42 3.3.1 RORI Calculation ,
52 4.2.1 Event Probability, p.53 ,
54 4.2.2.1 Non-restrictive Combination Approach ,
77 6.1.1.1 Operating Systems Attack Surface, 77 6.1.1.2 Software Systems Attack Surface Other Attack Surface Approaches . . . . . . . . . . . . . . . 79 ,
87 6.2.3.1 Inter-dimension Normalization ,
S 1 ) = (12 × 3) = 36 units ,
Network vulnerability to single, multiple, and probabilistic physical attacks, 2010, MILCOM 2010 MILITARY COMMUNICATIONS CONFERENCE, 2010. ,
DOI : 10.1109/MILCOM.2010.5679556
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.294.7935
Attack Simulation and Threat Modeling. GNU Free Documentation License, 2010. ,
Number Theory Trivia ,
http://www.ssi. gouv.fr/en/the-anssi/publications-109/methods-to-achieve-iss/ ebios-2010-expression-of-needs-and-identification-of-security-objectives. html, ASM06] A. Abbas, A. El Saddik, and A. Miri. A Comprehensive Approach to Designing Internet Security Taxonomy Canadian Conference on Electrical and Computer Engineering, 2006. ,
Passive and Active Combined Attacks: Combining Fault Attacks and Side Channel Analysis, Workshop on Fault Diagnosis and Tolerance in Cryptography (FDTC 2007), 2007. ,
DOI : 10.1109/FDTC.2007.12
Using CP-nets as a guide for countermeasure selection, Proceedings of the 2007 ACM symposium on Applied computing , SAC '07, p.300, 2007. ,
DOI : 10.1145/1244002.1244073
Modeling and selecting countermeasures using CP-nets and Answer Set Programming, 23rd Italian Convention of Computational Logic, 2008. ,
Zeus P2P Advancements and MitB Attack Vectors, 2012. ,
Return on Security Investment -Design Principles of Measurement System Based on Capital Budgeting, Proceedings of the 6th International Conference of Information Systems Technology and its Applications (ISTA), p.2132, 2007. ,
Analysis of Financial Statements, 2000. ,
Modelling Contextual Security Policies, International Journal of Information Security, vol.7, issue.4, p.285305, 2007. ,
DOI : 10.1007/s10207-007-0051-9
Inheritance Hierarchies in the Or- BAC Model and Application in a Network Environment, In the 2nd Foundation of Computer Security Workshop, 2004. ,
Adaptable Parsing of Real- Time Data Streams, 15-th Euromicro Conference on Parallel, Distributed and Network-based Processing, 2007. ,
Exploiting Diversity and Correlation to Improve the Performance of Intrusion Detection Systems, International Conference on Network and Service Security, 2009. ,
Internet Assigned Numbers Authority (IANA) Procedures for the Management of the Service Name and Transport Protocol Port Number Registry, 2011. ,
DOI : 10.17487/rfc6335
Passive and Active Combined Attacks on AES Combining Fault Attacks and Side Channel Analysis, 2010 Workshop on Fault Diagnosis and Tolerance in Cryptography, 2010. ,
DOI : 10.1109/FDTC.2010.17
MEHARI 2010 -Risk Analysis and Treatment Guide. Web- site, 2010. ,
Evaluating Information Security Investment from Attackers Perspective: the Return-on-Attack (roa), Proceedings of the 4th Workshop on the Economics on Information Security, 2005. ,
A model for evaluating IT security investments, Communications of the ACM, vol.47, issue.7, p.8792, 2004. ,
DOI : 10.1145/1005817.1005828
Special-Purpose IP Address Registries, 2013. ,
DOI : 10.17487/rfc6890
A Manager's Guide to Data Security and ISO 27001/ISO 27002, 2008. ,
Automated Safeguard Selection Strategies, CTI Research Symposium, 2006. ,
Ecacy of Coordinated Distributed Multiple Attacks (A Proactive Approach to Cyber Defense), 20th International Conference on Advanced Information Networking and Applications, p.1014, 2006. ,
Version 6 (IPv6) Specication, Internet Protocol, 1995. ,
Internet Security: An Intrusion-Tolerance Approach, Proceedings of the IEEE, vol.94, issue.2, p.432441, 2006. ,
DOI : 10.1109/JPROC.2005.862320
Enabling automated threat response through the use of a dynamic security policy, Journal in Computer Virology, vol.29, issue.2, 2007. ,
DOI : 10.1007/s11416-007-0039-z
Triangular Distribution, Ch. 40 in Statistical Distributions, 2000. ,
The Logic behind CRAMM's Assessment of Measures of Risk and Determination of Appropriate Countermeasures, 2005. ,
An introduction to ROC analysis. Pattern Recognition Letters -Special issue: ROC analysis in pattern recognition, p.861874, 2006. ,
A Weight-Based Symptom Correlation Approach to SQL Injection Attacks, 2009 Fourth Latin-American Symposium on Dependable Computing, 2009. ,
