C. Selection and P. , 42 3.3.1 RORI Calculation

C. Parameters and .. , 52 4.2.1 Event Probability, p.53

C. Approaches and .. , 54 4.2.2.1 Non-restrictive Combination Approach

A. Surface and .. , 77 6.1.1.1 Operating Systems Attack Surface, 77 6.1.1.2 Software Systems Attack Surface Other Attack Surface Approaches . . . . . . . . . . . . . . . 79

.. Unit-volume-construction, 87 6.2.3.1 Inter-dimension Normalization

P. Co, S 1 ) = (12 × 3) = 36 units

P. Agarwal, A. Efrat, S. Ganjugunte, D. Hay, S. Sankararaman et al., Network vulnerability to single, multiple, and probabilistic physical attacks, 2010, MILCOM 2010 MILITARY COMMUNICATIONS CONFERENCE, 2010.
DOI : 10.1109/MILCOM.2010.5679556

URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.294.7935

O. Akindeinde, Attack Simulation and Threat Modeling. GNU Free Documentation License, 2010.

]. T. And and . Andreescu, Number Theory Trivia

[. Ebios, http://www.ssi. gouv.fr/en/the-anssi/publications-109/methods-to-achieve-iss/ ebios-2010-expression-of-needs-and-identification-of-security-objectives. html, ASM06] A. Abbas, A. El Saddik, and A. Miri. A Comprehensive Approach to Designing Internet Security Taxonomy Canadian Conference on Electrical and Computer Engineering, 2006.

K. [. Amiel and . Villegas, Passive and Active Combined Attacks: Combining Fault Attacks and Side Channel Analysis, Workshop on Fault Diagnosis and Tolerance in Cryptography (FDTC 2007), 2007.
DOI : 10.1109/FDTC.2007.12

F. [. Bistarelli, P. Fioravanti, and . Peretti, Using CP-nets as a guide for countermeasure selection, Proceedings of the 2007 ACM symposium on Applied computing , SAC '07, p.300, 2007.
DOI : 10.1145/1244002.1244073

F. [. Bistarelli, P. Fioravanti, I. Peretti, and . Trubitsyna, Modeling and selecting countermeasures using CP-nets and Answer Set Programming, 23rd Italian Convention of Computational Logic, 2008.

A. [. Baumhof and . Shipp, Zeus P2P Advancements and MitB Attack Vectors, 2012.

G. [. Brocke, C. Strauch, and . Buddendick, Return on Security Investment -Design Principles of Measurement System Based on Capital Budgeting, Proceedings of the 6th International Conference of Information Systems Technology and its Applications (ISTA), p.2132, 2007.

L. Bernstein and J. Wild, Analysis of Financial Statements, 2000.

F. Cuppens and N. Cuppens-boulahia, Modelling Contextual Security Policies, International Journal of Information Security, vol.7, issue.4, p.285305, 2007.
DOI : 10.1007/s10207-007-0051-9

N. [. Cuppens, A. Cuppens-boulahia, and . Miege, Inheritance Hierarchies in the Or- BAC Model and Application in a Network Environment, In the 2nd Foundation of Computer Security Workshop, 2004.

L. [. Cilardo, F. Coppolino, L. Campanile, and . Romano, Adaptable Parsing of Real- Time Data Streams, 15-th Euromicro Conference on Parallel, Distributed and Network-based Processing, 2007.

S. [. Coppolino, M. Antonio, L. Esposito, and . Romano, Exploiting Diversity and Correlation to Improve the Performance of Intrusion Detection Systems, International Conference on Network and Service Security, 2009.

M. Cotton, L. Eggert, J. Touch, M. Westerlund, and S. Cheshire, Internet Assigned Numbers Authority (IANA) Procedures for the Management of the Service Name and Transport Protocol Port Number Registry, 2011.
DOI : 10.17487/rfc6335

B. [. Clavier, G. Feix, M. Gagnerot, and . Roussellet, Passive and Active Combined Attacks on AES Combining Fault Attacks and Side Channel Analysis, 2010 Workshop on Fault Diagnosis and Tolerance in Cryptography, 2010.
DOI : 10.1109/FDTC.2010.17

. Clusif, MEHARI 2010 -Risk Analysis and Treatment Guide. Web- site, 2010.

