The paper examines quantitative assessment of wireless distribution system security, as well as an assessment of risks from attacks and security violations. Furthermore, it describes typical security breach and formal attack models and five methods for assessing security. The proposed normalized method for assessing the degree of security assurance operates with at least three characteristics, which allows comparatively analyze heterogeneous information systems. The improved calculating formulas have been proposed for two security assessment methods, and the elements of functional-cost analysis have been applied to calculate the degree of security. To check the results of the analysis, the coefficient of concordance was calculated, which gives opportunity to determine the quality of expert assessment. The simultaneous use of several models to describe attacks and the effectiveness of countering them allows us to create a comprehensive approach to countering modern security threats to information networks at the commercial enterprises and critical infrastructure facilities.
Several threats are presently affecting wireless systems: natural, man-made, human
intentional and human inadvertent. Natural (cosmic radiation, ionization of the
ionosphere) and man-made (radiation of radio equipment) are very similar in action: they
cause interference in communication channels. Intentional threats become more
widespread and appear as a form of security breaches: the introduction of malicious code
into the system. Human inadvertent threats can be considered as force majeure [
The reminder of the paper is organized as follows. Section 2 “Review of the Literatureˮ contains the analysis of the latest scientific work in this area. Sections 3 “Problem Statement,” 4 “Methods for Assessing the Threats,” and 5 “Approaches to the Threats Assessmentˮ reveal problems, well-known approaches to solving the problem of evaluating the effectiveness of information systems protection. In sections 6 “Zombie” Model of Security Breaches Considerationˮ and 7 “Formal Attack Model” are presented formal models of security breaches and attacks. In section 8 “Methods for Threats Assessing” considered the existing and charming own method of threats. Section 9 “Functional-Cost Analysis” is an example of an audit of the cost of a security system implementing. The paper ends with section 10 “Conclusion and Future Work.ˮ
At first glance, it seems that the problem of protection against security breaches can be
solved by protecting the information, transmitted by the network, itself. But such a
threat is due to the use of the computer facilities, directly involved into in data
transmission, in equipment, for instance, multiplexers and demultiplexers, switches, routers,
amplifiers, regenerators, control devices, etc. Thus, we are talking not only about the
integrity of information, but also about the capacity of the system as a whole [
The system consists of hardware, software, information resources and organizational
structure. Each of these elements can be considered separately as a subsystem of the
general system and apply the same principles as for the system as a whole [
Theoretical and practical studies indicate that the determination of exact quantitative
estimates of possible damage is very difficult or impossible at all. Due to this, the
approximate estimates obtained during the operation of the wireless system, together with
expert assessments have become widespread [
Through the results of security breaches (cyber attacks and viruses) lead to a deterioration of the wireless system infrastructure, they can be considered similar to obstacles. Conversely, obstacles can be considered as the effects of viruses.
Simultaneously with the definition of security indicators, risk assessment should be considered. Only a combination of these two indicators provides a complete picture of the state of wireless system being studied.
The purpose of this study is to develop the methods for determining the level of security, refining them to obtain a methodology of comparing several systems among themselves, as well as improving the methods for verifying the reliability of expert assessments. Let’s suppose that the attacker uses a known security breach model—a zombie model—to gain access to an object of information activity. Defining the system's security level can be used in conjunction with the tree method attack for timely response to changes in the system configuration, the emergence of new types of attacks and changes in organization security policy. 4
Methods for Assessing the Threats “Zombie” model of security breaches consideration and formal attack model allow us to simulate a system and an attack on it. The most appropriate methods for assessing the threats from internal and external threats may be the following: Denial of service probability. Expected vulnerability damage from the ith threat. Set of values for defining security requirements. Assessing the threats and losses. Degree of security procuring.
Through empirical analysis of the above methods for assessing the threats, it has been found that none of its meets the requirements for security of information objects. In our view, this problem can be solved by means of the normalization of quantitative and qualitative indices of threats to information objects and, if necessary, used for “weakly structured” indicators of expert evaluation data. To this end, we have proposed a comprehensive method of the information objects security. 5
Approaches to the Threats Assessment The subjective process of obtaining the probability of the threat can be divided into three stages: Preparatory (the object of research is formed: the set of events and the initial analysis of the properties of this set; one is selected for methods of obtaining subjective probability; the preparation of an expert or a group of experts is conducted). Derivation of the assessments (using the chosen method; obtaining results in a numerical form, possibly controversial). Analysis of the obtained assessments (researching the results of the survey; clarification of the experts’ answers).
Sometimes the third stage is not carried out if the method itself uses the axioms of
probable distribution, which is close to expert estimates itself. Conversely, the stage
becomes especially important if results are obtained from expert groups [
It is also possible to separate two approaches to multicriteria assessment of the
efficiency of distributed wireless systems:
Associated with bringing the set of individual performance indicators to a single
integral indicator.