DOI : 10.1109/LADC.2009.14
To Innity and Beyond: Combined Attack on ECC Using Points of Low Order, 13th International Conference on Cryptographic Hardware and Embedded Systems, p.143159, 2011. ,
Microsoft Releases Attack Surface Analizer Tool Available at: http://threatpost.com/en_us/blogs/microsoft-releases-attack-surface- analyzer-tool-080612, 2012. ,
A Game Theory Based Risk and Impact Analysis Method for Intrusion Defense Systems, International Conference on Computer Systems and Applications (AICCSA), p.975982, 2009. ,
Analytic Combinatorics, 2009. ,
DOI : 10.1017/CBO9780511801655
URL : https://hal.archives-ouvertes.fr/inria-00072739
Speculative Attacks with Multiple Targets. Techni- cal report, CARF Working Papers, 2010. ,
Mathematical Structures for Computer Science. A Modern Approach to Descrete Mathematics, Freeman & Company, vol.6, 2007. ,
Synthetic Logs Generator for Fraud Detection in Mobile Transfer Services, 2012. ,
DOI : 10.1007/978-3-642-39884-1_35
URL : https://hal.archives-ouvertes.fr/hal-00848342
Return on Information Security Investments: Myths vs. Realities. Strategic Finance, 2002. ,
A Dual Approach to Detect Pharming Attacks at the Client-Side, 4th IFIP International Conference on New Technologies, Mobility and Security (NTMS), 2011. ,
Decisive Heuristics to Dierentiate Legitimate from Phishing Sites, 6th Conference on Network Architectures and Information Systems Security (SAR-SSI), 2011. ,
Introduction to Probability ,
McAfee Avert Labs Finding W32/Concker.worm ,
A Retrospective and Prospective Survey of the Monte Carlo Method, SIAM Review ,
The American Heritage Science Dictionary, 2010. ,
Intrusion Detection FAQ: AINT Misbehaving: A Taxonomy of Anti-Intrusion Techniques, Proceedings of the 18th National Information Systems Security Conference, p.163172, 1995. ,
Generic Cryptanalysis of Combined Countermeasures with Randomized BSD Representations, 7th International Federation for Information Processing (IFIP), Smart Card Research and Advanced Applications, p.119134, 2006. ,
Ataxonomy of network and computer attacks, Journal of Computers and Security, vol.24, issue.1, p.3144, 2004. ,
Five Notorious Facebook Attacks (Learn How To Protect Yourself ,
Mitigate Security Risks by Minimizing the Code You Expose to Untrusted Users ,
SafetyAnalyst: Software Tools for Safety Management of Specic Highway Sites, MSDN Magazine available at, 2004. ,
Measuring Relative Attack Surfaces, Computer Security in the 21st Century, p.109137, 2007. ,
DOI : 10.1007/0-387-24006-3_8
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.61.2335
Toward a taxonomy and costing method for security services, Proceedings 15th Annual Computer Security Applications Conference (ACSAC'99), p.163168, 1999. ,
DOI : 10.1109/CSAC.1999.816026
Return on Investment Analysis for e-Business Projects, Internet Encyclopedia, vol.3, 2004. ,
Monetary Theory and Electronic Money: Reections on the Kenyan Experience, 2010. ,
Architecture of the World Wide Web, Volume One, W3C Recommendation, 2004. ,
Organization based access control, Proceedings POLICY 2003. IEEE 4th International Workshop on Policies for Distributed Systems and Networks, 2003. ,
DOI : 10.1109/POLICY.2003.1206966
URL : https://hal.archives-ouvertes.fr/hal-01483818
A Service Dependency Model for Cost-Sensitive Intrusion Response, Proceedings of the 15th European Symposium on Research in Computer Security (ESORICS), p.626642, 2010. ,
DOI : 10.1007/978-3-642-15497-3_38
URL : https://hal.archives-ouvertes.fr/hal-01164601
Response Policies and Countermeasures: Management of Service Dependencies and Intrusion and Reaction Impacts, 2010. ,
Eective Security Safeguard Selection Process for Return on Security Investment, Proceedings of the IEEE Asia-Pacic Services Computing Conference, p.2132, 2008. ,
Security Ontology for Annotating Resources, Research Lab, NRL Memorandum Report, p.14831499, 2005. ,
DOI : 10.1007/11575801_34
Is it possible to calculate the Return on Security Investment (rosi)? ,
Detecting Concker in your Network ,
A hierarchical approach for dependability analysis of a commercial cache-based RAID storage architecture, Digest of Papers. Twenty-Eighth Annual International Symposium on Fault-Tolerant Computing (Cat. No.98CB36224), p.615, 1998. ,
DOI : 10.1109/FTCS.1998.689450
