System security requirements analysis with answer set programming

G. Bibu, N. Yoshioka, J. Padget

Research output: Chapter in Book/Report/Conference proceedingConference contribution

2 Citations (Scopus)

Abstract

The need for early consideration of security during system design and development cannot be over-emphasized, since this allows security features to be properly integrated into the system rather than added as patches later on. A necessary pre-requisite is the elicitation and analysis of the security requirements prior to system design. Existing methods for the security requirements phase, such as attack trees and misuse case analysis, use manual means for analysis, with which it is difficult to validate and analyse system properties exhaustively. We present a computational solution to this problem using an institutional (also called normative) specification to capture the requirements in the InstAL action language, which in turn is implemented in answer set programming (a kind of logic programming language). The result of solving the answer set program with respect to a set of events is a set of traces that capture the evolution of the model over time (as defined by the occurrence of events). Verification is achieved by querying the traces for specific system properties. Using a simple scenario, we show how any state of the system can be verified with respect to the events that brought about that state. We also demonstrate how the same traces enable: (i) identification of possible times and causes of security breaches and (ii) establishment of possible consequences of security violations.
Original languageEnglish
Title of host publication2012 2nd IEEE International Workshop on Requirements Engineering for Systems, Services, and Systems-of-Systems, RESS 2012 - Proceedings
PublisherIEEE
Pages10-13
Number of pages4
DOIs
Publication statusPublished - 2012
Event2012 2nd IEEE International Workshop on Requirements Engineering for Systems, Services, and Systems-of-Systems - Chicago, USA United States
Duration: 24 Sep 201224 Sep 2012

Conference

Conference2012 2nd IEEE International Workshop on Requirements Engineering for Systems, Services, and Systems-of-Systems
CountryUSA United States
CityChicago
Period24/09/1224/09/12

Fingerprint Dive into the research topics of 'System security requirements analysis with answer set programming'. Together they form a unique fingerprint.

  • Cite this

    Bibu, G., Yoshioka, N., & Padget, J. (2012). System security requirements analysis with answer set programming. In 2012 2nd IEEE International Workshop on Requirements Engineering for Systems, Services, and Systems-of-Systems, RESS 2012 - Proceedings (pp. 10-13). IEEE. https://doi.org/10.1109/RES4.2012.6347689