Attack Tree Generation by Policy Invalidation - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2015

Attack Tree Generation by Policy Invalidation

Résumé

Attacks on systems and organisations increasingly exploit human actors, for example through social engineering, complicating their formal treatment and automatic identification. Formalisation of human behaviour is difficult at best, and attacks on socio-technical systems are still mostly identified through brainstorming of experts. In this work we formalize attack tree generation including human factors; based on recent advances in system models we develop a technique to identify possible attacks analytically, including technical and human factors. Our systematic attack generation is based on invalidating policies in the system model by identifying possible sequences of actions that lead to an attack. The generated attacks are precise enough to illustrate the threat, and they are general enough to hide the details of individual steps.
Fichier principal
Vignette du fichier
978-3-319-24018-3_16_Chapter.pdf (296.17 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-01442547 , version 1 (20-01-2017)

Licence

Paternité

Identifiants

Citer

Marieta Georgieva Ivanova, Christian W. Probst, René Rydhof Hansen, Florian Kammüller. Attack Tree Generation by Policy Invalidation. 9th Workshop on Information Security Theory and Practice (WISTP), Aug 2015, Heraklion, Crete, Greece. pp.249-259, ⟨10.1007/978-3-319-24018-3_16⟩. ⟨hal-01442547⟩
85 Consultations
78 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More