Attack Tree를 활용한 Game Theory 기반 보안 취약점 정량화 기법
Game Theory-Based Vulnerability Quantification Method Using Attack Tree
1
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
현대사회는 가정, 산업, 금융 등 다양한 분야에 IT 기술 기반 시스템이 도입되어 운영되고 있다. 사회의 안전을 보장하기 위해서는 사회 전반에 도입된 IT 시스템을 사이버 공격으로부터 보호해야하며, 이를 위해 시스템의 현재 보안상태를 이해하고, 점검하는 것은 사이버 공격에 효과적으로 대응하기 위해 선결되어야 하는 과제이다. 본 논문에서는보안 취약점을 점검하기 위해 사용되는 Game Theory 및 Attack Tree 방법론의 한계점을 분석하고, 두 방법론의한계를 상호 보완한 보안 취약점 정량화 기법을 제안하여, 보다 객관적이고 체계적으로 보안 취약점을 점검할 수 있는방법을 제공한다.
Abstract
In modern society, IT technology based systems are introduced and operated in various fields such as home, industry, and finance. To ensure the safety of society, IT systems introduced throughout society should be protected from cyber attacks. Understanding and checking the current security status of the system is one of the important tasks to response effectively against cyber attacks. In this paper, we analyze limitations of Game Theory and Attack Tree methodologies used to inspect for security vulnerabilities. Based on this, we propose a security vulnerability quantification method that complements the limitations of both methodologies. This provides a more objective and systematic way to inspect for security weaknesses.
참고문헌 (15)
- B. Schneier, "Attack Trees", Dr. Dobb’s Journal (1999)
- An annotated review of past papers on attack graphs, "R. Lipmann", Lincoln Laboratory, ~ (2005)
- Osborne, M. J., "A Course in Game Theory" (2014), The MIT Press
- First.org, Inc., "Common Vulnerability Scoring System v3.0", ~ (2015)
- R. Arai, "Differential game-theoretic framework for a demand-side energy management system", Proc. IEEE SmartGridComm 2013 (2013)
- Game Theory in Wireless Networks: A Tutorial, "M. Felegyhazi", EPFL, ~, pp.EPFL Technical Report LCA-REPORT-2006–002 (2006)
- W. He, "A Game Theoretical Attack-Defense Model Oriented to Network Security Risk Assessment", International Conference on Computer Science and Software Engineering (2008)
- Boehmer W, "Dynamic Systems Approach to Analyzing Event Risks and Behavioral Risk with Game Theory", IEEE Third international conference on Privacy, security, risk and trust and social computing (2011)
- X. Liang, "Game Theory for Network Security", IEEE Communications Surveys & Tutorials, 15(1), pp.472~486 (2013)
- R. Hewett, "Smart Grid security : Deriving informed decisions from cyber attack game analysis", 2014 IEEE International Conference on Smart Grid Communications (Smart GridComm) (2014)
- Jung-kuk Seo, "Adapted Attack Tree for Internet Attack Simulation", Proceedings of Symposium of the Korean Institute of communications and Information Sciences (2002)
- C. W. Ten, "Vulnerability Assessment of Cybersecurity for SCADA Systems Using Attack Trees", 2007 IEEE Power Engineering Society General Meeting (2007)
- Du S., "Security Assessment in Vehicular Net works" (2013), Springer
- X. Ji, "Attack-defense trees based cyber security analysis for CPSs", 2016 17th IEEE, Distributed Computing (SNPD), pp.2016[DOI]
- "Common Vulnerabilities and Exposures"[URL]