System security requirements analysis with answer set programming

Gideon Bibu*, Nobukazu Yoshioka, Julian Padget

*この研究の対応する著者

研究成果: Conference contribution

2 被引用数 (Scopus)

抄録

The need for early consideration of security during system design and development cannot be over-emphasized, since this allows security features to be properly integrated into the system rather than added as patches later on. A necessary pre-requisite is the elicitation and analysis of the security requirements prior to system design. Existing methods for the security requirements phase, such as attack trees and misuse case analysis, use manual means for analysis, with which it is difficult to validate and analyse system properties exhaustively. We present a computational solution to this problem using an institutional (also called normative) specification to capture the requirements in the InstAL action language, which in turn is implemented in answer set programming (a kind of logic programming language). The result of solving the answer set program with respect to a set of events is a set of traces that capture the evolution of the model over time (as defined by the occurrence of events). Verification is achieved by querying the traces for specific system properties. Using a simple scenario, we show how any state of the system can be verified with respect to the events that brought about that state. We also demonstrate how the same traces enable: (i) identification of possible times and causes of security breaches and (ii) establishment of possible consequences of security violations.

本文言語English
ホスト出版物のタイトル2012 2nd IEEE International Workshop on Requirements Engineering for Systems, Services, and Systems-of-Systems, RESS 2012 - Proceedings
ページ10-13
ページ数4
DOI
出版ステータスPublished - 2012
外部発表はい
イベント2012 2nd IEEE International Workshop on Requirements Engineering for Systems, Services, and Systems-of-Systems, RESS 2012 - Chicago, IL, United States
継続期間: 2012 9 252012 9 25

出版物シリーズ

名前2012 2nd IEEE International Workshop on Requirements Engineering for Systems, Services, and Systems-of-Systems, RESS 2012 - Proceedings

Conference

Conference2012 2nd IEEE International Workshop on Requirements Engineering for Systems, Services, and Systems-of-Systems, RESS 2012
国/地域United States
CityChicago, IL
Period12/9/2512/9/25

ASJC Scopus subject areas

  • ソフトウェア

フィンガープリント

「System security requirements analysis with answer set programming」の研究トピックを掘り下げます。これらがまとまってユニークなフィンガープリントを構成します。

引用スタイル