A Methodology of Security Pattern Classification and of Attack-Defense Tree Generation

Loukmen Regainia, Sébastien Salva

Abstract

Security at the design stage of the software life cycle can be performed by means of security patterns, which are viable and reusable solutions to regular security problems. Their generic nature and growing number make their choice difficult though, even for experts in system design. To guide them through the appropriate choice of patterns, we present a methodology of security pattern classification and the classification itself, which exposes relationships among attacks, weaknesses and security patterns. Given an attack of the CAPEC (Common Attack Patterns Enumeration and Classification) database , the classification expresses the security pattern combinations that overcome the attack. The methodology, which generates the classification is composed of five steps, which decompose patterns and attacks into sets of more precise sub-properties that are associated. These steps provide the justifications of the classification and can be followed again to upgrade it. From the classification, we also generate Attack-Defense Trees (ADTtrees), which depict an attack, its sub-attacks and the related defenses in the form of security pattern combinations. Without loss of generality, this classification has been established for Web applications and covers 215 attacks, 136 software weaknesses and 26 security patterns.

References

  1. Alvi, A. K. and Zulkernine, M. (2011). A Natural Classification Scheme for Software Security Patterns. 2011 IEEE Ninth International Conference on Dependable, Autonomic and Secure Computing, pages 113-120.
  2. Alvi, Aleem, K. and Zulkernine, M. (2012). A Comparative Study of Software Security Pattern Classifications. 2012 Seventh International Conference on Availability, Reliability and Security, pages 582-589.
  3. Anand, P., Ryoo, J., and Kazman, R. (2014). VulnerabilityBased Security Pattern Categorization in Search of Missing Patterns. 2014 Ninth International Conference on Availability, Reliability and Security, pages 476-483.
  4. Bunke, M., Koschke, R., and Sohr, K. (2012). Organizing security patterns related to security and pattern recognition requirements. International Journal on Advances in Security, 5.
  5. Fernandez, E. B. (2007). Security patterns and secure systems design.
  6. Fernandez, E. B., Washizaki, H., Yoshioka, N., Kubo, A., and Fukazawa, Y. (2008). Classifying security patterns. In Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), volume 4976 LNCS, pages 342-347.
  7. Harb, D., Bouhours, C., and Leblanc, H. (2009). Using an Ontology to Suggest Software Design Patterns Integration, pages 318-331. Springer Berlin Heidelberg, Berlin, Heidelberg.
  8. Kordy, B., Kordy, P., Mauw, S., and Schweitzer, P. (2013). ADTool: Security Analysis with Attack-Defense Trees , pages 173-176. Springer Berlin Heidelberg, Berlin, Heidelberg.
  9. Kordy, B., Mauw, S., Radomirovic, S., and Schweitzer, P. (2012). Attack-Defense Trees. Journal of Logic and Computation, page exs029.
  10. Mitre corporation (2015a). Common attack pattern enumeration and classification, url:https://capec.mitre.org/.
  11. Mitre corporation (2015b). Common weakness enumeration, url:https://cwe.mitre.org/.
  12. Regainia, L. (2016). Attack defence trees generator, url:http://regainia.com/adtreegen.zip.
  13. Regainia, L., Salva, S., and Bouhours, C. (2016a). A classification methodology for security patterns to help fix software weaknesses. In Proceedings of the 13th ACS/IEEE International Conference on Computer Systems and Applications AICCSA.
  14. Regainia, L., Salva, S., and Bouhours, (2016b). Security pattern classification http://regainia.com/research/database.html.
  15. Rodriguez, E. (2003). Security Design Patterns, volume 49.
  16. Schneier, B. (1999). Attack trees: threats. Dr. Dobb's journal.
  17. Schumacher, M. and Roedig, U. (2001). Security Engineering with Patterns. Engineering, 2754:1-208.
  18. Slavin, R. and Niu, J. (2016). Security patterns repository, url: http://sefm.cs.utsa.edu/repository/.
  19. Tøndel, I. A., Jensen, J., and Røstad, L. (2010). Combining misuse cases with attack trees and security activity models. In Availability, Reliability, and Security, 2010. ARES'10 International Conference on, pages 438-445. IEEE.
  20. Uzunov, A. V. and Fernandez, E. B. (2014). An extensible pattern-based library and taxonomy of security threats for distributed systems. Computer Standards & Interfaces, 36(4):734-747.
  21. Wiesauer, A. and Sametinger, J. (2009). A security design pattern taxonomy based on attack patterns. In International Joint Conference on e-Business and Telecommunications, pages 387-394.
  22. Yskout, K., Heyman, T., Scandariato, R., and Joosen, W. (2006). A system of security patterns.
  23. Yskout, K., Scandariato, R., and Joosen, W. (2012). Does organizing security patterns focus architectural choices? Proceedings - International Conference on Software Engineering, pages 617-627.
Download


Paper Citation


in Harvard Style

Regainia L. and Salva S. (2017). A Methodology of Security Pattern Classification and of Attack-Defense Tree Generation . In Proceedings of the 3rd International Conference on Information Systems Security and Privacy - Volume 1: ICISSP, ISBN 978-989-758-209-7, pages 136-146. DOI: 10.5220/0006198301360146


in Bibtex Style

@conference{icissp17,
author={Loukmen Regainia and Sébastien Salva},
title={A Methodology of Security Pattern Classification and of Attack-Defense Tree Generation},
booktitle={Proceedings of the 3rd International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,},
year={2017},
pages={136-146},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0006198301360146},
isbn={978-989-758-209-7},
}


in EndNote Style

TY - CONF
JO - Proceedings of the 3rd International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,
TI - A Methodology of Security Pattern Classification and of Attack-Defense Tree Generation
SN - 978-989-758-209-7
AU - Regainia L.
AU - Salva S.
PY - 2017
SP - 136
EP - 146
DO - 10.5220/0006198301360146