State space approach to security quantification

Christopher Griffin, Bharat Madan, Kishor Trivedi

Research output: Chapter in Book/Report/Conference proceedingConference contribution

4 Scopus citations

Abstract

In this paper, we describe three different state space models for analyzing the security of a software system. In the first part of this paper, we utilize a semi-Markov Process (SMP) to model the transitions between the security states of an abstract software system. The SMP model can be solved to obtain the probability of reaching security failed states along with the mean-time to security failure (MTTSF). In the second part of the paper, we use a discrete event dynamic system model of security dynamics. We show how to derive events and transitions from existing security taxonomies. We then apply theory of discrete event control to define safety properties of the computer system in terms of the basic concepts of controllability used in discrete event control for two special sublanguages KS and KV. These languages correspond to maximally robust controllable sub-languages. In the third approach, we show that by associating cost with the state transitions, the security quantification problem can be casted as Markov decision problem (MDP). This MDP can be solved to obtain an optimal controllable language K S* ⊆Ks the gives the minimal cost safe security policy.

Original languageEnglish (US)
Title of host publicationProceedings of the 29th Annual International Computer Software and Applications Conference - Workshops and Fast Abstracts, COMPSAC 2005
Pages83-88
Number of pages6
DOIs
StatePublished - Dec 1 2005
Event29th Annual International Computer Software and Applications Conference, COMPSAC 2005 - Edinburgh, Scotland, United Kingdom
Duration: Jul 26 2005Jul 28 2005

Publication series

NameProceedings - International Computer Software and Applications Conference
Volume2
ISSN (Print)0730-3157

Conference

Conference29th Annual International Computer Software and Applications Conference, COMPSAC 2005
CountryUnited Kingdom
CityEdinburgh, Scotland
Period7/26/057/28/05

All Science Journal Classification (ASJC) codes

  • Software
  • Computer Science Applications

Fingerprint Dive into the research topics of 'State space approach to security quantification'. Together they form a unique fingerprint.

Cite this