Automating threat modeling using an ontology framework

Välja, Margus; Heiding, Fredrik; Franke, Ulrik; Lagerström, Robert

doi:10.1186/s42400-020-00060-8

Cited by 21 publications

(11 citation statements)

References 50 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In particular, we exam-97 ine the areas of security vulnerability, ontologies and 98 healthcare sector cyber security. Välja et al [6] introduced an ontology framework for 101 improving automatic threat modelling, where they pro-102 posed a framework that is developed with conceptual 103 modelling, which is validated using different datasets 104 from water utility control network and university IT 105 environment. The goal of the framework is to sup-106 port the automation of threat modelling by improv-107 ing the comparability and completeness of data from 108 multiple sources based on specific data type elements 109 such as software products, operating systems, and data 110 flows.…”

Section: Related Work 95mentioning

confidence: 99%

Vulnerability prediction for secure healthcare supply chain service delivery

Islam

Abba

Ismail

et al. 2022

ICA

View full text Add to dashboard Cite

Healthcare organisations are constantly facing sophisticated cyberattacks due to the sensitivity and criticality of patient health care information and wide connectivity of medical devices. Such attacks can pose potential disruptions to critical services delivery. There are number of existing works that focus on using Machine Learning (ML) models for predicting vulnerability and exploitation but most of these works focused on parameterized values to predict severity and exploitability. This paper proposes a novel method that uses ontology axioms to define essential concepts related to the overall healthcare ecosystem and to ensure semantic consistency checking among such concepts. The application of ontology enables the formal specification and description of healthcare ecosystem and the key elements used in vulnerability assessment as a set of concepts. Such specification also strengthens the relationships that exist between healthcare-based and vulnerability assessment concepts, in addition to semantic definition and reasoning of the concepts. Our work also makes use of Machine Learning techniques to predict possible security vulnerabilities in health care supply chain services. The paper demonstrates the applicability of our work by using vulnerability datasets to predict the exploitation. The results show that the conceptualization of healthcare sector cybersecurity using an ontological approach provides mechanisms to better understand the correlation between the healthcare sector and the security domain, while the ML algorithms increase the accuracy of the vulnerability exploitability prediction. Our result shows that using Linear Regression, Decision Tree and Random Forest provided a reasonable result for predicting vulnerability exploitability.

show abstract

Section: Related Work 95mentioning

confidence: 99%

Vulnerability prediction for secure healthcare supply chain service delivery

Islam

Abba

Ismail

et al. 2022

ICA

View full text Add to dashboard Cite

show abstract

“…An ontology-based EA can be employed to solve the communication problems between humans, between systems, or between human and system [25]. Moreover, it can be used to address the lack of domain knowledge and mismatched data granularity in automating threat modeling [50].…”

Section: Enterprise Architecturementioning

confidence: 99%

Cyber security threat modeling based on the MITRE Enterprise ATT&CK Matrix

et al. 2021

Self Cite

View full text Add to dashboard Cite

Enterprise systems are growing in complexity, and the adoption of cloud and mobile services has greatly increased the attack surface. To proactively address these security issues in enterprise systems, this paper proposes a threat modeling language for enterprise security based on the MITRE Enterprise ATT&CK Matrix. It is designed using the Meta Attack Language framework and focuses on describing system assets, attack steps, defenses, and asset associations. The attack steps in the language represent adversary techniques as listed and described by MITRE. This entity-relationship model describes enterprise IT systems as a whole; by using available tools, the proposed language enables attack simulations on its system model instances. These simulations can be used to investigate security settings and architectural changes that might be implemented to secure the system more effectively. Our proposed language is tested with a number of unit and integration tests. This is visualized in the paper with two real cyber attacks modeled and simulated.

show abstract

“…Architecture modeling can aid system analysis and help handling the increasing complexity of IT landscapes [26], [27]. The importance of creating models to support decision-making has previously been addressed in some studies.…”

Section: Related Workmentioning

confidence: 99%

A Method for Assigning Probability Distributions in Attack Simulation Languages

Xiong

Hacks

Lagerström

2021

J. Complex Syst. Inform. Model. Q.

Self Cite

View full text Add to dashboard Cite

Cyber attacks on IT and OT systems can have severe consequences for individuals and organizations, from water or energy distribution systems to online banking services. To respond to these threats, attack simulations can be used to assess the cyber security of systems to foster a higher degree of resilience against cyber attacks; the steps taken by an attacker to compromise sensitive system assets can be traced, and a time estimate can be computed from the initial step to the compromise of assets of interest. Previously, the Meta Attack Language (MAL) was introduced as a framework to develop security-oriented domain-specific languages. It allows attack simulations on modeled systems and analyzes weaknesses related to known attacks. To produce more realistic simulation results, probability distributions can be assigned to attack steps and defenses to describe the efforts required for attackers to exploit certain attack steps. However, research on assessing such probability distributions is scarce, and we often rely on security experts to model attackers' efforts. To address this gap, we propose a method to assign probability distributions to the attack steps and defenses of MAL-based languages. We demonstrate the proposed method by assigning probability distributions to a MAL-based language. Finally, the resulting language is evaluated by modeling and simulating a known cyber attack.

show abstract

Automating threat modeling using an ontology framework

Cited by 21 publications

References 50 publications

Vulnerability prediction for secure healthcare supply chain service delivery

Vulnerability prediction for secure healthcare supply chain service delivery

Cyber security threat modeling based on the MITRE Enterprise ATT&CK Matrix

A Method for Assigning Probability Distributions in Attack Simulation Languages

Contact Info

Product

Resources

About