Security threat assessment of an Internet security system using attack tree and vague sets

Area of Science:

• Computer Science
• Information Security
• Reliability Engineering

Background:

• Internet security threat assessment is increasingly complex due to technological advancements.
• Traditional methods struggle with incomplete failure data and unquantified attack impacts.
• Existing reliability calculations may yield biased conclusions in real-world security scenarios.

Purpose of the Study:

• To propose a novel technique for security threat assessment integrating attack trees and vague sets.
• To overcome the limitations of traditional methods in handling incomplete data and attack uncertainties.
• To provide a more accurate and robust approach to Internet security threat assessment.

Main Methods:

• Integration of attack tree methodology for structured threat modeling.
• Application of vague set theory to manage uncertainty in failure probabilities.
• Development of a hybrid approach combining these two techniques for comprehensive assessment.

Main Results:

• The proposed method effectively handles incomplete malfunction data for elementary events.
• It accounts for the impact of attacks on bottom event failure probabilities.
• Numerical examples demonstrate the proposed approach's validity and superiority over traditional methods.

Conclusions:

• The novel technique offers a more accurate and reliable method for Internet security threat assessment.
• Integrating attack trees and vague sets provides a robust framework for uncertain security environments.
• This approach enhances the precision of security threat evaluations in the face of incomplete information.