Multi-representational security analysis
Name
Multi-representational.pdf
Size
515.85 KB
Format
Adobe PDF
Checksum (MD5)
ce634e95ae92b8b22b419df742f637f8
Author(s)
Kang, Eunsuk
Milicevic, Aleksandar
Jackson, Daniel
Date Issued
November 2016
Journal
Proceedings of the 2016 24th ACM SIGSOFT International Symposium on Foundations of Software Engineering - FSE 2016
Publisher
Association for Computing Machinery (ACM)
Citation
Kang, Eunsuk, et al. "Multi-Representational Security Analysis." FSE 2016 Proceedings of the 2016 24th ACM SIGSOFT International Symposium on Foundations of Software Engineering, 13-19 November, 2016, Seattle, Washington, ACM Press, 2016, pp. 181–92.
Version
Author's final manuscript
Abstract
Security attacks often exploit flaws that are not anticipated in an abstract design, but are introduced inadvertently when high-level interactions in the design are mapped to low-level behaviors in the supporting platform. This paper proposes a multi-representational approach to security analysis, where models capturing distinct (but possibly overlapping) views of a system are automatically composed in order to enable an end-to-end analysis. This approach allows the designer to incrementally explore the impact of design decisions on security, and discover attacks that span multiple layers of the system. This paper describes Poirot, a prototype implementation of the approach, and reports on our experience on applying Poirot to detect previously unknown security flaws in publicly deployed systems.
MIT Department
Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory
Terms of Use
Creative Commons Attribution-Noncommercial-Share Alike
Persistent DSpace Link
DOI of Published Version
https://doi.org/10.1145/2950290.2950356