Methods of the theory of multiple choice and decision-making with a significant
number of individual performance indicators, approximately equally important [
“Zombie” Model of Security Breaches Consideration Security breaches, based on this model, have a clearly separated stage, as it’s shown in Fig. 1. The attack model, used by the attacker, can be presented as follows: shallow study (reconnaissance), in-depth study (scanning of communication channels), complete study (mapping), access to the operating system (OS), extension of authority, “Zombie” OS, manipulation of information, removal of traces of a crime, as well as the installation of spyware software, if it’s needed.
The system “zombification” passes through malicious code, which is entered into the OS for remote access. After that, a “zombie” OS runs the next attack and adds new workstations to the “zombie” network (the so-called botnet). At the end of the attack, traces of an attacker’s presence in the system are deleted.
The “zombie” model efficiency [с–1∙USD–1] can be calculated by the formula:
=
∙
∆ ∙
where n is the number of potential servers on which the attack is implemented; s is the
number of computers that work directly with one server; Δt is the time of the system in
the “zombie” state; C is the cost of the attack: the cost of writing a botnet, additional
costs for the input and distribution of lost code, additional costs [
A formal attack model (AM), within the described above processes, taking into account
the proposals [
port scan.
is a component that describes the script level and serves to create a plurality of different scenarios (sequence of attacking actions), taking into account the purpose formed at the level of parameterization of the SA process, which should be achieved by the offender. At the same time, scripting is carried out by the method of a complete overview of all sub-targets of attacking the purpose action, for example, the target “intelligence,” sub-targets—“scan of ports,” “definition of the OS type,” etc.
is a component that describes all possible variants of the attacker’s actions on the basis of its characteristics, also includes an algorithm for the formation of the attack tree. 8 8.1
Denial of Service Probability
The probability of denial of service data (natural disaster, force majeure, total or partial
loss of data, unauthorized access, etc.) allows you to obtain results in the form of a scale
of assessments of potential threats and their consequences. The method operates with a
set of indicators and for each individual case will be different. The values of the
indicators are approximate, based on available statistics or expert estimates, which makes
it impossible to analyze it with a small amount of accumulated statistical data [
Expected Vulnerability Damage from Threats
Expected vulnerability damage from the ith threat—an empirical method of evaluation,
was first proposed by the specialists of IBM [
This methodology can be described by a system of equations, resulting in parameters at intervals:
= ( , , ) where A is set of all attacking actions; E is set of all exploits; Foption is set of the functions of this component.
At the same time, the filling of the sets A and E is based on open vulnerability databases, for example, the Open Source Vulnerability Database or the National Vulnerability Database (NVD, attacking actions of the implementation stages, enhancing privileges, and implementing the threat), as well as expert knowledge (attacking actions of the stages of intelligence, concealment traces, creation of secret moves).
= 10 + −4 = 7 ∙ 10−3 ∙ , 0 ≤ ≤ 103 { = 7 ∙ 10−7 ∙ ( − 1), 1 ≤ ≤ 107 = 7, > 103 = 7, > 107 where si is predictable or actual number of attacks per year, vi is amount of predictable or real damage in monetary units.
In this case, the increase in the second interval is not taken into account; we propose to correct the formula, taking into account the growth in the whole area of determination of characteristics. It is proposed to use a hyperbolic tangent (more precisely, only its positive part in the first quadrant) in the new formula. Based on the characteristics of the hyperbolic tangent function, additional coefficients are introduced: where kmax corresponds to the maximum of the scale that is 7, and bmax is maximum value of the predictable or real value, the coefficient 2 is introduced for a better scaling by abscissa.
Then the system can be written as follows: ( ) = ∙ ℎ 2
The formula of expected damage from ith threat can be written in general terms: = 107∙
ℎ50 0+7∙
ℎ 5∙1−015−4, 0 ≤ , 1 ≤
This method, as can be seen from the graph (Fig. 2), does not allow to compare different
information systems (due to the significant variation in the cost of systems, their scale
and workload), since the estimated damage is relative. The method shows the most
adequate results in the case of comparing the security of the same system at different
points in time or when the state changes its quality.
(6)
(7)
(8)
20
15
10
5
0
v=500
v=5000
v=50000
v=100000
200
250
300
350
400
450
500
The set of values for defining security requirements is another proposed method in [
( ) where ( ) is normalized pair “function of accessory/element.” Then it is possible to evaluate the effectiveness of clearly defined safety criteria.
This method has the main drawback: the system may be evaluated only with a predetermined set of criteria. 8.4
Assessing the Threats and Losses The analytical method for assessing the threats and losses, associated with them, operates with the average indicator of the appearance of the threat L and the magnitude of the probability distribution f(L). To estimate the losses, the value m with mean deviation v is used.
For analysis, it is imperative to have statistics of security breaches and measured values of losses for these attacks.
The issue with the method is the inability to calculate the impact of information
security (IS) on L and, accordingly, on m, and therefore to assess the effectiveness of the
the X set (security requirements), and A is a plural of values, defining the fulfillment of
security requirements:
(9)
(10)
measures of IS [
Degree of Security The degree of security provides a rough estimate of the effectiveness of the IS system. The method operates with the subjective coefficients of weight ith characteristic Wi and the ball values of each characteristic Gi, which is determined by expert’s estimates.
