A Probabilistic Framework for Security Scenarios with Dependent Actions

Barbara Kordy (1, 2, 3) , Marc Pouly (4) , Patrick Schweitzer (3)

1 INSA Rennes - Institut National des Sciences Appliquées - Rennes
2 CELTIQUE - Software certification with semantic analysis
3 University of Luxembourg [Luxembourg]
4 EPFL - Ecole Polytechnique Fédérale de Lausanne

This work addresses the growing need of performing meaningful probabilistic analysis of security. We propose a framework that integrates the graphical security modeling technique of attack–defense trees with probabilistic information expressed in terms of Bayesian networks. This allows us to perform probabilistic evaluation of attack–defense scenarios involving dependent actions. To improve the efficiency of our computations, we make use of inference algorithms from Bayesian networks and encoding techniques from constraint reasoning. We discuss the algebraic theory underlying our framework and point out several generalizations which are possible thanks to the use of semiring theory.

Mots clés: attack trees; Bayesian networks; dependent actions; quantitative analysis of security; probability computation; semiring theory; attack-defense trees; security; AI

Domaines: Informatique [cs]

Barbara Kordy, Marc Pouly, Patrick Schweitzer. A Probabilistic Framework for Security Scenarios with Dependent Actions. Integrated Formal Methods, Sep 2014, Bertinoro, Italy. pp.256 - 271, ⟨10.1007/978-3-319-10181-1_16⟩. ⟨hal-01093276⟩