Model-based systems security quantification

In this paper, we address the issue of security verification and evaluation of systems at the design level. To this end, we elaborate a practical and formal framework that enables security risk assessment and security requirements verification on systems that are designed using SysML activity diagrams. Our approach is based on probabilistic adversarial interactions between potential attackers and the system design models. These interactions result in a global model that is used to quantify security risks by applying probabilistic model-checking. We rely on a standard catalogue of attack patterns to build a library of attacks' design patterns. To demonstrate the effectiveness of our approach, we apply it on a real-life case study related to the Secure Real Time Streaming Protocol.