A quantitative model of the security intrusion process based on attacker behavior

摘要: The paper is based on a conceptual framework in which security can be split into two generic types of characteristics, behavioral and preventive. Here, preventive denotes the system's ability to protect itself from external attacks. One way describe system terms its interaction with alleged attacker, i.e., by describing intrusion process. To our knowledge, very little done model this process quantitative terms. Therefore, empirical data collected experiments, we have worked out hypothesis typical attacker behavior. suggests that attacking three phases: learning phase, standard attack innovative phase. probability for successful attacks during phases expected small, although different reasons. During phase it considerably higher. indicates breaches are statistically equivalent times between exponentially distributed. This would actually imply traditional methods reliability modeling could applicable.