P. [. Cremonini and . Martini, Evaluating Information Security Investment from Attackers Perspective: the Return-on-Attack (roa), Proceedings of the 4th Workshop on the Economics on Information Security, 2005.

B. [. Cavusoglu, S. Mishra, and . Raghunathan, A model for evaluating IT security investments, Communications of the ACM, vol.47, issue.7, p.8792, 2004.
DOI : 10.1145/1005817.1005828

L. [. Cotton, R. Vegoda, B. Bonica, and . Haberman, Special-Purpose IP Address Registries, 2013.
DOI : 10.17487/rfc6890

A. Calder, S. Watkins, and . Governance, A Manager's Guide to Data Security and ISO 27001/ISO 27002, 2008.

C. Duan and J. Cleland-huang, Automated Safeguard Selection Strategies, CTI Research Symposium, 2006.

S. [. Debaugh-chavez, A. Mukkamala, and . Sung, Ecacy of Coordinated Distributed Multiple Attacks (A Proactive Approach to Cyber Defense), 20th International Conference on Advanced Information Networking and Applications, p.1014, 2006.

R. [. Deering and . Hinden, Version 6 (IPv6) Specication, Internet Protocol, 1995.

D. [. Deswarte and . Powell, Internet Security: An Intrusion-Tolerance Approach, Proceedings of the IEEE, vol.94, issue.2, p.432441, 2006.
DOI : 10.1109/JPROC.2005.862320

H. Débar, Y. Thomas, F. Cuppens, and N. Cuppens-boulahia, Enabling automated threat response through the use of a dynamic security policy, Journal in Computer Virology, vol.29, issue.2, 2007.
DOI : 10.1007/s11416-007-0039-z

M. Evans, N. Hastings, and B. Peacock, Triangular Distribution, Ch. 40 in Statistical Distributions, 2000.

[. Enterprise, The Logic behind CRAMM's Assessment of Measures of Risk and Determination of Appropriate Countermeasures, 2005.

T. Faucett, An introduction to ROC analysis. Pattern Recognition Letters -Special issue: ROC analysis in pattern recognition, p.861874, 2006.

L. [. Ficco, L. Coppolino, and . Romano, A Weight-Based Symptom Correlation Approach to SQL Injection Attacks, 2009 Fourth Latin-American Symposium on Dependable Computing, 2009.
DOI : 10.1109/LADC.2009.14

B. [. Fan, F. Gierlichs, and . Vercauteren, To Innity and Beyond: Combined Attack on ECC Using Points of Low Order, 13th International Conference on Cryptographic Hardware and Embedded Systems, p.143159, 2011.

]. D. Fis12 and . Fisher, Microsoft Releases Attack Surface Analizer Tool Available at: http://threatpost.com/en_us/blogs/microsoft-releases-attack-surface- analyzer-tool-080612, 2012.

]. Y. Fs09a, Y. Ferenc, and . Salim, A Game Theory Based Risk and Impact Analysis Method for Intrusion Defense Systems, International Conference on Computer Systems and Applications (AICCSA), p.975982, 2009.

P. Flajolet and R. Sedgewick, Analytic Combinatorics, 2009.
DOI : 10.1017/CBO9780511801655

URL : https://hal.archives-ouvertes.fr/inria-00072739

]. J. Fuj10 and . Fujimoto, Speculative Attacks with Multiple Targets. Techni- cal report, CARF Working Papers, 2010.

J. L. Gersting, Mathematical Structures for Computer Science. A Modern Approach to Descrete Mathematics, Freeman & Company, vol.6, 2007.

C. Gaber, B. Hemery, M. Achemlal, M. Pasquet, and P. Urien, Synthetic Logs Generator for Fraud Detection in Mobile Transfer Services, 2012.
DOI : 10.1007/978-3-642-39884-1_35

URL : https://hal.archives-ouvertes.fr/hal-00848342

M. [. Gordon and . Loeb, Return on Information Security Investments: Myths vs. Realities. Strategic Finance, 2002.

]. S. Gpgl11a, G. Gastéllier-prevost, M. Gonzalez-granadillo, and . Laurent, A Dual Approach to Detect Pharming Attacks at the Client-Side, 4th IFIP International Conference on New Technologies, Mobility and Security (NTMS), 2011.

