Assessing system performance impact of security attacks

摘要

A method for assessing an impact of a security attack on a system includes defining a system affecting metric for an observation period as a fraction of time the system satisfies a defined specification, defining a resource failure based model and a resource usage based model for the system, obtaining results for each of a plurality of states of the resource failure based model and the resource usage based model, solving the resource failure based model and the resource usage based model and obtaining a term fraction of time each model spends on each of the plurality of states, obtaining a state probability according to the term fraction, and obtaining a measure of the system affecting metric according to the state probability.

主权项

1. A computer-implemented method for assessing an impact of a security attack on a software system, the method executed by the computer comprising the steps of:
defining a system performance/reliability affecting metric for an observation period as a fraction of time the system satisfies a defined performance/reliability specification; defining a resource failure based Markov model and a plurality of resource usage based Markov models for the system, wherein each resource usage based model is associated with a corresponding resource configuration; using results of security test cases performed on said software system to obtain pass/fail results for each of a plurality of states of the resource failure based model and the resource usage based model for each corresponding resource configuration; solving the resource failure based Markov model and the plurality of resource usage based Markov models and obtaining a long term fraction of time each model spends on each of the plurality of states; and obtaining a measure of the system performance/reliability affecting metric by summing the states for a plurality of system performance requirements met using the pass/fail results obtained from the plurality of states of the resource failure based model and the resource usage based model for each corresponding resource configuration, and incorporating the long term fraction of time each model spends on each of the plurality of states.