Probabilistic Modeling and Simulation of Vehicular Cyber Attacks: An Application of the Meta Attack Language

Katsikeas, Sotirios; Johnson, Pontus; Hacks, Simon; Lagerström, Robert

doi:10.5220/0007247901750182

Cited by 23 publications

(16 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As mentioned earlier, it is a common issue for MAL-based languages to have only a few attack steps and defenses with probability distributions (e.g., [8], [39]). Therefore, we propose a method that guides future developers to find such probabilities and assign them to MAL-based languages.…”

Section: Methods For Assigning Probability Distributionsmentioning

confidence: 99%

“…To collect information as input for the process, different sources are possible, such as performing systematic literature reviews (SLRs) (e.g., [40], [41]), interviewing experts [39], conducting studies [42], or making an estimation based on existing sources [43]. Considering SLRs, we expand their scope (see Figure 5) to include not only traditional academic publishing, such as journal papers and conference proceedings, but also online platforms such as security events (e.g., blackhat 14 ), vulnerability databases (e.g., NVD 15 ), blogs, and technical reports, since, oftentimes, the recent cyber threats are publicly disclosed online [44].…”

Section: Collect Information For Domain Under Assessmentmentioning

confidence: 99%

See 1 more Smart Citation

A Method for Assigning Probability Distributions in Attack Simulation Languages

Xiong

Hacks

Lagerström

2021

J. Complex Syst. Inform. Model. Q.

Self Cite

View full text Add to dashboard Cite

Cyber attacks on IT and OT systems can have severe consequences for individuals and organizations, from water or energy distribution systems to online banking services. To respond to these threats, attack simulations can be used to assess the cyber security of systems to foster a higher degree of resilience against cyber attacks; the steps taken by an attacker to compromise sensitive system assets can be traced, and a time estimate can be computed from the initial step to the compromise of assets of interest. Previously, the Meta Attack Language (MAL) was introduced as a framework to develop security-oriented domain-specific languages. It allows attack simulations on modeled systems and analyzes weaknesses related to known attacks. To produce more realistic simulation results, probability distributions can be assigned to attack steps and defenses to describe the efforts required for attackers to exploit certain attack steps. However, research on assessing such probability distributions is scarce, and we often rely on security experts to model attackers' efforts. To address this gap, we propose a method to assign probability distributions to the attack steps and defenses of MAL-based languages. We demonstrate the proposed method by assigning probability distributions to a MAL-based language. Finally, the resulting language is evaluated by modeling and simulating a known cyber attack.

show abstract

Section: Methods For Assigning Probability Distributionsmentioning

confidence: 99%

Section: Collect Information For Domain Under Assessmentmentioning

confidence: 99%

A Method for Assigning Probability Distributions in Attack Simulation Languages

Xiong

Hacks

Lagerström

2021

J. Complex Syst. Inform. Model. Q.

Self Cite

View full text Add to dashboard Cite

show abstract

“…Some researchers have investigated the combined use of threat modeling and attack simulations in domains such as energy [51] and vehicular IT [27,57]. CySeMoL [45] is a cyber security modeling language for enterprise-level system architectures; P 2 CySeMoL [19], which is further development of CySeMoL, is an attack graph tool for estimating the cyber security of EAs.…”

Section: Attack Simulationsmentioning

confidence: 99%

Cyber security threat modeling based on the MITRE Enterprise ATT&CK Matrix

et al. 2021

Self Cite

View full text Add to dashboard Cite

Enterprise systems are growing in complexity, and the adoption of cloud and mobile services has greatly increased the attack surface. To proactively address these security issues in enterprise systems, this paper proposes a threat modeling language for enterprise security based on the MITRE Enterprise ATT&CK Matrix. It is designed using the Meta Attack Language framework and focuses on describing system assets, attack steps, defenses, and asset associations. The attack steps in the language represent adversary techniques as listed and described by MITRE. This entity-relationship model describes enterprise IT systems as a whole; by using available tools, the proposed language enables attack simulations on its system model instances. These simulations can be used to investigate security settings and architectural changes that might be implemented to secure the system more effectively. Our proposed language is tested with a number of unit and integration tests. This is visualized in the paper with two real cyber attacks modeled and simulated.

show abstract

“…So far, several languages have been built in MAL. One example is vehicleLang (Katsikeas et al 2019), which allows modeling cyber-attacks on modern vehicles. Another example is coreLang, which contains the most common IT entities and attack steps and is included in the presentation of MAL (Johnson et al 2018).…”

Section: State Of the Artmentioning

confidence: 99%

powerLang: a probabilistic attack simulation language for the power domain

et al. 2020

Self Cite

View full text Add to dashboard Cite

Cyber-attacks these threats, the cyber security assessment of IT and OT infrastructures can foster a higher degree of safety and resilience against cyber-attacks. Therefore, the use of attack simulations based on system architecture models is proposed. To reduce the effort of creating new attack graphs for each system under assessment, domain-specific languages (DSLs) can be employed. DSLs codify the common attack logics of the considered domain.Previously, MAL (the Meta Attack Language) was proposed, which serves as a framework to develop DSLs and generate attack graphs for modeled infrastructures. In this article, powerLang as a MAL-based DSL for modeling IT and OT infrastructures in the power domain is proposed. Further, it allows analyzing weaknesses related to known attacks. To comprise powerLang, two existing MAL-based DSL are combined with a new language focusing on industrial control systems (ICS). Finally, this first version of the language was validated against a known cyber-attack.

show abstract

Probabilistic Modeling and Simulation of Vehicular Cyber Attacks: An Application of the Meta Attack Language

Cited by 23 publications

References 19 publications

A Method for Assigning Probability Distributions in Attack Simulation Languages

A Method for Assigning Probability Distributions in Attack Simulation Languages

Cyber security threat modeling based on the MITRE Enterprise ATT&CK Matrix

powerLang: a probabilistic attack simulation language for the power domain

Contact Info

Product

Resources

About