S. Gastéllier-prevost, G. Gonzalez-granadillo, and M. Laurent, Decisive Heuristics to Dierentiate Legitimate from Phishing Sites, 6th Conference on Network Architectures and Information Systems Security (SAR-SSI), 2011.

C. Grinstead and J. L. Snell, Introduction to Probability

]. K. Gud and . Gudgion, McAfee Avert Labs Finding W32/Concker.worm

]. J. Hal and . Halton, A Retrospective and Prospective Survey of the Monte Carlo Method, SIAM Review

H. Houghton-miin, The American Heritage Science Dictionary, 2010.

R. [. Halme and . Bauer, Intrusion Detection FAQ: AINT Misbehaving: A Taxonomy of Anti-Intrusion Techniques, Proceedings of the 18th National Information Systems Security Conference, p.163172, 1995.

[. Hyun, H. Dong-guk, O. Katsujuki, and L. Jongin, Generic Cryptanalysis of Combined Countermeasures with Randomized BSD Representations, 7th International Federation for Information Processing (IFIP), Smart Card Research and Advanced Applications, p.119134, 2006.

S. Hansman and R. Hunt, Ataxonomy of network and computer attacks, Journal of Computers and Security, vol.24, issue.1, p.3144, 2004.

]. L. Hon and . Hongkiat, Five Notorious Facebook Attacks (Learn How To Protect Yourself

]. M. How04 and . Howard, Mitigate Security Risks by Minimizing the Code You Expose to Untrusted Users

D. Harwood, K. Torbic, M. Richard, and . Meyer, SafetyAnalyst: Software Tools for Safety Management of Specic Highway Sites, MSDN Magazine available at, 2004.

M. Howard and J. Wing, Measuring Relative Attack Surfaces, Computer Security in the 21st Century, p.109137, 2007.
DOI : 10.1007/0-387-24006-3_8

URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.61.2335

T. [. Irvine and . Levin, Toward a taxonomy and costing method for security services, Proceedings 15th Annual Computer Security Applications Conference (ACSAC'99), p.163168, 1999.
DOI : 10.1109/CSAC.1999.816026

M. Jerey, Return on Investment Analysis for e-Business Projects, Internet Encyclopedia, vol.3, 2004.

S. [. Jack, R. Tavneet, and . Townsed, Monetary Theory and Electronic Money: Reections on the Kenyan Experience, 2010.

N. [. Jacobs and . Walsh, Architecture of the World Wide Web, Volume One, W3C Recommendation, 2004.

A. Kalam, R. Baida, P. Balbiani, S. Benferhat, F. Cuppens et al., Organization based access control, Proceedings POLICY 2003. IEEE 4th International Workshop on Policies for Distributed Systems and Networks, 2003.
DOI : 10.1109/POLICY.2003.1206966

URL : https://hal.archives-ouvertes.fr/hal-01483818

N. [. Kheir, F. Cuppens-boulahia, H. Cuppens, and . Débar, A Service Dependency Model for Cost-Sensitive Intrusion Response, Proceedings of the 15th European Symposium on Research in Computer Security (ESORICS), p.626642, 2010.
DOI : 10.1007/978-3-642-15497-3_38

URL : https://hal.archives-ouvertes.fr/hal-01164601

N. Kheir, Response Policies and Countermeasures: Management of Service Dependencies and Intrusion and Reaction Impacts, 2010.

T. [. Kim, H. Lee, and . In, Eective Security Safeguard Selection Process for Return on Security Investment, Proceedings of the IEEE Asia-Pacic Services Computing Conference, p.2132, 2008.

J. [. Kim, M. Luo, and . Kang, Security Ontology for Annotating Resources, Research Lab, NRL Memorandum Report, p.14831499, 2005.
DOI : 10.1007/11575801_34

]. D. Kos11 and . Kosutic, Is it possible to calculate the Return on Security Investment (rosi)?

]. A. Kri09 and . Kriegisch, Detecting Concker in your Network

M. Kaaniche, L. Romano, Z. Kalbarczyck, R. Iyer, and R. Karcich, A hierarchical approach for dependability analysis of a commercial cache-based RAID storage architecture, Digest of Papers. Twenty-Eighth Annual International Symposium on Fault-Tolerant Computing (Cat. No.98CB36224), p.615, 1998.
DOI : 10.1109/FTCS.1998.689450

URL : https://hal.archives-ouvertes.fr/hal-00140480

S. Kumar, A Classication and Detection of Computer Intrusion, 1995.

E. [. Lindqvist and . Jonsson, How to systematically classify computer security intrusions, Proceedings. 1997 IEEE Symposium on Security and Privacy (Cat. No.97CB36097), p.154163, 1997.
DOI : 10.1109/SECPRI.1997.601330

]. C. Loc05 and . Locher, Methodologies for Evaluating Information Security Investments -What Basel II Can Change in the Financial Industry, ECIS Proceedings, 2005.

D. Lough, A Taxonomy of Computer Attacks with Applications to Wireless Networks

Y. [. Liu, T. Sun, and . Yu, Defending Multiple-user-multiple-target Attacks in Online Reputation Systems, International Conference on privacy, Security, Risk and Trust, and International Conference on Social Computing, p.425434, 2011.

T. [. Leder and . Werner, Know Your Enemy: Containing Concker To Tame A

P. Manadhata, An Attack Surface Metric, IEEE Transactions on Software Engineering, vol.37, issue.3, 2008.
DOI : 10.1109/TSE.2010.60

R. Martin, Managing vulnerabilities in networked systems, Computer, vol.34, issue.11, p.3238, 2001.
DOI : 10.1109/2.963441

H. [. Masinter, D. Alvestrand, R. Zigmond, and . Petke, Guidelines for new URL Schemes, 1999.
DOI : 10.17487/rfc2718

[. Mustapha, G. Blanc, and H. Debar, Policy Enforcement Points Responsibility Domain, Under reviw, 2013.

]. Mic12, . Sdl-team, and . Microsoft, Attack Surface Analyzer 1.0. Web- site, 2012.

A. Miege, Denition of a Formal Framework for Specifying Security Policies. The OrBAC Model and Extensions, 2005.

]. A. Miz05 and . Mizzi, Return on Information Security Investment -Are you spending enough? Are you spending too much?, 2005.

]. A. Miz10 and . Mizzi, Return on Information Security Investment -The Viability Of An Anti- Spam Solution In A Wireless Environment, International Journal of Network Security, vol.10, issue.1, p.1824, 2010.

K. [. Mukkamala, R. Yendrapalli, A. Basnet, and . Sung, Detecting Coordinated Distributed Multiple Attacks, 21st International Conference on Advanced Information Networking and Applications Workshops (AINAW'07), p.557562, 2007.
DOI : 10.1109/AINAW.2007.149

URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.557.5805

Y. [. Manadhata, J. Karabulut, and . Wing, Measuring the Attack Surfaces of SAP Business Applications, IEEE International Symposium on Software Reliability Engineering, 2008.

P. [. Mirkovic and . Reiher, A taxonomy of DDoS attack and DDoS defense mechanisms, ACM SIGCOMM Computer Communication Review, vol.34, issue.2, p.3953, 2004.
DOI : 10.1145/997150.997156

P. Manadhata and J. Wing, An Attack Surface Metric, IEEE Transactions on Software Engineering, 2010.
DOI : 10.1109/TSE.2010.60

P. Manadhata, J. Wing, M. Flynn, and M. Mcqueen, Measuring the attack surfaces of two FTP daemons, Proceedings of the 2nd ACM workshop on Quality of protection , QoP '06, p.310, 2006.
DOI : 10.1145/1179494.1179497

Y. [. Nakatsu, K. Li, K. Sakijama, and . Ohta, Combination of SW Countermeasure and CPU Modication on FPGA against Power Analysis, 11th International Conference on Information Security Applications (WISA), p.258272, 2011.

T. Norman, Risk Analysis and Security Countermeasure Selection, 2010.
DOI : 10.1201/9781420078718

M. [. Neubauer and . Pehn, Workshop-based Security Safeguard Selection with AU- RUM, International Journal on Advances in Security, vol.3, pp.3-4123134, 2010.

C. [. Neubauer, E. Stummer, and . Weippl, Workshop-based multiobjective security safeguard selection, First International Conference on Availability, Reliability and Security (ARES'06), p.1, 2006.
DOI : 10.1109/ARES.2006.144

URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.384.7480

P. Olofsson, Probability, Statistics, and Stochastic Processes, 2005.

P. S. Petajasoja, H. Kortti, A. Takanen, and J. Tirila, IMS Threat and Attack Surface Analysis Using Common Vulnerability Scoring System, 2011 IEEE 35th Annual Computer Software and Applications Conference Workshops, 2010.
DOI : 10.1109/COMPSACW.2011.22

]. P. Pua09 and . Puangsri, Quantied Return On Information Security Investment -A Model for Cost-Benet Analysis, 2009.

S. [. Romano, V. Antonio, L. Formicola, and . Coppolino, Protecting the WSN Zones of a Critical Infrastructure via Enhanced SIEM Technology, International Conference on Computer Safety, Reliability, and Security, p.222234
DOI : 10.1007/978-3-642-33675-1_20

R. Riveiro, E. Galvao, F. Freitas, C. Rodriguez, M. Siqueira et al., An Automatic Ontology-Based Multiagent System for Intrusion Detection in Computing Environments, International Journal for Informatics (IJI), vol.3, issue.1, 2010.

L. [. Rheinfurth and . Howell, Probability and Statistics in Aerospace Engineering, 1998.

K. Rosen, Discrete Mathematics and its Applications, 1994.

E. [. Rajbhandari and . Snekkenes, Intended Actions: Risk Is Conflicting Incentives
DOI : 10.1007/978-3-642-33383-5_23

E. [. Rajbhandari and . Snekkenes, Using the Conicting Incentives Risk Analysis Method, 28th IFIP International Conference, Security and Privacy Protection in Information System, p.315329, 2013.

T. L. Saaty, What is relative measurement? The ratio scale phantom, Mathematical and Computer Modelling, vol.17, issue.4-5, p.112, 1993.
DOI : 10.1016/0895-7177(93)90170-4

J. [. Sonnenreich, B. Albanese, and . Stout, Return On Security Investment (rosi) -A Practical Quantitative Model, Journal of Research and Practice in Information Technology, vol.38, issue.1, 2006.

P. Sousa, A. Bessani, M. Correia, N. Ferreira-neves, and P. Verissimo, Resilient Intrusion Tolerance through Proactive and Reactive Recovery, 13th Pacific Rim International Symposium on Dependable Computing (PRDC 2007), 2007.
DOI : 10.1109/PRDC.2007.52

URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.74.6735

]. N. Sbw07a, S. Stakhanova, J. Basu, and . Wong, A Cost-Sensitive Model for Preemptive Intrusion Response Systems, Proceedings of the 21st International Conference on Advanced Networking and Applications, 2007.

]. N. Sbw07b, S. Stakhanova, J. Basu, and . Wong, A Taxonomy of Intrusion Response Systems, International Journal of Information and Computer Security, vol.1, issue.12, p.169184, 2007.

M. Schumacher, Security engineering with patterns: origins, theoretical model, and new applications, 2003.
DOI : 10.1007/b11930

S. E. Schechter, Computer Security Strength & Risk: A Quantitative Approach, 2004.

]. J. Seg13 and . Segura, Zero-Day Java vulnerability wreaks havoc on computers worldwide

V. [. Saidane, Y. Nicomette, and . Deswarte, The Design of a Generic Intrusion-Tolerant Architecture for Web Servers, IEEE Transactions on Dependable and Secure Computing, vol.6, issue.1, p.4558, 2009.
DOI : 10.1109/TDSC.2008.1

[. Software, Targeted Cyber Attacks, the danger faced by your corporate network, 2009.

R. [. Talib, R. Atan, M. Abdullah, and . Azmi, Security Ontology Driven Multi Agent System Architecture for Cloud Data Storage Security: Ontology Development, International Journal of Computer Science and Network Security, vol.12, issue.5, p.6372, 2012.

Y. Thomas, Policy-Based Response to Intrusions Through Context Activation, 2007.

H. F. Tipton and M. Krause, Information Security Management Handbook, Four Volume Set, Boca Raton Auerbach Publications, 2000.
DOI : 10.1201/9780203325438

J. Touch, M. Kojo, E. Lear, A. Mankin, K. Ono et al., Service Name and Transport Protocol Port Number Registry, 2013.

]. J. Tou13 and . Touch, Updated Specication of the IPv4 ID Field, 2013.

H. Venter and J. Elo, A taxonomy for information security technologies, Computers & Security, vol.22, issue.4, p.299307, 2003.
DOI : 10.1016/S0167-4048(03)00406-1

E. Vetillard and A. Ferrari, Combined Attacks and Countermeasures, International Federation for Information Processing, 2010.
DOI : 10.1007/978-3-642-12510-2_10

URL : https://hal.archives-ouvertes.fr/hal-01056108

N. [. Verissimo, M. P. Ferreira-neves, and . Correia, Intrusion-Tolerant Architectures: Concepts and Design, Lecture Notes in Computer Science, p.336, 2003.
DOI : 10.1007/3-540-45177-3_1

]. K. War07 and . Ward, Series Binomial Theorem, 2007.

A. Westerinen, J. Schnizlein, J. Strassner, M. Scherling, B. Quinn et al., Terminology for Policy-Based Management, p.3198, 2000.
DOI : 10.17487/rfc3198

C. [. Wang and . Wang, Taxonomy of security considerations and software quality, Communications of the ACM, vol.46, issue.6, p.7578, 2003.
DOI : 10.1145/777313.777315

D. [. Yavatkar, R. Pendarakis, and . Guerin, A Framework for Policy-based Admission Control, 2000.
DOI : 10.17487/rfc2753

H. [. Zonouz, W. Khurana, T. Sanders, and . Yardley, A Game-Theoretic Intrusion Response and Recovery Engine, International Conference on Dependable Systems and Networks, 2009.

G. , G. Gonzalez-granadillo, Y. B. Mustapha, N. Hachem, and H. Débar, Author's publications Publications in international peer-reviewed journals An Ontologydriven Approach to Model SIEM Information and Operations Using the SWRL Formalism, International Journal of Electronic Security and Digital Forensics, vol.4, issue.23, p.104123, 2012.

G. Gonzalez-granadillo, M. Belhaouane, H. Débar, and G. Jacob, RORI-based countermeasure selection using the OrBAC formalism, International Journal of Information Security, vol.12, issue.4, 2013.
DOI : 10.1007/s10207-013-0207-8

URL : https://hal.archives-ouvertes.fr/hal-01274857

G. Gonzalez-granadillo, C. Gaber, and V. Formicola, Enhanced Detection and Reaction at the Edge of SIEM Systems for a Mobile Money Transfer Service Infrastructure Journal of Network and Systems Management (in review), 2013. Publications in international peer-reviewed conferences An Ontologybased Model for SIEM Environments, 7th International Conference in Global Security, Safety and Sustainability, p.148155, 2011.

. Gdj-+-12-]-g, H. Gonzalez-granadillo, G. Débar, C. Jacob, M. Gaber et al., Individual Countermeasure Selection based on the Return On Response Investment Index, International Conference Mathematical Methods, Models and Architectures for Computer Network Security, p.156170, 2012.

G. Gonzalez-granadillo, H. Débar, G. Jacob, and L. Coppolino, Combination Approach to Select Optimal Countermeasures based on the RORI Index Contributions to European projects [Con11b] The MASSIF Consortium. D3.2.2 Specication of Event and Alert Description, Second International Conference on the Innovative Computing Technology MASSIF European Project from the 7th Framework Program, as part of the ICT MASSIF project, p.3845, 2011.

. Similarly, 6, the system detects that a user account (x) has a current transaction amount (ta) greater than the predened threshold transaction amount (th) and therefore, it is assumed that the account (x) is aected by an account takeover attack (z) and an event is generated accordingly by an analyser (a)