Value-adaptive security threat modeling and vulnerability ranking

1. A method of analyzing security threats associated with software and computer vulnerabilities, the method comprising:

identifying, stakeholder values relevant for a software system;

quantifying the identified stakeholder values using a quantitative decision making approach to prioritize vulnerabilities of the software system;

generating a structured attack graph that includes the quantified stakeholder values to define a scalable framework to evaluate attack scenarios, wherein the structured attack graph includes five or more nodes and at least five layers with each layer including one or more of the nodes, the at least five layers representing the identified stakeholder values, the software system, software installed on the software system, software vulnerabilities of the software installed on the software system and possible attackers;

based on the generated structured attack graph, identifying structured attack paths, each of the structured attack paths including at least one node of the five or more nodes and representing a respective attack scenario, wherein each of the structured attack paths is associated with at least one threat relevant attribute rating;

and calculating, by one or more computer system, a quantitative measure of criticalness of each respective node of the five or more nodes based on the at least one threat relevant attribute rating associated with each structured attack path that includes the respective node.

2. The method of claim 1 , comprising calculating a weight of each of the structured attack paths by multiplying the calculated quantitative measure of criticalness corresponding to each node included in the respective structured attack path.

3. The method of claim 2 , comprising

providing a recommendation on a security investment plan including identifying the attack path with the largest weight to be suppressed using a security practice.

4. The method of claim 1 , wherein identifying comprises identifying values that cannot be quantified in terms of tangible units.

5. The method of claim 1 , wherein quantifying comprises quantifying the identified stakeholder values using a quantitative decision making approach that includes analytical hierarchy process.

6. The method of claim 1 , wherein generating the structured attack graph comprises generating a structured attack graph that includes information on one or more communication ports.

7. The method of claim 6 , further comprising calculating a quantitative measure of criticalness of each port in terms of security threats.

8. The method of claim 7 , further comprising operating a greedy algorithm to calculate an optimal rule set that balances security and efficiency.

9. The method of claim 1 , comprising:

forming two trees from all the structured attack paths that include a given node, one tree below the given node and one tree above the given node; and

calculating the quantitative measure of criticalness of the given node by recursively calculating a bottom-up-weight contributed by the tree below the given node and a top-down-weight contributed by the tree above the given node.

10. The method of claim 1 , comprising:

identifying one of the five or more nodes as a most vulnerable node based on the calculated quantitative measures of criticalness for the five or more nodes and

providing a recommendation on a security investment plan that includes suppressing a security threat of the most vulnerable node.

11. A computer program product, embodied on a non-transitory computer-readable medium, operable to cause a data processing apparatus to perform operations comprising:

identifying stakeholder values relevant for a software system;

quantifying the identified stakeholder values using a quantitative decision making approach to prioritize vulnerabilities of the software system;

generating a structured attack graph that includes the quantified stakeholder values to define a scalable framework to evaluate attack scenarios, wherein the structured attack graph includes two or more nodes and information on one or more communication ports;

calculating a quantitative measure of criticalness of each port in terms of security threats;

based on the generated structured attack graph, identifying structured attack paths, each of the structured attack paths including at least one of the two or more nodes and representing a respective attack scenario, wherein each of the structured attack paths is associated with at least one threat relevant attribute rating; and

calculating a quantitative measure of criticalness of each respective node of the two or more nodes based on the at least one threat relevant attribute rating associated with each attack path that includes the respective node.

12. The computer program product of claim 11 further operable to cause a data processing apparatus to perform operations comprising calculating a weight of each of the structured attack paths by multiplying the calculated quantitative measure of criticalness corresponding to each node included in the respective structured attack path.

13. The computer program product of claim 12 further operable to cause a data processing apparatus to perform operations comprising

providing a recommendation on a security investment plan including identifying the attack path with the largest weight to be suppressed using a security practice.

14. The computer program product of claim 11 further operable to cause a data processing apparatus to perform operations comprising identifying values that cannot be quantified in terms of tangible units.

15. The computer program product of claim 11 further operable to cause a data processing apparatus to perform operations comprising generating a structured attack graph that includes two or more layers with each layer including one or more of the nodes.

16. The computer program product of claim 15 further operable to cause a data processing apparatus to perform operations comprising generating the structured attack graph that includes at least five layers that represent the identified stakeholder values, the software system, software installed on the software system, software vulnerabilities of the software installed on the software system and possible attackers.

17. The computer program product of claim 11 further operable to cause a data processing apparatus to perform operations comprising quantifying the identified stakeholder values using a quantitative decision making approach that includes analytical hierarchy process.

18. The computer program product of claim 11 further operable to cause a data processing apparatus to perform operations comprising operating a greedy algorithm to calculate an optimal rule set that balances security and efficiency.

19. The computer program product of claim 11 further operable to cause a data processing apparatus to perform operations comprising:

forming two trees from all the structured attack paths that include a given node, one tree below the given node and one tree above the given node; and

calculating the quantitative measure of criticalness of the given node by recursively calculating a bottom-up-weight contributed by the tree below the given node and a top-down-weight contributed by the tree above the given node.

20. The computer program product of claim 11 further operable to cause a data processing apparatus to perform operations comprising:

identifying one of the two or more nodes as a most vulnerable node based on the calculated quantitative measures of criticalness for the two or more nodes; and

providing a recommendation on a security investment plan that includes suppressing a security threat of the most vulnerable node.

21. A system comprising:

a communication network; and

two or more servers connected to the network to implement a software system and to perform operations which comprise:

identify stakeholder values relevant for the software system implemented in the two or more servers;

quantify the identified stakeholder values using a quantitative decision making approach to prioritize vulnerabilities of the software system;

generate a structured attack graph that includes the quantified stakeholder values to define a scalable framework to evaluate attack scenarios, wherein the structured attack graph includes two or more nodes;

based on the generated structured attack graph, identify structured attack paths, each structured attack path including at least one node of the two or more nodes and representing a respective attack scenario and being associated with at least one attribute, where each attribute includes a rating value; and

calculate a quantitative measure of criticalness of each node of the two or more nodes, where the quantitative measure of criticalness for a given node is based on the rating value of the at least one attribute associated with each attack path that includes the given node.

22. The system as in claim 21 , wherein a weight of each of the structured attack paths is calculated by multiplying the calculated quantitative measure of criticalness corresponding to each node included in the respective structured attack path.

23. The system as in claim 22 , wherein the two or more servers perform operations which comprise:

providing a recommendation on a security investment plan including identifying the attack path with the largest weight to be suppressed using a security practice.

24. The system as in claim 21 , wherein the two or more servers perform operations which comprise:

forming two trees from all the structured attack paths that include a given node, one tree below the given node and one tree above the given node; and

calculating the quantitative measure of criticalness of the given node by recursively calculating a bottom-up-weight contributed by the tree below the given node and a top-down-weight contributed by the tree above the given node.

25. The system as in claim 21 , wherein the two or more servers perform operations which comprise:

identifying one of the two or more nodes as a most vulnerable node based on the calculated quantitative measures of criticalness for the two or more nodes; and

providing a recommendation on a security investment plan that includes suppressing a security threat of the most vulnerable node.