A Mathematical Modeling of Exploitations and Mitigation Techniques Using Set Theory
A Mathematical Modeling of Exploitations and Mitigation Techniques Using Set Theory
复制标题
使用集合论对漏洞利用和缓解技术进行数学建模
DOI：
10.1109/spw.2018.00050
复制
发表时间：
2018
期刊：
影响因子：
--
通讯作者：
Ke Sun
中科院分区：
文献类型：
--
作者：
R. Branco;Kekai Hu;Henrique Kawakami;Ke Sun
计算机安全中最具挑战性的问题之一是对漏洞、利用、缓解及其关系的形式化。尽管已有各种研究和理论，但还没有一个能够定量表示和分析开发复杂性和缓解效果的数学模型。在这项工作中，我们介绍了一种利用集合论和大O符号的数学概念来建模攻击和缓解技术的新方法。该模型建立了攻击原语和攻击目标之间的公式化关系，能够对系统中的漏洞和安全特征进行定量评估。我们用两种真实世界的缓解技术演示了该模型的应用。它是对利用和减轻进行全面的数学理解和建模的第一步，这将在很大程度上有利于和促进系统安全评估的实践。
One of the most challenging problems in computer security is formalization of vulnerabilities, exploits, mitigations and their relationship. In spite of various existing researches and theories, a mathematical model that can be used to quantitatively represent and analyze exploit complexity and mitigation effectiveness is still in absence. In this work, we introduce a novel way of modeling exploits and mitigation techniques with mathematical concepts from set theory and big O notation. The proposed model establishes formulaic relationships between exploit primitives and exploit objectives, and enables the quantitative evaluation of vulnerabilities and security features in a system. We demonstrate the application of this model with two real world mitigation techniques. It serves as the first step toward a comprehensive mathematical understanding and modeling of exploitations and mitigations, which will largely benefit and facilitate the practice of system security assessment.