Attack tree analysis for insider threats on the IoT using isabelle

Florian Kammüller; Jason R. C. Nurse; Christian W. Probst

doi:10.1007/978-3-319-39381-0_21

Attack tree analysis for insider threats on the IoT using isabelle

Florian Kammüller, Jason R. C. Nurse, Christian W. Probst

Research output: Chapter in Book/Report/Conference proceeding › Article in proceedings › Research › peer-review

Abstract

The Internet-of-Things (IoT) aims at integrating small devices around humans. The threat from human insiders in "regular" organisations is real; in a fully-connected world of the IoT, organisations face a substantially more severe security challenge due to unexpected access possibilities and information flow. In this paper, we seek to illustrate and classify insider threats in relation to the IoT (by ‘smart insiders’), exhibiting attack vectors for their characterisation. To model the attacks we apply a method of formal modelling of Insider Threats in the interactive theorem prover Isabelle. On the classified IoT attack examples, we show how this logical approach can be used to make the models more precise and to analyse the previously identified Insider IoT attacks using Isabelle attack trees.

Original language	English
Title of host publication	Human Aspects of Information Security, Privacy, and Trust : 4th International Conference, HAS 2016, Held as Part of HCI International 2016, Toronto, ON, Canada, July 17-22, 2016, Proceedings
Editors	Theo Tryfonas
Number of pages	13
Volume	9750
Publisher	Springer
Publication date	2016
Pages	234-246
ISBN (Print)	978-3-319-39380-3
ISBN (Electronic)	978-3-319-39381-0
DOIs	https://doi.org/10.1007/978-3-319-39381-0_21
Publication status	Published - 2016
Event	4th International Conference on Human Aspects of Information Security, Privacy and Trust (HAS 2016): Part of HCI International 2016 - Toronto, Canada Duration: 17 Jul 2016 → 22 Jul 2016 Conference number: 4 http://2016.hci.international/has

Conference

Conference	4th International Conference on Human Aspects of Information Security, Privacy and Trust (HAS 2016)
Number	4
Country	Canada
City	Toronto
Period	17/07/2016 → 22/07/2016
Internet address	http://2016.hci.international/has

Series	Lecture Notes in Computer Science
ISSN	0302-9743

Access to Document

10.1007/978-3-319-39381-0_21

Fingerprint Dive into the research topics of 'Attack tree analysis for insider threats on the IoT using isabelle'. Together they form a unique fingerprint.

Cite this

Kammüller, F., Nurse, J. R. C., & Probst, C. W. (2016). Attack tree analysis for insider threats on the IoT using isabelle. In T. Tryfonas (Ed.), Human Aspects of Information Security, Privacy, and Trust: 4th International Conference, HAS 2016, Held as Part of HCI International 2016, Toronto, ON, Canada, July 17-22, 2016, Proceedings (Vol. 9750, pp. 234-246). Springer. Lecture Notes in Computer Science https://doi.org/10.1007/978-3-319-39381-0_21

Kammüller, Florian ; Nurse, Jason R. C. ; Probst, Christian W. / Attack tree analysis for insider threats on the IoT using isabelle. Human Aspects of Information Security, Privacy, and Trust: 4th International Conference, HAS 2016, Held as Part of HCI International 2016, Toronto, ON, Canada, July 17-22, 2016, Proceedings. editor / Theo Tryfonas. Vol. 9750 Springer, 2016. pp. 234-246 (Lecture Notes in Computer Science).

@inproceedings{096dd6da4af349cb9f9025d56e287750,

title = "Attack tree analysis for insider threats on the IoT using isabelle",

abstract = "The Internet-of-Things (IoT) aims at integrating small devices around humans. The threat from human insiders in {"}regular{"} organisations is real; in a fully-connected world of the IoT, organisations face a substantially more severe security challenge due to unexpected access possibilities and information flow. In this paper, we seek to illustrate and classify insider threats in relation to the IoT (by {\textquoteleft}smart insiders{\textquoteright}), exhibiting attack vectors for their characterisation. To model the attacks we apply a method of formal modelling of Insider Threats in the interactive theorem prover Isabelle. On the classified IoT attack examples, we show how this logical approach can be used to make the models more precise and to analyse the previously identified Insider IoT attacks using Isabelle attack trees.",

author = "Florian Kamm{\"u}ller and Nurse, {Jason R. C.} and Probst, {Christian W.}",

