An Extended Stochastic Model for Quantitative Security Analysis of Networked Systems

TL;DR

This paper introduces an extended stochastic model for analyzing the security of networked systems, relaxing previous assumptions and providing practical methods for security quantification, advancing the field significantly.

Contribution

It weakens previous assumptions in stochastic security models and offers new analytical and practical tools for quantitative security analysis of networked systems.

Findings

Relaxed assumptions on random variables in security models.

Provided analytical results for security quantification.

Developed practical methods for security analysis.

Abstract

Quantitative security analysis of networked computer systems is one of the decades-long open problems in computer security. Recently, a promising approach was proposed in \cite{XuTDSC11}, which however made some strong assumptions including the exponential distribution of, and the independence between, the relevant random variables. In this paper, we substantially weaken these assumptions while offering, in addition to the same types of analytical results as in \cite{XuTDSC11}, methods for obtaining the desired security quantities in practice. Moreover, we investigate the problem from a higher-level abstraction, which also leads to both analytical results and practical methods for obtaining the desired security quantities. These would represent a significant step toward ultimately solving the problem of quantitative security analysis of networked computer systems.