Security analysis of socio-technical physical systems. (October 2015)

• Record Type: Journal Article
• Authors: Lenzini, Gabriele; Mauw, Sjouke; Ouchani, Samir
• Is Part Of: Computers & electrical engineering. Volume 47(2015)
• Page Start: 258
• Page End: 274
• Publication Date: 2015-10
• Subjects: Socio-technical systems -- Security assessment -- Probabilistic verification -- Security model; Computer engineering -- Periodicals; Electrical engineering -- Periodicals; Electrical engineering -- Data processing -- Periodicals; Ordinateurs -- Conception et construction -- Périodiques; Électrotechnique -- Périodiques; Électrotechnique -- Informatique -- Périodiques; Computer engineering; Electrical engineering; Electrical engineering -- Data processing; Periodicals; Electronic journals; 621.302854
• DOI: 10.1016/j.compeleceng.2015.02.019
• Languages: English
• ISSNs: 0045-7906

Abstract

Abstract: Recent initiatives that evaluate the security of physical systems with objects as assets and people as agents – here called socio-technical physical systems – have limitations: their agent behavior is too simple, they just estimate feasibility and not the likelihood of attacks, or they do estimate likelihood but on explicitly provided attacks only. We propose a model that can detect and quantify attacks. It has a rich set of agent actions with associated probability and cost. We also propose a threat model, an intruder that can misbehave and that competes with honest agents. The intruder's actions have an associated cost and are constrained to be realistic. We map our model to a probabilistic symbolic model checker and we express templates of security properties in the Probabilistic Computation Tree Logic, thus supporting automatic analysis of security properties. A use case shows the effectiveness of our approach.