Towards Secure Architecture-Based Adaptations

Abstract

As any software system, a self-adaptive system is subject to security threats. However, applying self-adaptation may introduce additional threats. So far, little research has been devoted to this important problem. In this paper, we propose an approach for vulnerability analysis of architecturebased adaptations in self-adaptive systems using threat modeling and analysis techniques. To this end, we specify components' vulnerabilities and the system architecture formally and generate an attack model that describes the attacker's strategies to attack the system by exploiting different types of vulnerabilities. We use a set of security metrics to quantitatively assess the security risks of adaptations based on the produced attack model which enables the system to consider security aspects while choosing an adaptation to apply to the system. We automate and incorporate our approach into the Rainbow framework, allowing secure architectural adaptations at runtime. To evaluate the effectiveness of our approach, we apply it on a simple document storage system and on the ZNN system.

AT-DIFC + : Toward Adaptive and Trust-Aware Decentralized Information Flow Control

“…Tun et al [25] propose an approach to specify adaptive security under partial environment knowledge that is dynamically updated, as more information becomes available at runtime. Khakpour et al [10] provide a method to perform security risk assessment on adaptations that considers dependencies of components vulnerabilities. Compared to the current work, (i) we combine information flow control and trust-based methods to enforce security that is a novel approach not present in any of the discussed work, (ii) we target distributed open systems with multiple feedback loops, where modules can specify their policies individually, and (iii) instead of adapting the underlying system, we adapt the structure and behavior of the superimposed trust architecture, which enables us to support a broader range of systems compared to the approaches above.…”

“…Let T m be the set of context pairs to be merged, T s be the set of contexts to be split and T i be the set of contexts to be isolated. We define the local utility function as Equation (10) where w 0 , w 1 , and w 2 are weights placed on each part of the plan based on the perceived importance of each of the merge, split and isolation actions, respectively. Weight assignment is domain specific and decided by the user.…”

“…(ii) We combine the identified operations into candidate plans. Each candidate is (iii) evaluated by one of the two utility functions (local or global) defined in Equation (10) and Equation (11). Finally, in (iv), the planner forwards the best fit the plan for enactment to j 9 .…”

A Survey of MulVAL Extensions and Their Attack Scenarios Coverage

“…In particular, they presented ARP spoofing and route hijacking scenarios. Khakpour et al [81] defined several rules for the exploitation and propagation of vulnerabilities. Inokuchi et al [82] proposed a methodical procedure for defining new interaction rules, and they applied the method to define four categories of behavior: privilege escalation, credential access, lateral movement, and execution.…”

Towards model co-evolution across self-adaptation steps for combined safety and security analysis

“…The approach of Khakpour et al [7] focuses on vulnerabilities of the system in transient states that occur especially during architecture-based adaptations. They manually add vulnerability information to the architecture description by utilizing Acme's properties of components.…”