Sciweavers

WSC
2004

Fast Model-Based Penetration Testing

13 years 5 months ago
Fast Model-Based Penetration Testing
Traditional approaches to security evaluation have been based on penetration testing of real systems, or analysis of formal models of such systems. The former suffer from the problem that the security metrics are based on only a few of the possible paths through the system. The latter suffer from the inability to analyze detailed system descriptions due to the rapid explosion of state space sizes, which render the models intractable for tools such as model checkers. We propose an approach to obtain statistically valid estimates of security metrics by performing repeated penetration testing of detailed system models. We make use of importance sampling techniques to help reduce the variance of our estimates, and achieve relative error bounds quickly. We validate our approach by estimating security metrics of a large model with more than 21700 possible states.
Sankalp Singh, James Lyons, David M. Nicol
Added 31 Oct 2010
Updated 31 Oct 2010
Type Conference
Year 2004
Where WSC
Authors Sankalp Singh, James Lyons, David M. Nicol
Comments (0)