A Meta Language for Threat Modeling and Attack Simulations

Johnson, Pontus; Lagerström, Robert; Ekstedt, Mathias

doi:10.1145/3230833.3232799

Cited by 88 publications

(77 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Domain-specific attack languages can be used to make the creation of new attack graphs and threat models cheap and efficient (Johnson et al 2018). Such languages can clarify the reasoning of a generic attack in a specific domain and facilitate the modeling or instantiating of a specific system in that domain.…”

Section: Threat Modelingmentioning

confidence: 99%

Automating threat modeling using an ontology framework

et al. 2020

Self Cite

View full text Add to dashboard Cite

Threat modeling is of increasing importance to IT security, and it is a complex and resource demanding task. The aim of automating threat modeling is to simplify model creation by using data that are already available. However, the collected data often lack context; this can make the automated models less precise in terms of domain knowledge than those created by an expert human modeler. The lack of domain knowledge in modeling automation can be addressed with ontologies. In this paper, we introduce an ontology framework to improve automatic threat modeling. The framework is developed with conceptual modeling and validated using three different datasets: a small scale utility lab, water utility control network, and university IT environment. The framework produced successful results such as standardizing input sources, removing duplicate name entries, and grouping application software more logically.

show abstract

Section: Threat Modelingmentioning

confidence: 99%

Automating threat modeling using an ontology framework

et al. 2020

Self Cite

View full text Add to dashboard Cite

show abstract

“…The Meta Attack Language (MAL) [26] allows generating attack graphs automatically for a specific software system domain (cloud computing or embedded systems). Attack graphs represent the dependencies between the steps that may be performed by the attacker to compromise the software system.…”

Section: Background and Related Workmentioning

confidence: 99%

“…Previous work [22][23][24][25][26] allows generating threat models and providing assistance to companies to manage the security process. However, it is not suitable to represent security incidents in software systems and identify method executions that should be logged, automatically.…”

Section: Background and Related Workmentioning

confidence: 99%

Automated modelling of security incidents to represent logging requirements in software systems

Rivera-Ortiz

Pasquale

2020

Proceedings of the 15th International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

In 2017 the Open Web Application Security Project (OWASP) has identified insufficient logging and monitoring as one of the top ten security risks. Attackers can exploit insufficient logging in software systems to cause harm to an organisation while being undetected for long periods of time. Therefore, software systems used within an organisation should perform logging to collect data relevant to detect and/or diagnose potential security incidents. However, when implementing logging functionalities, software developers either do not log enough information or log too much information. In this paper, we provide an approach to help developers decide where to log and what to log for security purposes. Our approach allows a security engineer to replay potential security incidents on an instrumented version of the software system and generate automatically a model of such incidents. These are represented as a UML sequence diagram that contains the relevant method invocations occurring during and incident, without providing a representation of the entire software behaviour. Because our model refers to concrete system components, it provides immediate guidance to developers about what methods execution should be logged for security purposes.

show abstract

“…Another example is coreLang, which as its name suggests is a core modeling language that contains the most common IT entities and attack steps. coreLang is included in the presentation of MAL [9].…”

Section: Related Workmentioning

confidence: 99%

“…As the previous approaches rely on a static implementation, we propose the use of MAL (the Meta Attack Language) [9]. This framework for domain-specific languages (DSLs) defines which information about a system is required and specifies the generic attack logic.…”

Section: Introductionmentioning

confidence: 99%

Creating Meta Attack Language Instances using ArchiMate: Applied to Electric Power and Energy System Cases

Hacks

Katsikeas

et al. 2019

2019 IEEE 23rd International Enterprise Distributed Object Computing Conference (EDOC)

View full text Add to dashboard Cite

Cyber-attacks on power assets can have disastrous consequences for individuals, regions, and whole nations. In order to respond to these threats, the assessment of power grids' and plants' cyber security can foster a higher degree of safety for the whole infrastructure dependent on power. Hitherto, we propose the use of attack simulations based on system architecture models. To reduce the effort of creating new attack graphs for each system of a given type, domain-specific attack languages may be employed. They codify common attack logics of the considered domain. Previously, MAL (the Meta Attack Language) was proposed, which serves as a framework to develop domain specific attack languages. We extend the tool set of MAL by developing an approach to model security domains in ArchiMate notation. Next, those models are used to create a MAL instance, which reflects the concepts modeled in ArchiMate. These instances serve as input to simulate attacks on certain systems. To show the applicability of our approach, we conduct two case studies in the power domain. On the one hand, we model a thermal power plant and possible attacks on it. On the other hand, we use the attack on the Ukrainian power grid for our case study.

show abstract

A Meta Language for Threat Modeling and Attack Simulations

Cited by 88 publications

References 23 publications

Automating threat modeling using an ontology framework

Automating threat modeling using an ontology framework

Automated modelling of security incidents to represent logging requirements in software systems

Creating Meta Attack Language Instances using ArchiMate: Applied to Electric Power and Energy System Cases

Contact Info

Product

Resources

About