Skip to main content
SpringerLink
Log in

A Strategy for Structuring and Formalising Attack Patterns

  • Chapter
  • First Online:
Cyberpatterns

Abstract

We have created a framework for modelling security that divides computer incidents into their stages of access, use and effect. In addition, we have developed a three-layer architectural model to examine incidents with the social, logical and physical levels. Our ontology that combines the architectural and incident models provides the basis for a suitable semantics for attack patterns, where the entities and relationships between them can be precisely defined. The current informality of these patterns means that their utility is limited to manual use, so we plan to adapt existing work on formalising design patterns to attack patterns, to aid the detection of attack patterns leading to the possible creation of effective defensive controls. A specification in logic, which is progressively refined into code, is a common method of developing high integrity and secure software, but there are additional issues in system protection, as the system is a diverse set of components housing different and unrelated functionality rather than a single program. The attack patterns form a logical specification, which can be intersected with the model of the defence to determine the corresponding defensive observations and actions to counter the attacks. This would allow convincing reasoning about possible defensive response measures, and holds out the possibility of proving security against certain types of attacks. We outline a roadmap for formulating attack patterns in our ontology and then translating them in logic.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
eBook
USD 16.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Hardcover Book
USD 54.99
Price excludes VAT (USA)
  • Durable hardcover edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Blackwell C. A security ontology for incident analysis. In: 6th Cyber security and information intelligence research workshop. New York: ACM press; 2010.

    Google Scholar 

  2. Blackwell C. A Framework for investigative questioning in incident analysis and response. In: 7th IFIP WG 11.9 International conference on digital forensics. Springer Advances in Digital Forensics VII; 2011.

    Google Scholar 

  3. Howard M. Attack surface: mitigate security risks by minimizing the code you expose to untrusted users. MSDN magazine; 2004. http://msdn.microsoft.com/en-us/magazine/cc163882.aspx. Accessed 23 Sept 2013.

  4. Blackwell C. A forensic framework for incident analysis applied to the insider threat. In: 3rd ICST international conference on digital forensics and cyber crime. Berlin: Springer; 2011.

    Google Scholar 

  5. Howard JD. An analysis of security incidents on the internet, 1989–1995. PhD thesis. Carnegie-Mellon University. 1997. www.cert.org/archive/pdf/JHThesis.pdfy. Accessed 23 Sept 2013.

  6. Howard JD, Longstaff TA. A common language for computer security incidents. Sandia National Laboratories; 1998. http://www.cert.org/research/taxonomy_988667.pdf.Accessed 23 Sept 2013.

  7. Schneier B. Attack trees: modeling security threats. Dr. Dobb’s J; 1999.

    Google Scholar 

  8. Hutchins EM, Cloppert MJ, Amin RM. Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains. In: 6th Annual international conference on information warfare and security, Washington, DC; 2011. www.lockheedmartin.com/content/dam/lockheed/data/corporate/documents/LM-White-Paper-Intel-Driven-Defense.pdf. Accessed 23 Sept 2013.

    Google Scholar 

  9. Whittaker JA, Thompson HH. How to break software security. Boston, MA: Addison Wesley; 2001.

    Google Scholar 

  10. Zachman J. A framework for information systems architecture. IBM Syst J. 1987;26(3).

    Google Scholar 

  11. Sherwood J, Clark A, Lynas D. Enterprise security architecture, a business driven approach. San Francisco: CMP Books; 2005.

    Google Scholar 

  12. Hafiz M, Adamczyk P, Johnson RE. Organising security patterns. IEEE Softw. 2007;24(4):52–60.

    Article  Google Scholar 

  13. Hafiz M, Adamczyk P, Johnson RE. Growing a pattern language (For Security). In: Proceedings of the 27th object-oriented programming, systems, languages and applications. OOPSLA; 2012.

    Google Scholar 

  14. Fantl J. Knowledge how. In: EN Zalta editor. The stanford encyclopedia of philosophy (Winter 2012 Edition). http://plato.stanford.edu/archives/win2012/entries/knowledge-how. Accessed 23 Sept 2013

  15. Barnum S, Sethi A. Attack patterns as a knowledge resource for building secure software. Cigital Inc. 2007. http://capec.mitre.org/documents/Attack_Patterns-Knowing_Your_Enemies_in_Order_to_Defeat_Them-Paper.pdf. Accessed 23 Sept 2013.

  16. Gamma E, Helm R, Johnson R, Vlissides J. Design patterns: elements of reusable object-oriented software. Reading, MA: Addison-Wesley; 1995.

    Google Scholar 

  17. Alexander C, Ishikawa S, Silverstein M. A pattern language: towns, buildings. Construction, New York: Oxford University Press; 1977.

