Abstract
System architects should use security models to gain insight into how different design choices impact the overall security of a system. However, it is often difficult for those who do not possess a security modeling background to construct such models. To overcome this challenge we present a case study that demonstrates a novel approach that uses an ontology-assisted model generator to automatically create ADVISE security models from intuitive hand-built system models. More specifically, we consider a case study of a hypothetical utility that wishes to select the most cost-effective of several different intrusion detection system approaches to defend its Advanced Metering Infrastructure (AMI) deployment. We construct an AMI-focused ontology that consists of system model elements, security model elements, and the mapping between the two. We then use the ontology in conjunction with the generator to create security models from a system model. Finally, we discuss the benefits of the use of the approach relative to previous approaches, including an explanation of how it significantly eases the burden of creating complex security models for users without prior security modeling experience.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Krishna, V.B., Lee, K., Weaver, G.A., Iyer, R.K., Sanders, W.H.: F-DETA: a framework for detecting electricity theft attacks in smart grids. In: 46th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, pp. 407–418 (2016)
Federal Bureau of investigation cyber intelligence section: smart grid electric meters altered to steal electricity (2010). http://krebsonsecurity.com/wp-content/uploads/2012/04/FBI-SmartMeterHack-285x305.png
Ford, M., Keefe, K., LeMay, E., Sanders, W., Muehrcke, C.: Implementing the ADVISE security modeling formalism in Möbius. In: Dependable Systems and Networks, 43rd Annual IEEE/IFIP International Conference on 2013. pp. 1–8. June 2013
Gellings, C.: Estimating the costs and benefits of the smart grid: a preliminary estimate of the investment requirements and the resultant benefits of a fully functioning smart grid. Technical report, Electric Power Research Institute, March 2011
Grochocki, D., et al.: AMI threats, intrusion detection requirements and deployment recommendations. In: Smart Grid Communications (SmartGridComm), IEEE Third International Conference on 2012, pp. 395–400. November 2012
Ivanova, M.G., Probst, C.W., Hansen, R.R., Kammüller, F.: Transforming Graphical System Models to Graphical Attack Models, pp. 82–96. Springer International Publishing, Cham (2016), https://doi.org/10.1007/978-3-319-29968-6_6
LeMay, E.: Adversary-driven state-based system security evaluation. Ph.D. thesis, University of Illinois at Urbana-Champaign, Urbana, Illinois (2011)
Ou, X., Boyer, W.F., McQueen, M.A.: A scalable approach to attack graph generation. In: Proceedings of the 13th ACM conference on Computer and communications security, pp. 336–345. ACM (2006)
Rausch, M.: Determining cost-effective intrusion detection approaches for an advanced metering infrastructure deployment using ADVISE. Master’s thesis, University of Illinois at Urbana-Champaign (2016)
Rausch, M., Feddersen, B., Keefe, K., Sanders, W.H.: A comparison of different intrusion detection approaches in an advanced metering infrastructure network using ADVISE, vol. 9826, pp. 279–294. Springer International Publishing (2016), https://doi.org/10.1007/978-3-319-43425-4_19
Setalvad, A.: Demand to fill cybersecurity jobs booming, March 2015. http://peninsulapress.com/2015/03/31/cybersecurity-jobs-growth/
Sheyner, O., Haines, J., Jha, S., Lippmann, R., Wing, J.M.: Automated generation and analysis of attack graphs. In: Proceedings Security and privacy, 2002 IEEE Symposium on 2002, pp. 273–284. IEEE (2002)
Möbius team: Möbius documentation. University of Illinois at Urbana-Champaign, Urbana, IL (2014), https://www.mobius.illinois.edu/wiki/
Verendel, V.: Quantified security is a weak hypothesis: a critical survey of results and assumptions. In: Proceedings of the 2009 Workshop on New Security Paradigms Workshop, pp. 37–50. NSPW 2009, ACM, New York, NY, USA (2009). https://doi.org/10.1145/1719030.1719036
Acknowledgments
The work described here was performed, in part, with funding from the Maryland Procurement Office under Contract No. H98230-14-C-0141. The authors would like to thank Jenny Applequist for her editorial assistance.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2018 Springer Nature Switzerland AG
About this paper
Cite this paper
Rausch, M., Keefe, K., Feddersen, B., Sanders, W.H. (2018). Automatically Generating Security Models from System Models to Aid in the Evaluation of AMI Deployment Options. In: D'Agostino, G., Scala, A. (eds) Critical Information Infrastructures Security. CRITIS 2017. Lecture Notes in Computer Science(), vol 10707. Springer, Cham. https://doi.org/10.1007/978-3-319-99843-5_14
Download citation
DOI: https://doi.org/10.1007/978-3-319-99843-5_14
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-99842-8
Online ISBN: 978-3-319-99843-5
eBook Packages: Computer ScienceComputer Science (R0)