Limiting Adversarial Budget in Quantitative Security Assessment

We present the results of research of limiting adversarial budget in attack games, and, in particular, in the failure-free attack tree models presented by Buldas-Stepanenko in 2012 and improved in 2013 by Buldas and Lenin. In the previously presented models attacker’s budget was assumed to be unlimited. It is natural to assume that the adversarial budget is limited and such an assumption would allow us to model the adversarial decision making more close to the one that might happen in real life. We analyze three atomic cases – the single atomic case, the atomic AND, and the atomic OR. Even these elementary cases become quite complex, at the same time, limiting adversarial budget does not seem to provide any better or more precise results compared to the failure-free models. For the limited model analysis results to be reliable, it is required that the adversarial reward is estimated with high precision, probably not achievable by providing expert estimations for the quantitative annotations on the attack steps, such as the cost or the success probability. It is doubtful that it is reasonable to face this com- plexity, as the failure-free model provides reliable upper bounds, being at the same time computationally less complex.

Attack trees are considered a useful tool for security modelling because they support qualitative as well as quantitative analysis. The quantitative approach is based on values associated to each node in the tree, expressing, for instance, the minimal cost or probability of an attack. Current quantitative methods for attack trees allow the analyst to, based on an initial assignment of values to the leaf nodes, derive the values of the higher nodes in the tree. In practice, however, it shows to be very difficult to obtain reliable values for all leaf nodes. The main reasons are that data is only available for some of the nodes, that data is available for intermediate nodes rather than for the leaf nodes, or even that the available data is inconsistent. We address these problems by developing a generalisation of the standard bottom-up calculation method in three ways. First, we allow initial attributions of non-leaf nodes. Second, we admit additional relations between attack steps beyond those provided by the underlying attack tree semantics. Third, we support the calculation of an approximative solution in case of inconsistencies. We illustrate our method, which is based on constraint programming, by a comprehensive case study.

Attack trees are a well-known formalism for quantitative analysis of cyber attacks consisting of multiple steps and alternative paths. It is possible to derive properties of the overall attacks from properties of individual steps, such as cost for the attacker and probability of success. However, in existing formalisms, such properties are considered independent. For example, investing more in an attack step would not increase the probability of success. As this seems counterintuitive, we introduce a framework for reasoning about attack trees based on the notion of control strength, annotating nodes with a function from attacker investment to probability of success. Calculation rules on such trees are defined to enable analysis of optimal attacker investment. Our second result consists of the translation of optimal attacker investment into the associated adversarial risk, yielding what we call adversarial risk trees. The third result is the introduction of probabilistic attacker strategies, based on the fitness (utility) of available scenarios. Together these contributions improve the possibilities for using attack trees in adversarial risk analysis.KeywordsAdversarial risk analysisAttack treesAttacker modelsControl strengthFitness functionsSecurity metricsSimulation

