• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>13th IEEE International Conference on Commerce and Enterprise Computing >Computer Aided Threat Identification
【24h】

Computer Aided Threat Identification

机译：计算机辅助威胁识别

获取原文
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Recently, there has been an increase of reported security threats hitting organizations. Some of them are originated from the assignments to users of inappropriate permissions on organizational sensitive data. Thus it is crucial for organizations to recognize as early as possible the risks deriving by inappropriate access right management and to identify the solutions that they need to prevent such risks. In this paper, we propose a framework to identify threats during the requirements analysis of organizations' IT systems. With respect to other works which have attempted to include security analysis into requirement engineering process (e.g., KAOS, Elahi et al., Asnar et al.), our framework does not rely on the level of expertise of the security analyst to detect threats but allows to automatically identify threats that derive from inappropriate access management. To capture the organization's setting and the system stakeholders' requirements, we adopt SI* [1], a requirement engineering framework founded on the concepts of actors, goals, tasks and resources. This framework extends SI* with a reasoning technique that identifies potential security threats on resources and relevant goals. The reasoning is based on Answer Set Programming (ASP) logic rules that take into account the relationships between resources and the delegation of permission relations between actors. We illustrate this framework using an eHealth scenario.
机译：最近，据报道，对组织造成威胁的安全威胁有所增加。其中一些源自对组织敏感数据的不适当权限分配给用户。因此，对于组织来说，尽早识别因不适当的访问权限管理而带来的风险并找出防止此类风险所需的解决方案至关重要。在本文中，我们提出了一个在组织的IT系统的需求分析过程中识别威胁的框架。对于其他尝试将安全性分析纳入需求工程流程的工作（例如KAOS，Elahi等人，Asnar等人），我们的框架并不依靠安全性分析人员的专业知识来检测威胁，而是允许自动识别源于不当访问管理的威胁。为了捕获组织的设置和系统涉众的需求，我们采用SI * [1]，这是一个基于参与者，目标，任务和资源的概念的需求工程框架。该框架通过一种推理技术扩展了SI *，该推理技术可识别对资源和相关目标的潜在安全威胁。推理基于答案集编程（ASP）逻辑规则，该规则考虑了资源之间的关系以及参与者之间的权限关系的委派。我们使用eHealth场景说明了此框架。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号