Despite more and more rigorous defense mechanisms in place for cyber-physical systems, cybercriminals are increasingly attacking systems for benefits using a variety of means including malware, phishing, ransomware, and denial of service. Cyberattacks could not only cause significant economic loss but also disastrous consequences for individuals and organizations. Therefore, it is advantageous to detect and fix potential cyber vulnerabilities before the system is fielded. To this end, this article presents a language, VERDICT, and a novel framework, Cyber Vulnerability Analysis Framework (CyVAF) to (i) define cyber threats and mitigation defenses based on system properties, (ii) detect cyber vulnerabilities of system architecture automatically, and also (iii) suggest mitigation defenses. VERDICT is developed as an annex to the Architecture Analysis and Design Language (AADL) but can also be used independently. It enables users to define customized cyber threats and defenses, as well as from known libraries such as Common Attack Pattern Enumeration and Classification (CAPEC) and National Institute of Standards and Technology Recommended Security Controls for Federal Information Systems and Organizations (NIST 800-53). CyVAF translates a core fragment of AADL model annotated with properties along with VERDICT threats to Alloy specifications, leverages Alloy Analyzer to check whether components of the system are susceptible to threats and suggest defenses. In this article, we describe the language—VERDICT—and the translation mappings in the framework and demonstrate the capability and effectiveness of CyVAF using an unmanned aerial vehicle (UAV) example.


    Zugriff

    Zugriff prüfen

    Verfügbarkeit in meiner Bibliothek prüfen

    Bestellung bei Subito €


    Exportieren, teilen und zitieren



    Titel :

    Security Threat Modeling and Automated Analysis for System Design


    Weitere Titelangaben:

    Sae Int. J. Transp. Cyber. and Privacy


    Beteiligte:
    Meng, Baoluo (Autor:in) / Durling, Michael (Autor:in) / Smith, William (Autor:in)


    Erscheinungsdatum :

    2021-04-29


    Format / Umfang :

    15 pages




    Medientyp :

    Aufsatz (Konferenz)


    Format :

    Print


    Sprache :

    Englisch




    Automated aircraft ground threat avoidance system

    KHATWA RATAN / B JAYASENTHILNATHAN | Europäisches Patentamt | 2017

    Freier Zugriff

    Comment - Security threat

    Online Contents | 2004


    UNMANNED AERIAL SYSTEM AUTOMATED THREAT ASSESSMENT

    VACEK JOSEPH JAMES | Europäisches Patentamt | 2021

    Freier Zugriff

    AUTOMATED AIRCRAFT GROUND THREAT AVOIDANCE SYSTEM

    KHATWA RATAN / B JAYASENTHILNATHAN | Europäisches Patentamt | 2016

    Freier Zugriff

    AUTOMATED AIRCRAFT GROUND THREAT AVOIDANCE SYSTEM

    KHATWA RATAN / B JAYASENTHILNATHAN | Europäisches Patentamt | 2020

    Freier Zugriff