URL : https://hal.archives-ouvertes.fr/hal-00140480
A Classication and Detection of Computer Intrusion, 1995. ,
How to systematically classify computer security intrusions, Proceedings. 1997 IEEE Symposium on Security and Privacy (Cat. No.97CB36097), p.154163, 1997. ,
DOI : 10.1109/SECPRI.1997.601330
Methodologies for Evaluating Information Security Investments -What Basel II Can Change in the Financial Industry, ECIS Proceedings, 2005. ,
A Taxonomy of Computer Attacks with Applications to Wireless Networks ,
Defending Multiple-user-multiple-target Attacks in Online Reputation Systems, International Conference on privacy, Security, Risk and Trust, and International Conference on Social Computing, p.425434, 2011. ,
Know Your Enemy: Containing Concker To Tame A ,
An Attack Surface Metric, IEEE Transactions on Software Engineering, vol.37, issue.3, 2008. ,
DOI : 10.1109/TSE.2010.60
Managing vulnerabilities in networked systems, Computer, vol.34, issue.11, p.3238, 2001. ,
DOI : 10.1109/2.963441
Guidelines for new URL Schemes, 1999. ,
DOI : 10.17487/rfc2718
Policy Enforcement Points Responsibility Domain, Under reviw, 2013. ,
Attack Surface Analyzer 1.0. Web- site, 2012. ,
Denition of a Formal Framework for Specifying Security Policies. The OrBAC Model and Extensions, 2005. ,
Return on Information Security Investment -Are you spending enough? Are you spending too much?, 2005. ,
Return on Information Security Investment -The Viability Of An Anti- Spam Solution In A Wireless Environment, International Journal of Network Security, vol.10, issue.1, p.1824, 2010. ,
Detecting Coordinated Distributed Multiple Attacks, 21st International Conference on Advanced Information Networking and Applications Workshops (AINAW'07), p.557562, 2007. ,
DOI : 10.1109/AINAW.2007.149
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.557.5805
Measuring the Attack Surfaces of SAP Business Applications, IEEE International Symposium on Software Reliability Engineering, 2008. ,
A taxonomy of DDoS attack and DDoS defense mechanisms, ACM SIGCOMM Computer Communication Review, vol.34, issue.2, p.3953, 2004. ,
DOI : 10.1145/997150.997156
An Attack Surface Metric, IEEE Transactions on Software Engineering, 2010. ,
DOI : 10.1109/TSE.2010.60
Measuring the attack surfaces of two FTP daemons, Proceedings of the 2nd ACM workshop on Quality of protection , QoP '06, p.310, 2006. ,
DOI : 10.1145/1179494.1179497
Combination of SW Countermeasure and CPU Modication on FPGA against Power Analysis, 11th International Conference on Information Security Applications (WISA), p.258272, 2011. ,
Risk Analysis and Security Countermeasure Selection, 2010. ,
DOI : 10.1201/9781420078718
Workshop-based Security Safeguard Selection with AU- RUM, International Journal on Advances in Security, vol.3, pp.3-4123134, 2010. ,
Workshop-based multiobjective security safeguard selection, First International Conference on Availability, Reliability and Security (ARES'06), p.1, 2006. ,
DOI : 10.1109/ARES.2006.144
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.384.7480
Probability, Statistics, and Stochastic Processes, 2005. ,
IMS Threat and Attack Surface Analysis Using Common Vulnerability Scoring System, 2011 IEEE 35th Annual Computer Software and Applications Conference Workshops, 2010. ,
DOI : 10.1109/COMPSACW.2011.22
Quantied Return On Information Security Investment -A Model for Cost-Benet Analysis, 2009. ,
Protecting the WSN Zones of a Critical Infrastructure via Enhanced SIEM Technology, International Conference on Computer Safety, Reliability, and Security, p.222234 ,
DOI : 10.1007/978-3-642-33675-1_20
An Automatic Ontology-Based Multiagent System for Intrusion Detection in Computing Environments, International Journal for Informatics (IJI), vol.3, issue.1, 2010. ,
Probability and Statistics in Aerospace Engineering, 1998. ,
Discrete Mathematics and its Applications, 1994. ,
Intended Actions: Risk Is Conflicting Incentives ,
DOI : 10.1007/978-3-642-33383-5_23
Using the Conicting Incentives Risk Analysis Method, 28th IFIP International Conference, Security and Privacy Protection in Information System, p.315329, 2013. ,
What is relative measurement? The ratio scale phantom, Mathematical and Computer Modelling, vol.17, issue.4-5, p.112, 1993. ,
DOI : 10.1016/0895-7177(93)90170-4
