Threat Modeling Revisited: Improving Expressiveness of Attack
Liverpool(2008)
Abstract
Threat modeling plays an important role in the deployment of optimal security controls and a number of threat modeling techniques have been proposed. However, most of the existing techniques lack adequate semantics and expressiveness. This paper reviews the existing techniques and proposes threat net; a technique based on information and causality theory concepts which offers improved expressiveness and semantics of threat models. Threat Net is built on Petri nets and treats every node in the threat path as a random variable, whose values include time specific attacker profile and system defense capabilities. In theory, by computing the expected value of random events one can estimate the cost of achieving a given goal. We believe that the simplicity and richness of our technique will make it attractive to security experts. In future we hope to validate threat net using case-based analysis theory.
MoreTranslated text
Key words
petri net,existing technique,threat modeling technique,threat-centric,attack-centric,improving expressiveness,causality theory concept,semantics,threat path,threat modeling revisited,petri nets,threat modeling,expressiveness,threat net,case-based analysis theory,optimal security control,threat model,adequate semantics,security,random variable,information theory,visualization,fault trees,use case,cognition,computational modeling
AI Read Science
Must-Reading Tree
Example
![](https://originalfileserver.aminer.cn/sys/aminer/pubs/mrt_preview.jpeg)
Generate MRT to find the research sequence of this paper
Chat Paper
Summary is being generated by the instructions you defined