A user-centric threat model and repository for cyber attacks

Datta, Prerit; Sartoli, Sara; Gutiérrez, Luis Felipe González; Abri, Faranak; Namin, Akbar Siami; Jones, Keith S.

doi:10.1145/3477314.3507315

Cited by 2 publications

(2 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The software architecture provided in this research is somewhat partial or broad, limiting its applicability to real-world product guidelines and focusing more on the verification of research methods. Another research [11] extended the Microsoft STRIDE threat model to identify threats from a user's perspective. This model integrates aspects of threat modeling relevant to end-users, such as valuable assets, attack targets, and attack methods.…”

Section: Studies On the Formulation Of Security Guidelinesmentioning

confidence: 99%

“…Existing software security vulnerability analyses [10][11][12][13] often focus on specific functionalities or modules, and in many cases, they are performed without sufficient validation. Such partial and arbitrary security vulnerability analyses make it challenging to comprehend the overall security vulnerabilities of the software [14][15][16][17].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Systematic Security Guideline Framework through Intelligently Automated Vulnerability Analysis

Kim,

Ahn

2024

CMC

View full text Add to dashboard Cite

This research aims to propose a practical framework designed for the automatic analysis of a product's comprehensive functionality and security vulnerabilities, generating applicable guidelines based on real-world software. The existing analysis of software security vulnerabilities often focuses on specific features or modules. This partial and arbitrary analysis of the security vulnerabilities makes it challenging to comprehend the overall security vulnerabilities of the software. The key novelty lies in overcoming the constraints of partial approaches. The proposed framework utilizes data from various sources to create a comprehensive functionality profile, facilitating the derivation of real-world security guidelines. Security guidelines are dynamically generated by associating functional security vulnerabilities with the latest Common Vulnerabilities and Exposure (CVE) and Common Vulnerability Scoring System (CVSS) scores, resulting in automated guidelines tailored to each product. These guidelines are not only practical but also applicable in real-world software, allowing for prioritized security responses. The proposed framework is applied to virtual private network (VPN) software, wherein a validated Level 2 data flow diagram is generated using the Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of privilege (STRIDE) technique with references to various papers and examples from related software. The analysis resulted in the identification of a total of 121 vulnerabilities. The successful implementation and validation demonstrate the framework's efficacy in generating customized guidelines for entire systems, subsystems, and selected modules.

show abstract

Section: Studies On the Formulation Of Security Guidelinesmentioning

confidence: 99%