The formula for the degree of security is as follows: = 1 ∑
=1 ∙ where N is amount of the characteristics.
The method has two drawbacks: it is impossible to compare systems with different
sets of characteristics and it does not take into account the dependence of the weighting
factor and the value of the characteristic of the characteristic itself [
Comprehensive Method of the Information Objects Security The author of the paper proposes to use normalized characteristic S* to assess the degree of the system security, and at the same time, to consider the subjective factors of the importance of the ith characteristic and the ball value of each characteristic, as a function of the characteristics: and ∗( ) is normalized score value of a function: Intermediate values of which are defined as integral characteristics: (11) (12) (13) (14) (15) where fW and fG are functions of the characteristic xi.
The general formula for monotonous fW and uncertain function fG is as follow: where ∗( ) is normalized weighting factor of subjective estimation from xi: { = = ( ) ( ) ∗ = 1 ∑
=1 ∗( ) ∙ ∗( ) ∗( ) = | ( ) max[ ( )]
| ∗( ) = | Σ Σ | { Σ Σ = ∫
= ∫ ( ) ( ) where and
are the beginning and the end of the range of values for a given characteristic that exists and is continuous in the range from to .
In the given case the normalized level of safety of the system will always be S* ≤ 1. S* is “absolutely” protected system, when all the existing characteristics xi are considered. In the general case, the proposed modification of the method allows to obtain a normalized level of security for any system with a number of characteristics (but not less than 3), and to conduct a comparative analysis of IS in systems with a different set of characteristics.
Because the method operates with the results, obtained through expert evaluation, before the data processing begins, it is necessary to assess the adequacy of the expert group. To assess the adequacy it’s needed to determine the coefficient of concordance, which involves the elements of functional-cost analysis. 9
Let’s suppose we have N essential characteristics that are included in the X set of all characteristics of the system [ 1, 2 … ] ∈ .
We determine experimentally or analytically the intervals of values for all characteristics (minimum and maximum values), as well as the average value (which does not necessarily coincide with the arithmetic mean and maximum values). In the found intervals, experts determine the point values of each characteristic Gi: 1 = ( ), = 1 Based on the obtained data, for the sake of clarity, the charts (11), used by experts to determine the following characteristics, are constructed. The weighting of the parameters is determined by the method of prioritization, according to which the priorities of the characteristics are determined by the expert group (M is the number of experts), and as a the result, the comparison table is compiled (see Table 1), in which the average score is reduced to a numerical form according to the principle: “>” corresponds to 1.5, “=”—to 1.0, and “<”—to 0.5. Due to the received data, a table of the characteristics of the priorities is filled out (see Table 2), in which the coefficient 1.0 is taken for pairs xi/xi. where bi is the weight of the ith parameter on the basis of expert assessments; aij is the
The coefficient Wi of the importance of the ith parameter is determined in the second 9.2
Assessment of the Expert Group Adequacy Assessment of the adequacy of the expert group is carried out after determining the dependence of the ball values of each characteristic of the characteristic itself; the discrete function is reduced to a continuous one from (11).
= ∑ =1 where rij is the rank of the ith characteristics, determined by the jth expert.
Checking the total amount of the ranks, this must be equal: =
, ∑ =1 = ∑ =1 = ̇ =
̇ ∑ =1 ̇
, ̇ = ∑ =1 ∙
= 1 ∙ ∙ ∙ ( + 1) 2 = 1 ∙
Δ = −
= ∑ =1 Δ
2 =
12∙
2∙( 3− )
Rejection of the sum of the ranks for each ith characteristic from the average amount
(the sum of deviations for all characteristics should be zero):
(17)
(18)
(19)
(20)
(21)
(22)
(23)
(24)
(25)
The coefficient of concordance can take the value 0 ≤ W ≤ 1. In the case of complete
consistency of expert opinions, the coefficient is W = 1. If W ≥ Wnom, the certain data
are trustworthy and are usable. For the means of computer technology adopted
Wnom = 0.67, the same value can be used for distributed wireless systems [
Wdistribution of communication systems = 0.67±20% (27) The results of field experiments (Fig. 3) suggest that the recommended number of estimated safety parameters and the number of experts evaluating these parameters are interdependent. This is confirmed by the family of curves constructed on the basis of formula (26). The existing models and methods for assessing security and risks, with their drawbacks were considered in the paper. The proposed modifications are intended to improve existing methods and include more precise approximation (for expected damage to the vulnerability) and generalization of the function (for the degree of security). In addition, it is proposed to use elements of functional-cost analysis to verify the reliability of expert evaluation.
From the above, we can say that our method of evaluation is not yet sufficiently thorough and requires more detailed consideration and the introduction of step-by-step instructions in the comprehensive assessment of the security and risks for distributed wireless systems.
The paper describes the sequence of defining the system’s security. In the future, we plan to compare the calculation of efficiency and risk.