System security requirements analysis with answer set programming

Gideon Bibu*, Nobukazu Yoshioka, Julian Padget

*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceedingConference contribution

2 Citations (Scopus)

Abstract

The need for early consideration of security during system design and development cannot be over-emphasized, since this allows security features to be properly integrated into the system rather than added as patches later on. A necessary pre-requisite is the elicitation and analysis of the security requirements prior to system design. Existing methods for the security requirements phase, such as attack trees and misuse case analysis, use manual means for analysis, with which it is difficult to validate and analyse system properties exhaustively. We present a computational solution to this problem using an institutional (also called normative) specification to capture the requirements in the InstAL action language, which in turn is implemented in answer set programming (a kind of logic programming language). The result of solving the answer set program with respect to a set of events is a set of traces that capture the evolution of the model over time (as defined by the occurrence of events). Verification is achieved by querying the traces for specific system properties. Using a simple scenario, we show how any state of the system can be verified with respect to the events that brought about that state. We also demonstrate how the same traces enable: (i) identification of possible times and causes of security breaches and (ii) establishment of possible consequences of security violations.

Original languageEnglish
Title of host publication2012 2nd IEEE International Workshop on Requirements Engineering for Systems, Services, and Systems-of-Systems, RESS 2012 - Proceedings
Pages10-13
Number of pages4
DOIs
Publication statusPublished - 2012
Externally publishedYes
Event2012 2nd IEEE International Workshop on Requirements Engineering for Systems, Services, and Systems-of-Systems, RESS 2012 - Chicago, IL, United States
Duration: 2012 Sep 252012 Sep 25

Publication series

Name2012 2nd IEEE International Workshop on Requirements Engineering for Systems, Services, and Systems-of-Systems, RESS 2012 - Proceedings

Conference

Conference2012 2nd IEEE International Workshop on Requirements Engineering for Systems, Services, and Systems-of-Systems, RESS 2012
Country/TerritoryUnited States
CityChicago, IL
Period12/9/2512/9/25

Keywords

  • answer set programming
  • security requirements
  • verification

ASJC Scopus subject areas

  • Software

Fingerprint

Dive into the research topics of 'System security requirements analysis with answer set programming'. Together they form a unique fingerprint.

Cite this