Model-based Security Metrics Using ADversary VIew Security Evaluation (ADVISE)

TLDR

System architects need quantitative security metrics that reveal weak points in system defense by considering both system characteristics and adversary behavior. The authors formally define ADVISE to provide such metrics, enabling architects to compare architecture variants and analyze threats posed by different adversaries. ADVISE builds an executable state‑based security model of the system and an adversary, using a decision function that mimics attack preferences and looks ahead several steps, and is implemented in a tool that automates model generation. The feasibility and benefits of ADVISE are demonstrated through a case study.

Abstract

System architects need quantitative security metrics to make informed trade-off decisions involving system security. The security metrics need to provide insight on weak points in the system defense, considering characteristics of both the system and its adversaries. To provide such metrics, we formally define the ADversary View Security Evaluation (ADVISE) method. Our approach is to create an executable state-based security model of a system and an adversary that represents how the adversary is likely to attack the system and the results of such an attack. The attack decision function uses information about adversary attack preferences and possible attacks against the system to mimic how the adversary selects the most attractive next attack step. The adversary's decision involves looking ahead some number of attack steps. System architects can use ADVISE to compare the security strength of system architecture variants and analyze the threats posed by different adversaries. We demonstrate the feasibility and benefits of ADVISE using a case study. To produce quantitative model-based security metrics, we have implemented the ADVISE method in a tool that facilitates user input of system and adversary data and automatically generates executable models.