Amadeus

Abstract

The proper configuration of systems has become a fundamental factor to avoid cybersecurity risks. Thereby, the analysis of cybersecurity vulnerabilities is a mandatory task, but the number of vulnerabilities and system configurations that can be threatened is extremely high. In this paper, we propose a method that uses software product line techniques to analyse the vulnerable configuration of the systems. We propose a solution, entitled AMADEUS, to enable and support the automatic analysis and testing of cybersecurity vulnerabilities of configuration systems based on feature models. AMADEUS is a holistic solution that is able to automate the analysis of the specific infrastructures in the organisations, the existing vulnerabilities, and the possible configurations extracted from the vulnerability repositories. By using this information, AMADEUS generates automatically the feature models, that are used for reasoning capabilities to extract knowledge, such as to determine attack vectors with certain features. AMADEUS has been validated by demonstrating the capacities of feature models to support the threat scenario, in which a wide variety of vulnerabilities extracted from a real repository are involved. Furthermore, we open the door to new applications where software product line engineering and cybersecurity can be empowered. CCS CONCEPTS• Software and its engineering → Software product lines.␣

Feature models to boost the vulnerability management process

“…As mentioned above, AMADEUS was presented in a previous work (Varela-Vaca et al, 2020) as a methodology for automatically creating FMs by integrating information from the vulnerability repository and reasoning to determine attack vectors with certain features. However, certain aspects were left pending, such as the subsequent extraction of exploits to assess vulnerabilities, the incorporation of new vulnerability repositories, and the improvement of reasoning about the models.…”

“…The inference of FMs from vulnerabilities was introduced in the previous work (Varela-Vaca et al, 2020). In that approach, we inferred an FM for a CVE, but it was built considering only a vulnerability database and omitting exploit information.…”

“…In previous work, we presented AMADEUS (Varela-Vaca et al, 2020) as a solution that uses feature models (hereinafter FMs) as formal models to gather the variability of known affected elements (software, hardware, operating systems, etc.) represented in vulnerabilities.…”

“…In this paper, our aim is to extend the previous work (Varela-Vaca et al, 2020) by improving AMADEUS empowered by the following items:…”

Advisory

“…AAFMs enable reasoning about VISs by using artificial intelligence systems or ad-hoc algorithms to extract relevant information from the set of dependencies described in a VIS. Coupled with variability analysis, approaches have emerged that attempt to analyse the vulnerabilities of a software product line to optimise the test suite to be performed [11].…”