Introduction: VF accounts for ~30% of all sudden cardiac arrest episodes. VF signal analysis in the frequency domain - calculating the amplitude spectral area (AMSA) - can inform on the probability that an electrical shock could terminate VF followed by return of spontaneous circulation (ROSC). BLS guidelines require delivery of shocks every 2 min and epinephrine every 4 min. Yet, shocks often do not terminate VF and may injure the myocardium. We have previously reported that guiding the timing of shock delivery based on AMSA reduces myocardial injury and improves outcome. Epinephrine is given to increase the coronary perfusion pressure (CPP) and therefore myocardial blood flow but has detrimental effects on post-resuscitation myocardial function and possibly on neurological outcome. Hypothesis: Monitoring AMSA during CPR could be used not only to guide shock delivery but also to avoid administering epinephrine when AMSA predicts a high probability of shock success, reserving epinephrine when AMSA predicts a low probability of shock success and additional CPP increase might be helpful. Methods: In a swine model of electrically induced VF and mechanical chest compressions, two resuscitation protocols were compared in 8 pigs each: (1) A guidelines-driven (GD), delivering shocks and epinephrine guided by the current BLS protocol and (2) An AMSA-driven, delivering shocks and epinephrine guided by AMSA (ADSE). VF was untreated for 10 min and pigs that achieved ROSC were monitored for 240 min. Results: Compared to GD, ADSE was associated with a shorter time to ROSC (400±80 vs 569±16 sec, p=0.034) and higher survival rate at 240 minutes with borderline statistical significance (7/8 vs 3/8, p=0.059). ADSE required fewer shocks (3±2 vs 5±2, p=0.026) and received fewer doses of epinephrine (median [interquartile range], 1[1-1] vs 2[1.3-3], p=0.038). Conclusions: Resuscitation with the ADSE protocol was superior to the GD protocol resulting in a shorter time to ROSC with improved survival requiring fewer shocks and fewer epinephrine doses. The ADSE protocol represents a more tailored approach to resuscitation enabling delivery of resuscitation interventions with higher precision and consequently minimizing their associated adverse effects.

Modeling and analyses of IP spoofing attack in 6LoWPAN network

Trust in a microelectronics-based system can be characterized as the level of confidence that a system is free of subversive alterations made during system development, or that the development process of a system has not been manipulated by a malicious adversary. Trust in systems has become an increasing concern over the past decade. This article presents a novel game-theoretic framework, called GPLADD (Graph-based Probabilistic Learning Attacker and Dynamic Defender), for analyzing and quantifying system trustworthiness at the end of the development process, through the analysis of risk of development-time system manipulation. GPLADD represents attacks and attacker-defender contests over time. It treats time as an explicit constraint and allows incorporating the informational asymmetries between the attacker and defender into analysis. GPLADD includes an explicit representation of attack steps via multi-step attack graphs, attacker and defender strategies, and player actions at different times. GPLADD allows quantifying the attack success probability over time and the attacker and defender costs based on their capabilities and strategies. This ability to quantify different attacks provides an input for evaluation of trust in the development process. We demonstrate GPLADD on an example attack and its variants. We develop a method for representing success probability for arbitrary attacks and derive an explicit analytic characterization of success probability for a specific attack. We present a numeric Monte Carlo study of a small set of attacks, quantify attack success probabilities, attacker and defender costs, and illustrate the options the defender has for limiting the attack success and improving trust in the development process.

Parallel robotic systems have shown their advantages over the traditional serial robots such as high payload capacity, high speed, and high precision. Their applications are widespread from transportation to manufacturing fields. Therefore, most of the recent studies in parallel robots focus on finding the best method to improve the system accuracy. Enhancing this metric, however, is still the biggest challenge in controlling a parallel robot owing to the complex mathematical model of the system. In this paper, we present a novel solution to this problem with a Type 2 Fuzzy Coherent Controller Network (T2FHC), which is composed of a Type 2 Cerebellar Model Coupling Controller (CMAC) with its fast convergence ability and a Brain Emotional Learning Controller (BELC) using the Lyaponov-based weight updating rule. In addition, the T2FHC is combined with a surface generator to increase the system flexibility. To evaluate its applicability in real life, the proposed controller was tested on a Quanser 2-DOF robot system in three case studies: no load, 180 g load and 360 g load, respectively. The results showed that the proposed structure achieved superior performance compared to those of available algorithms such as CMAC and Novel Self-Organizing Fuzzy CMAC (NSOF CMAC). The Root Mean Square Error (RMSE) index of the system that was 2.20E-06 for angle A and 2.26E-06 for angle B and the tracking error that was -6.42E-04 for angle A and 2.27E-04 for angle B demonstrate the good stability and high accuracy of the proposed T2FHC. With this outstanding achievement, the proposed method is promising to be applied to many applications using nonlinear systems.

