A Role Modeling Based Approach for Cyber Threat Analysis
Résumé
Using DSMLs, the domain experts can express their models in a language that is relevant to the problem area. However, it also adds the complexity of interoperability between these languages, specially for application areas that encompass multiple domains. One such application area, Cyber Threat Analysis (CTA), is at the intersection of various domains that can evolve independently: system modeling, attacker modeling and threat description. In this paper, we present an approach to address CTA interoperability issues based on role modeling. The proposed language provides a mechanism to define shared semantics between DSMLs relative to the CTA. The concept of a role is central to our approach, presented as Role4All framework. These roles allow us to federate different DSMLs to generate an attacker’s viewpoint. Our approach is illustrated using a case study on the development of an attacker’s viewpoint based on the federation of multiple domain models. Interoperability between the domain models is crucial to apply dedicated algorithms and interpretations on the attacker’s viewpoint. We used this attacker viewpoint to simulate attacks on a system for security analysis.