Model-based Joint Analysis of Safety and Security: Survey and Identification of Gaps

TL;DR

This survey reviews 14 model-based formalisms for joint safety and security analysis, highlighting gaps in understanding interactions, practical applicability, and the need for larger case studies.

Contribution

It provides a comprehensive comparison of formalisms, refines definitions of safety-security dependencies, and identifies key gaps and future directions in the field.

Findings

Most approaches use tree-like formal models.

Safety-security interactions are still not well-understood.

Large case studies are lacking in current research.

Abstract

We survey the state-of-the-art on model-based formalisms for safety and security joint analysis, where safety refers to the absence of unintended failures, and security to absence of malicious attacks. We conduct a thorough literature review and - as a result - we consider fourteen model-based formalisms and compare them with respect to several criteria: (1) Modelling capabilities and Expressiveness: which phenomena can be expressed in these formalisms? To which extent can they capture safety-security interactions? (2) Analytical capabilities: which analysis types are supported? (3) Practical applicability: to what extent have the formalisms been used to analyze small or larger case studies? Furthermore, (1) we present more precise definitions for safety-security dependencies in tree-like formalisms; (2) we showcase the potential of each formalism by modelling the same toy example from the literature and (3) we present our findings and reflect on possible ways to narrow highlighted gaps. In summary, our key findings are the following: (1) the majority of approaches combine tree-like formal models; (2) the exact nature of safety-security interaction is still ill-understood and (3) diverse formalisms can capture different interactions; (4) analyzed formalisms merge modelling constructs from existing safety- and security-specific formalisms, without introducing ad hoc constructs to model safety-security interactions, or (5) metrics to analyze trade offs. Moreover, (6) large case studies representing safety-security interactions are still missing.