Quantitative questions on attack: defense trees

  • Authors:
  • Barbara Kordy;Sjouke Mauw;Patrick Schweitzer

  • Affiliations:
  • SnT, University of Luxembourg, Luxembourg;SnT, University of Luxembourg, Luxembourg;SnT, University of Luxembourg, Luxembourg

  • Venue:
  • ICISC'12 Proceedings of the 15th international conference on Information Security and Cryptology
  • Year:
  • 2012

Quantified Score

Hi-index 0.00

Visualization

Abstract

Attack---defense trees are a novel methodology for graphical security modeling and assessment. The methodology includes intuitive and formal components that can be used for quantitative analysis of attack---defense scenarios. In practice, we use intuitive questions to ask about aspects of scenarios we are interested in. Formally, a computational procedure, using a bottom-up algorithm, is applied to derive the corresponding numerical values. This paper bridges the gap between the intuitive and the formal way of quantitatively assessing attack---defense scenarios. We discuss how to properly specify a question, so that it can be answered unambiguously. Given a well-specified question, we then show how to derive an appropriate attribute domain which constitutes the corresponding formal model.