    Google Scholar 

  18. Moore AP, Ellison RJ, Linger RC. Attack modeling for information security and survivability. No. CMU-SEI-2001-TN-001. Software Engineering Institute, Carnegie Mellon University, Pittsburgh PA; 2001.

    Google Scholar 

  19. Hoglund G, McGraw G. Exploiting software: how to break code. Addison-Wesley; 2004.

    Google Scholar 

  20. Barnum S, Sethi A. Introduction to attack patterns. Cigital Inc. 2006 (revised 14 May 2013). https://buildsecurityin.us-cert.gov/bsi/articles/knowledge/attack/585-BSI.html. Accessed 23 Sept 2013.

  21. Fernandez EB, Pelaez JC, Larrondo-Petrie MM. Attack patterns: a new forensic and design tool. In: 3rd Annual IFIP WG 11.9 international conference on digital forensics. Berlin: Springer. 2007.

    Google Scholar 

  22. Mitre Corporation. Common attack pattern enumeration and classification (CAPEC). Mitre Corporation. http://www.capec.mitre.org. Accessed 23 Sept 2013.

  23. Blackwell C. Formally modelling attack patterns for forensic analysis. In: 5th International conference on cybercrime forensics education and training. Canterbury; 2011.

    Google Scholar 

  24. Swiderski F, Snyder W. Threat modeling. Redmond, WA: Microsoft Press; 2004.

    Google Scholar 

  25. Noy NF, McGuinness DL. Ontology development 101: a guide to creating your first ontology. Technical Report KSL-01-05. Stanford Knowledge Systems Laboratory; 2001.

    Google Scholar 

  26. Bayley I, Zhu H. Formalising design patterns in predicate logic. In: 5th IEEE international conference on software engineering and formal, methods; 2007. pp. 25–36.

    Google Scholar 

  27. Bayley I, Zhu H. Specifying behavioural features of design patterns in first order logic. In: 32nd Annual IEEE international computer software and applications conference. COMPSAC’08. IEEE; 2008. pp. 203–10.

    Google Scholar 

  28. Abrial J-R. The B-Book: assigning programs to meanings. Cambridge: Cambridge University Press; 1996.

    Google Scholar 

  29. Mitre Corporation. Common vulnerabilities and exposures (CVE). Mitre Corporation. http://www.cve.mitre.org. Accessed 23 Sept 2013.

  30. Mitre Corporation. Common weaknesses enumeration (CWE). Mitre Corporation. http://www.cwe.mitre.org. Accessed 23 Sept 2013.

  31. Schumacher M, Fernandez-Buglioni E, Hybertson D, Buschmann F, Sommerlad P. Security patterns: integrating security and systems engineering. Chichester, West Sussex: Wiley; 2005.

    Google Scholar 

  32. Kowalski R. Computational logic and human thinking: how to be artificially intelligent. Cambridge University Press; 2011.

    Google Scholar 

  33. Robertson T. Essential vs. Accidental Properties. In: EN Zalta editor. The stanford encyclopedia of philosophy (Fall 2008 Edition). http://plato.stanford.edu/archives/fall2008/entries/essential-accidental. Accessed 23 Sept 2013.

  34. Garson J. Modal Logic. In: EN Zalta editor. The stanford encyclopedia of philosophy (Spring 2013 Edition). http://plato.stanford.edu/archives/spr2013/entries/logic-modal. Accessed 23 Sept 2013.

  35. Antoniou G, van Harmelen F. A semantic web primer. 2nd ed. MA, London: MIT Press; 2008.

    Google Scholar 

  36. Dolev D, Yao AC. On the security of public key protocols. IEEE Trans Inf Theory. 1983;29(2):198–208.

    Article  MATH  MathSciNet  Google Scholar 

  37. Fowler M. UML distilled: a brief guide to the standard object modeling language. 3rd ed. Boston, MA: Addison-Wesley Professional; 2003.

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Department of Computing and Communication Technologies, Oxford Brookes University, Wheatley Campus, Wheatley, Oxford, OX33 1HX, UK

    Clive Blackwell

Authors
  1. Clive Blackwell
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Clive Blackwell .

Editor information

Editors and Affiliations

  1. Department of Computing and Communication Technologies, Oxford Brookes University, Oxford, Oxfordshire, United Kingdom

    Clive Blackwell

  2. Department of Computing and Communication Technologies, Oxford Brookes University, Oxford, Oxfordshire, United Kingdom

    Hong Zhu

Rights and permissions

Reprints and permissions

Copyright information

© 2014 Springer International Publishing Switzerland

About this chapter

Cite this chapter

Blackwell, C. (2014). A Strategy for Structuring and Formalising Attack Patterns. In: Blackwell, C., Zhu, H. (eds) Cyberpatterns. Springer, Cham. https://doi.org/10.1007/978-3-319-04447-7_9

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-04447-7_9

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-04446-0

  • Online ISBN: 978-3-319-04447-7

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation