A Methodology of Security Pattern Classification and of Attack-Defense Tree Generation

Loukmen Regainia, Sébastien Salva

2017

Abstract

Security at the design stage of the software life cycle can be performed by means of security patterns, which are viable and reusable solutions to regular security problems. Their generic nature and growing number make their choice difficult though, even for experts in system design. To guide them through the appropriate choice of patterns, we present a methodology of security pattern classification and the classification itself, which exposes relationships among attacks, weaknesses and security patterns. Given an attack of the CAPEC (Common Attack Patterns Enumeration and Classification) database , the classification expresses the security pattern combinations that overcome the attack. The methodology, which generates the classification is composed of five steps, which decompose patterns and attacks into sets of more precise sub-properties that are associated. These steps provide the justifications of the classification and can be followed again to upgrade it. From the classification, we also generate Attack-Defense Trees (ADTtrees), which depict an attack, its sub-attacks and the related defenses in the form of security pattern combinations. Without loss of generality, this classification has been established for Web applications and covers 215 attacks, 136 software weaknesses and 26 security patterns.

Paper Citation

in Harvard Style

Regainia L. and Salva S. (2017). A Methodology of Security Pattern Classification and of Attack-Defense Tree Generation . In Proceedings of the 3rd International Conference on Information Systems Security and Privacy - Volume 1: ICISSP, ISBN 978-989-758-209-7, pages 136-146. DOI: 10.5220/0006198301360146

in Bibtex Style

@conference{icissp17,
author={Loukmen Regainia and Sébastien Salva},
title={A Methodology of Security Pattern Classification and of Attack-Defense Tree Generation},
booktitle={Proceedings of the 3rd International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,},
year={2017},
pages={136-146},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0006198301360146},
isbn={978-989-758-209-7},
}

in EndNote Style

TY - CONF
JO - Proceedings of the 3rd International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,
TI - A Methodology of Security Pattern Classification and of Attack-Defense Tree Generation
SN - 978-989-758-209-7
AU - Regainia L.
AU - Salva S.
PY - 2017
SP - 136
EP - 146
DO - 10.5220/0006198301360146