year = "2016",

doi = "10.1007/978-3-319-39381-0_21",

language = "English",

isbn = "978-3-319-39380-3",

volume = "9750",

series = "Lecture Notes in Computer Science",

publisher = "Springer",

pages = "234--246",

editor = "Theo Tryfonas",

booktitle = "Human Aspects of Information Security, Privacy, and Trust",

note = "4th International Conference on Human Aspects of Information Security, Privacy and Trust (HAS 2016) : Part of HCI International 2016, HAS 2016 ; Conference date: 17-07-2016 Through 22-07-2016",

url = "http://2016.hci.international/has",

}

Kammüller, F, Nurse, JRC & Probst, CW 2016, Attack tree analysis for insider threats on the IoT using isabelle. in T Tryfonas (ed.), Human Aspects of Information Security, Privacy, and Trust: 4th International Conference, HAS 2016, Held as Part of HCI International 2016, Toronto, ON, Canada, July 17-22, 2016, Proceedings. vol. 9750, Springer, Lecture Notes in Computer Science, pp. 234-246, 4th International Conference on Human Aspects of Information Security, Privacy and Trust (HAS 2016), Toronto, Canada, 17/07/2016. https://doi.org/10.1007/978-3-319-39381-0_21

Attack tree analysis for insider threats on the IoT using isabelle. / Kammüller, Florian; Nurse, Jason R. C.; Probst, Christian W.

Human Aspects of Information Security, Privacy, and Trust: 4th International Conference, HAS 2016, Held as Part of HCI International 2016, Toronto, ON, Canada, July 17-22, 2016, Proceedings. ed. / Theo Tryfonas. Vol. 9750 Springer, 2016. p. 234-246 (Lecture Notes in Computer Science).

Research output: Chapter in Book/Report/Conference proceeding › Article in proceedings › Research › peer-review

TY - GEN

T1 - Attack tree analysis for insider threats on the IoT using isabelle

AU - Kammüller, Florian

AU - Nurse, Jason R. C.

AU - Probst, Christian W.

N1 - Conference code: 4

PY - 2016

Y1 - 2016

N2 - The Internet-of-Things (IoT) aims at integrating small devices around humans. The threat from human insiders in "regular" organisations is real; in a fully-connected world of the IoT, organisations face a substantially more severe security challenge due to unexpected access possibilities and information flow. In this paper, we seek to illustrate and classify insider threats in relation to the IoT (by ‘smart insiders’), exhibiting attack vectors for their characterisation. To model the attacks we apply a method of formal modelling of Insider Threats in the interactive theorem prover Isabelle. On the classified IoT attack examples, we show how this logical approach can be used to make the models more precise and to analyse the previously identified Insider IoT attacks using Isabelle attack trees.

AB - The Internet-of-Things (IoT) aims at integrating small devices around humans. The threat from human insiders in "regular" organisations is real; in a fully-connected world of the IoT, organisations face a substantially more severe security challenge due to unexpected access possibilities and information flow. In this paper, we seek to illustrate and classify insider threats in relation to the IoT (by ‘smart insiders’), exhibiting attack vectors for their characterisation. To model the attacks we apply a method of formal modelling of Insider Threats in the interactive theorem prover Isabelle. On the classified IoT attack examples, we show how this logical approach can be used to make the models more precise and to analyse the previously identified Insider IoT attacks using Isabelle attack trees.

U2 - 10.1007/978-3-319-39381-0_21

DO - 10.1007/978-3-319-39381-0_21

M3 - Article in proceedings

SN - 978-3-319-39380-3

VL - 9750

T3 - Lecture Notes in Computer Science

SP - 234

EP - 246

BT - Human Aspects of Information Security, Privacy, and Trust

A2 - Tryfonas, Theo

PB - Springer

T2 - 4th International Conference on Human Aspects of Information Security, Privacy and Trust (HAS 2016)

Y2 - 17 July 2016 through 22 July 2016

ER -

Kammüller F, Nurse JRC, Probst CW. Attack tree analysis for insider threats on the IoT using isabelle. In Tryfonas T, editor, Human Aspects of Information Security, Privacy, and Trust: 4th International Conference, HAS 2016, Held as Part of HCI International 2016, Toronto, ON, Canada, July 17-22, 2016, Proceedings. Vol. 9750. Springer. 2016. p. 234-246. (Lecture Notes in Computer Science). https://doi.org/10.1007/978-3-319-39381-0_21