Return On Security Investment (rosi) -A Practical Quantitative Model, Journal of Research and Practice in Information Technology, vol.38, issue.1, 2006. ,
Resilient Intrusion Tolerance through Proactive and Reactive Recovery, 13th Pacific Rim International Symposium on Dependable Computing (PRDC 2007), 2007. ,
DOI : 10.1109/PRDC.2007.52
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.74.6735
A Cost-Sensitive Model for Preemptive Intrusion Response Systems, Proceedings of the 21st International Conference on Advanced Networking and Applications, 2007. ,
A Taxonomy of Intrusion Response Systems, International Journal of Information and Computer Security, vol.1, issue.12, p.169184, 2007. ,
Security engineering with patterns: origins, theoretical model, and new applications, 2003. ,
DOI : 10.1007/b11930
Computer Security Strength & Risk: A Quantitative Approach, 2004. ,
Zero-Day Java vulnerability wreaks havoc on computers worldwide ,
The Design of a Generic Intrusion-Tolerant Architecture for Web Servers, IEEE Transactions on Dependable and Secure Computing, vol.6, issue.1, p.4558, 2009. ,
DOI : 10.1109/TDSC.2008.1
Targeted Cyber Attacks, the danger faced by your corporate network, 2009. ,
Security Ontology Driven Multi Agent System Architecture for Cloud Data Storage Security: Ontology Development, International Journal of Computer Science and Network Security, vol.12, issue.5, p.6372, 2012. ,
Policy-Based Response to Intrusions Through Context Activation, 2007. ,
Information Security Management Handbook, Four Volume Set, Boca Raton Auerbach Publications, 2000. ,
DOI : 10.1201/9780203325438
Service Name and Transport Protocol Port Number Registry, 2013. ,
Updated Specication of the IPv4 ID Field, 2013. ,
A taxonomy for information security technologies, Computers & Security, vol.22, issue.4, p.299307, 2003. ,
DOI : 10.1016/S0167-4048(03)00406-1
Combined Attacks and Countermeasures, International Federation for Information Processing, 2010. ,
DOI : 10.1007/978-3-642-12510-2_10
URL : https://hal.archives-ouvertes.fr/hal-01056108
Intrusion-Tolerant Architectures: Concepts and Design, Lecture Notes in Computer Science, p.336, 2003. ,
DOI : 10.1007/3-540-45177-3_1
Series Binomial Theorem, 2007. ,
Terminology for Policy-Based Management, p.3198, 2000. ,
DOI : 10.17487/rfc3198
Taxonomy of security considerations and software quality, Communications of the ACM, vol.46, issue.6, p.7578, 2003. ,
DOI : 10.1145/777313.777315
A Framework for Policy-based Admission Control, 2000. ,
DOI : 10.17487/rfc2753
A Game-Theoretic Intrusion Response and Recovery Engine, International Conference on Dependable Systems and Networks, 2009. ,
Author's publications Publications in international peer-reviewed journals An Ontologydriven Approach to Model SIEM Information and Operations Using the SWRL Formalism, International Journal of Electronic Security and Digital Forensics, vol.4, issue.23, p.104123, 2012. ,
RORI-based countermeasure selection using the OrBAC formalism, International Journal of Information Security, vol.12, issue.4, 2013. ,
DOI : 10.1007/s10207-013-0207-8
URL : https://hal.archives-ouvertes.fr/hal-01274857
Enhanced Detection and Reaction at the Edge of SIEM Systems for a Mobile Money Transfer Service Infrastructure Journal of Network and Systems Management (in review), 2013. Publications in international peer-reviewed conferences An Ontologybased Model for SIEM Environments, 7th International Conference in Global Security, Safety and Sustainability, p.148155, 2011. ,
Individual Countermeasure Selection based on the Return On Response Investment Index, International Conference Mathematical Methods, Models and Architectures for Computer Network Security, p.156170, 2012. ,
Combination Approach to Select Optimal Countermeasures based on the RORI Index Contributions to European projects [Con11b] The MASSIF Consortium. D3.2.2 Specication of Event and Alert Description, Second International Conference on the Innovative Computing Technology MASSIF European Project from the 7th Framework Program, as part of the ICT MASSIF project, p.3845, 2011. ,
6, the system detects that a user account (x) has a current transaction amount (ta) greater than the predened threshold transaction amount (th) and therefore, it is assumed that the account (x) is aected by an account takeover attack (z) and an event is generated accordingly by an analyser (a) ,