kth.sePublications
Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
Development and validation of coreLang: A threat modeling language for the ICT domain
KTH, School of Electrical Engineering and Computer Science (EECS), Computer Science, Network and Systems Engineering.ORCID iD: 0000-0001-8287-3160
KTH, School of Electrical Engineering and Computer Science (EECS), Computer Science, Network and Systems Engineering.
KTH, School of Electrical Engineering and Computer Science (EECS), Computer Science, Network and Systems Engineering.ORCID iD: 0000-0003-3922-9606
KTH, School of Electrical Engineering and Computer Science (EECS), Computer Science, Network and Systems Engineering. Uppsala Univ, Dept Informat Technol, S-75236 Uppsala, Sweden..ORCID iD: 0000-0001-9886-6651
Show others and affiliations
2024 (English)In: Computers & security (Print), ISSN 0167-4048, E-ISSN 1872-6208, Vol. 146, article id 104057Article in journal (Refereed) Published
Abstract [en]

ICT infrastructures are getting increasingly complex, and defending them against cyber attacks is cumbersome. As cyber threats continue to increase and expert resources are limited, organizations must find more efficient ways to evaluate their resilience and take proactive measures. Threat modeling is an excellent method of assessing the resilience of ICT systems, for example, by building Attack Graphs that illustrate an adversary's attack vectors. Previously, the Meta Attack Language (MAL) was proposed, which serves as a framework to develop Domain Specific Languages (DSLs) and generate Attack Graphs for modeled infrastructures. coreLang is a MAL-based threat modeling language that utilizes Attack Graphs to enable attack simulations and security assessments. In this work, we present the first release version of coreLang in which MITRE ATT&CK tactics and techniques are mapped onto to serve as a validation and identify strengths and weaknesses to benefit the development cycle. Our validation showed that coreLang does cover 46% of all the techniques included in the matrix, while if we additionally exclude the tactics that are intrinsically not covered by coreLang and MAL, the coverage percentage increases to 64%.

Place, publisher, year, edition, pages
Elsevier BV , 2024. Vol. 146, article id 104057
Keywords [en]
Domain specific language, Attack graphs, Cyber attack modeling, Threat modeling, ICT domain
National Category
Computer Systems Computer Sciences
Identifiers
URN: urn:nbn:se:kth:diva-353785DOI: 10.1016/j.cose.2024.104057ISI: 001298046900001Scopus ID: 2-s2.0-85201461410OAI: oai:DiVA.org:kth-353785DiVA, id: diva2:1900520
Note

QC 20240924

Available from: 2024-09-24 Created: 2024-09-24 Last updated: 2024-09-24Bibliographically approved

Open Access in DiVA

No full text in DiVA

Other links

Publisher's full textScopus

Authority records

Katsikeas, SotiriosBuhaiu, AndreiEkstedt, MathiasAfzal, Zeeshan

Search in DiVA

By author/editor
Katsikeas, SotiriosBuhaiu, AndreiEkstedt, MathiasAfzal, ZeeshanMukherjee, Preetam
By organisation
Network and Systems Engineering
In the same journal
Computers & security (Print)
Computer SystemsComputer Sciences

Search outside of DiVA

GoogleGoogle Scholar

doi
urn-nbn

Altmetric score

doi
urn-nbn
Total: 68 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf