lnu.sePublications
Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
Design and Implementation of Self-Protecting Systems: A Formal Approach
Linnaeus University, Faculty of Technology, Department of computer science and media technology (CM). (PROSSES;ERES)ORCID iD: 0000-0002-5057-2790
Linnaeus University, Faculty of Technology, Department of computer science and media technology (CM). (PROSSES;ERES)ORCID iD: 0000-0002-0377-5595
2021 (English)In: Future Generation Computer Systems, ISSN 0167-739X, E-ISSN 1872-7115, Vol. 115, p. 421-437Article in journal (Refereed) Published
Sustainable development
SDG 9: Build resilient infrastructure, promote inclusive and sustainable industrialization, and foster innovation
Abstract [en]

As threats to computer security become more common, complex and frequent, systems that canautomatically protect themselves from attacks are imminently needed. In this paper, we proposea formal approach to achieve self-protection by performing security analysis on self-adaptive systems, taking the adaptation process into account. We use probabilistic model checking to quantitatively analyze adaptation security, rank the strategies available and select the most secure one to apply in the system. We have incorporated our approach in Rainbow which is a framework to develop architecture-based self-adaptive systems.To evaluate our approach's effectiveness, we applied it on two  case studies: a simple document storage system and ZNN, a well known self-adaptive exemplar. The results show that applying our approachcan guarantee a reasonable degree of security, both during and after adaptation.

Place, publisher, year, edition, pages
Elsevier, 2021. Vol. 115, p. 421-437
Keywords [en]
Self-Protection, Self-Adaptive Systems, Formal Security Analysis, Model Checking, Adaptive Security
National Category
Computer Sciences
Research subject
Computer and Information Sciences Computer Science, Computer Science
Identifiers
URN: urn:nbn:se:lnu:diva-98075DOI: 10.1016/j.future.2020.09.005ISI: 000591438900011Scopus ID: 2-s2.0-85092115590OAI: oai:DiVA.org:lnu-98075DiVA, id: diva2:1468023
Projects
PROSSES
Funder
Knowledge FoundationAvailable from: 2020-09-16 Created: 2020-09-16 Last updated: 2024-09-04Bibliographically approved
In thesis
1. Design and Analysis of Self-protection: Adaptive Security for Software-Intensive Systems
Open this publication in new window or tab >>Design and Analysis of Self-protection: Adaptive Security for Software-Intensive Systems
2020 (English)Licentiate thesis, comprehensive summary (Other academic)
Abstract [en]

Today’s software landscape features a high degree of complexity, frequent changes in requirements and stakeholder goals, and uncertainty. Uncertainty and high complexity imply a threat landscape where cybersecurity attacks are a common occurrence, while their consequences are often severe. Self-adaptive systems have been proposed to mitigate the complexity and frequent degree of change by adapting at run-time to deal with situations not known at design time. They, however, are not immune to attacks, as they themselves suffer from high degrees of complexity and uncertainty. Therefore, systems that can dynamically defend themselves from adversaries are required. Such systems are called self-protecting systems and aim to identify, analyse and mitigate threats autonomously. This thesis contributes two approaches towards the goal of providing systems with self-protection capabilities.

The first approach aims to enhance the security of architecture-based selfadaptive systems and equip them with (proactive) self-protection capabilities that reduce the exposed attack surface. We target systems where information about the system components and its adaptation decisions is available, and control over its adaptation is also possible. We formally model the security of the system and provide two methods to analyze its security that help us rank adaptations in terms of their security level: a method based on quantitative risk assessment and a method based on probabilistic verification. The results indicate an improvement to the system security when either of our solutions is employed. However, only the second method can provide self-protecting capabilities. We have identified a direct relationship between security and performance overhead, i.e., higher security guarantees impose analogously higher performance overhead.

The second approach targets open decentralized systems where we have limited information about and control over the system entities. Therefore, we attempt to employ decentralized information flow control mechanisms to enforce security by controlling interactions among the system elements. We extend a classical decentralized information flow control model by incorporating trust and adding adaptation capabilities that allow the system to identify security threats and self-organize to maximize the average trust between the system entities. We arrange entities of the system in trust hierarchies that enforce security policies among their elements and can mitigate security issues raised by the openness and uncertainty in the context and environment, without the need for a trusted central controller. The experiment results show that a reasonable level of trust can be achieved and at the same time confidentiality and integrity can be enforced with a low impact on the throughput and latency of messages exchanged in the system.

Place, publisher, year, edition, pages
Växjö: Linnaeus University Press, 2020. p. 122
Series
Lnu Licentiate ; 32
Keywords
Self-Protection, Security Analysis, Self-Adaptation
National Category
Computer Sciences
Research subject
Computer and Information Sciences Computer Science, Computer Science
Identifiers
urn:nbn:se:lnu:diva-99109 (URN)978-91-89283-22-0 (ISBN)978-91-89283-23-7 (ISBN)
Presentation
2020-12-16, Newton, Hus C, Växjö, 10:00 (English)
Opponent
Supervisors
Available from: 2020-12-02 Created: 2020-12-01 Last updated: 2024-08-28Bibliographically approved
2. Design and Analysis of Self-protection: Adaptive Security for Software Systems
Open this publication in new window or tab >>Design and Analysis of Self-protection: Adaptive Security for Software Systems
2023 (English)Doctoral thesis, comprehensive summary (Other academic)
Abstract [en]

Today's software landscape features a high degree of complexity, frequent changes in requirements and stakeholder goals, and uncertainty.Uncertainty and high complexity imply a threat landscape where cybersecurity attacks are a common occurrence while their consequences are often severe. Self-adaptive systems have been proposed to mitigate the complexity and frequent changes by adapting at run-time to deal with situations not known at design time.Self-adaptive systems that aim to identify, analyse and mitigate threats autonomously are called self-protecting systems.This thesis contributes approaches towards developing systems with self-protection capabilities under two perspectives.

Under the first perspective, we enhance the security of component-based systems and equip them with self-protection capabilities that reduce the exposedattack surface or provide efficient defenses against identified attacks. We target systems where information about the system components and the adaptationdecisions is available, and  control over the adaptation is possible. We employ runtime threat modeling and analysis using quantitative risk analysis and probabilistic verification to rank adaptations to be applied in the system in terms of their security levels.  We then introduce modular and incremental verification approaches to tackle the scalability issues of probabilistic verification to be able to analyze larger-scale software systems.To protect against cyberattacks that cannot be mitigated by reducing the exposed attack surface, we propose an approach to analyze the security of different software architectures incorporating countermeasures to decide on the most suitable ones to evolve to.

Under the second perspective, we study open decentralized systems where we have limited information about and limited control over the system entities. We employ decentralized information flow control mechanisms to enforce security by controlling the interactions among the system elements.We extend decentralized information flow control by incorporating trust and adding adaptationcapabilities that allow the system to identify security threats and self-organize to maximize trust between the system entities.

Place, publisher, year, edition, pages
Växjö: Linnaeus University Press, 2023. p. 258
Series
Linnaeus University Dissertations ; 497
Keywords
Security Analysis, Self-Protection, Self-adaptive Systems, Verification, Information Flow Control, Risk Assessment
National Category
Computer Sciences
Research subject
Computer and Information Sciences Computer Science, Computer Science
Identifiers
urn:nbn:se:lnu:diva-121777 (URN)10.15626/LUD.497.2023 (DOI)9789180820479 (ISBN)9789180820486 (ISBN)
Public defence
2023-08-18, Weber, Hus K, Växjö, 13:00 (English)
Opponent
Supervisors
Available from: 2023-06-14 Created: 2023-06-13 Last updated: 2024-03-26Bibliographically approved

Open Access in DiVA

No full text in DiVA

Other links

Publisher's full textScopus

Authority records

Skandylas, CharilaosKhakpour, Narges

Search in DiVA

By author/editor
Skandylas, CharilaosKhakpour, Narges
By organisation
Department of computer science and media technology (CM)
In the same journal
Future Generation Computer Systems
Computer Sciences

Search outside of DiVA

GoogleGoogle Scholar

doi
urn-nbn

Altmetric score

doi
urn-nbn
Total: 750 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf