kth.sePublications KTH
Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
A Meta Language for Threat Modeling and Attack Simulations
KTH, School of Electrical Engineering and Computer Science (EECS), Computer Science, Network and Systems Engineering.
KTH, School of Electrical Engineering and Computer Science (EECS), Computer Science, Network and Systems Engineering.ORCID iD: 0000-0003-3089-3885
KTH, School of Electrical Engineering and Computer Science (EECS), Computer Science, Network and Systems Engineering.
2018 (English)In: ACM International Conference Proceeding Series, 2018Conference paper, Published paper (Refereed)
Abstract [en]

Attack simulations may be used to assess the cyber security of systems. In such simulations, the steps taken by an attacker in order to compromise sensitive system assets are traced, and a time estimate may be computed from the initial step to the compromise of assets of interest. Attack graphs constitute a suitable formalism for the modeling of attack steps and their dependencies, allowing the subsequent simulation. To avoid the costly proposition of building new attack graphs for each system of a given type, domain-specific attack languages may be used. These languages codify the generic attack logic of the considered domain, thus facilitating the modeling, or instantiation, of a specific system in the domain. Examples of possible cyber security domains suitable for domain-specific attack languages are generic types such as cloud systems or embedded systems but may also be highly specialized kinds, e.g. Ubuntu installations; the objects of interest as well as the attack logic will differ significantly between such domains. In this paper, we present the Meta Attack Language (MAL), which may be used to design domain-specific attack languages such as the aforementioned. The MAL provides a formalism that allows the semi-automated generation as well as the efficient computation of very large attack graphs. We declare the formal background to MAL, define its syntax and semantics, exemplify its use with a small domain-specific language and instance model, and report on the computational performance.

Place, publisher, year, edition, pages
2018.
National Category
Software Engineering
Identifiers
URN: urn:nbn:se:kth:diva-230940DOI: 10.1145/3230833.3232799ISI: 000477981800075Scopus ID: 2-s2.0-85055265185OAI: oai:DiVA.org:kth-230940DiVA, id: diva2:1220399
Conference
International Workshop on Cyber Threat Intelligence (WCTI 2018) in conjunct. with the International Conference on Availability, Reliability and Security (ARES 2018)
Funder
StandUp
Note

QC 20180620

Available from: 2018-06-18 Created: 2018-06-18 Last updated: 2024-03-15Bibliographically approved

Open Access in DiVA

No full text in DiVA

Other links

Publisher's full textScopusConference webpage

Authority records

Johnson, PontusLagerström, RobertEkstedt, Mathias

Search in DiVA

By author/editor
Johnson, PontusLagerström, RobertEkstedt, Mathias
By organisation
Network and Systems Engineering
Software Engineering

Search outside of DiVA

GoogleGoogle Scholar

doi
urn-nbn

Altmetric score

doi
urn-nbn
Total: 1449 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf