Modeling Moving Target Defense strategies and attacks with SAN and ADVISE

Abstract

Security evaluation can be used at the early stage of development to identify the security level of the system's components and to guide the system's development process. In previous works we extended the ontology of ADVISE Meta, an highlevel security modeling framework, to integrate common attack patterns and standardized adversaries' profiles, thus enabling wide-ranging security analyses. However, in such formalism, the active part is played only by the adversary, while the defense is only a passive aspect delegated to a few embedded attributes of the models. This work proposes a preliminary study on an approach to model active dynamic defense strategies, known as Moving Target Defense (MTD). We target one of them, the proactive obfuscation technique, which is modeled using Stochastic Activity Networks to represent the system's dynamic defense and, we join it with an ADVISE model to represent the attack counterpart.