":{"name":"Proceedings of the Symposium and Bootcamp on the Science of Security","volume":"29 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-04-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127736943","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 41

Operation-level traffic analyzer framework for smart grid 面向智能电网的运营级流量分析框架

Proceedings of the Symposium and Bootcamp on the Science of Security Pub Date : 2016-04-19 DOI: 10.1145/2898375.2898396

Wenyu Ren, K. Nahrstedt, Timothy M. Yardley

引用次数: 0

Decentralization and security in dynamic traffic light control 动态红绿灯控制中的分权与安全

Proceedings of the Symposium and Bootcamp on the Science of Security Pub Date : 2016-04-19 DOI: 10.1145/2898375.2898384

Jian Lou, Yevgeniy Vorobeychik

{"title":"Decentralization and security in dynamic traffic light control","authors":"Jian Lou, Yevgeniy Vorobeychik","doi":"10.1145/2898375.2898384","DOIUrl":"https://doi.org/10.1145/2898375.2898384","url":null,"abstract":"Complex traffic networks include a number of controlled intersections, and, commonly, multiple districts or municipalities. The result is that the overall traffic control problem is extremely complex computationally. Moreover, given that different municipalities may have distinct, non-aligned, interests, traffic light controller design is inherently decentralized, a consideration that is almost entirely absent from related literature. Both complexity and decentralization have great bearing both on the quality of the traffic network overall, as well as on its security. We consider both of these issues in a dynamic traffic network. First, we propose an effective local search algorithm to efficiently design system-wide control logic for a collection of intersections. Second, we propose a game theoretic (Stackelberg game) model of traffic network security in which an attacker can deploy denial-of-service attacks on sensors, and develop a resilient control algorithm to mitigate such threats. Finally, we propose a game theoretic model of decentralization, and investigate this model both in the context of baseline traffic network design, as well as resilient design accounting for attacks. Our methods are implemented and evaluated using a simple traffic network scenario in SUMO.","PeriodicalId":163427,"journal":{"name":"Proceedings of the Symposium and Bootcamp on the Science of Security","volume":"24 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-04-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115515551","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 10

Risk-based attack surface approximation: poster 基于风险的攻击面近似:海报

Proceedings of the Symposium and Bootcamp on the Science of Security Pub Date : 2016-04-19 DOI: 10.1145/2898375.2898388

Christopher Theisen, L. Williams

引用次数: 0

Abstract runtime structure for reasoning about security: poster 用于安全推理的抽象运行时结构:海报

Proceedings of the Symposium and Bootcamp on the Science of Security Pub Date : 2016-04-19 DOI: 10.1145/2898375.2898377

Marwan Abi-Antoun, E. Khalaj, R. Vanciu, A. Moghimi

引用次数: 2

Raindroid: a system for run-time mitigation of Android intent vulnerabilities [poster] Raindroid:一个运行时缓解Android意图漏洞的系统

Proceedings of the Symposium and Bootcamp on the Science of Security Pub Date : 2016-04-19 DOI: 10.1145/2898375.2898389

B. Schmerl, Jeffrey Gennari, J. Cámara, D. Garlan

引用次数: 6

A framework for generation, replay, and analysis of real-world attack variants 用于生成、重播和分析真实世界攻击变体的框架

Proceedings of the Symposium and Bootcamp on the Science of Security Pub Date : 2016-04-19 DOI: 10.1145/2898375.2898392

Phuong Cao, Eric C. Badger, Z. Kalbarczyk, R. Iyer

引用次数: 3