We consider a scenario where a searcher requires both high precision and high recall from an interactive retrieval process. Such scenarios are very common in real life, exemplified by medical search, legal search, market research, and literature review. When access to the entire data set is available, an active learning loop could be used to ask for additional relevance feedback labels in order to refine a classifier. When data is accessed via search services, however, only limited subsets of the corpus can be considered, subsets defined by queries. In that setting, relevance feedback has been used in a query enhancement loop that updates a query. We describe and demonstrate the effectiveness of ReQ-ReC (ReQuery-ReClassify), a double-loop retrieval system that combines iterative expansion of a query set with iterative refinements of a classifier. This permits a separation of concerns, where the query selector's job is to enhance recall while the classifier's job is to maximize precision on the items that have been retrieved by any of the queries so far. The overall process alternates between the query enhancement loop, to increase recall, and the classifier refinement loop, to increase precision. The separation allows the query enhancement process to explore larger parts of the query space. Our experiments show that this distribution of work significantly outperforms previous relevance feedback methods that rely on a single ranking function to balance precision and recall.

A recently proposed self-assessment questionnaire aimed at diagnosing sensitive skin provided promising results in a relatively small population. The main objectives were: (i) to assess the reliability of the aforementioned questionnaire in a larger population and verify the cut-off score previously found to predict skin sensitivity (defined as positivity to LAST, lactic acid stinging test) and (ii) to define a formula that yields the probability of a positive LAST result. Adult volunteers were included in this observational, cross-sectional, extended study. Both LAST-positive subjects, who were considered as having sensitive skin ('patients') and negative ones ('controls') completed the questionnaire, which concerned sensitivity to possible triggers of unpleasant skin sensations in real life. A cumulative score (questionnaire-based skin sensitivity score, 0-10) was calculated from the sum of all items. Three hundred and sixty-four subjects were enrolled, 214 patients and 150 controls. The mean questionnaire-based skin sensitivity score was significantly higher among patients than controls. Using two different methods, cut-off values of 4 and 5 were defined for the identification of LAST-positive subjects, with 76.6% and 72.8% accuracy, respectively. Scores below 4 or above 5 showed a high (80% or better) negative or positive predictive value, respectively. The coefficients found that in multivariate analysis for each questionnaire item, gender and age allowed us to calculate the probability of LAST positivity with higher precision taking into account the 'relative weight' of each factor. With small variations in the results, the self-assessment questionnaire confirmed its reliability for diagnosing sensitive skin in clinical practice.

Isotope dilution determinations of Lu, Hf, Zr, Ta and W are reported for nine test portions (five for W) of NIST SRM 610 and 612 glass wafers. Additionally, all test portions were analysed for their Hf isotope compositions. In general, high field strength elemental (HFSE) distributions in NIST SRM 610 and 612 were reproducible to ∼± 1%, except for Zr (± 5%) in NIST SRM 612, and absolute reported concentrations agreed with previously published values, but with higher precision. The slightly worse reproducibility of Zr in NIST SRM 612 compared to other HFSE is interpreted to result from analytical scatter, rather than sample inhomogeneity. The analyses demonstrated elemental homogeneity for both glass wafers for samples of 1–2 mg with respect to the precision of the method, i.e., ± 1% or better. Average Hf isotope compositions for both glass wafers agreed within uncertainty and the weighted average of all determinations yielded a mean 176Hf/177Hf ratio of 0.282111 ± 0.000009 (95% confidence level). However, although mean values for NIST SRM 610 and 612 agreed within analytical limits, NIST SRM 610 test portions showed a tendency of systematically elevated isotope composition of ∼ 0.5 ɛHf units when compared to NIST SRM 612, which may indicate a slightly more radiogenic Hf isotope composition of NIST SRM 610. The results of this study suggest that NIST SRM 610 and 612 are valuable calibrators for HFSE in situ analyses within the given uncertainties.

Background:Female diffuse alopecia is a common dermatologic problem. Consequently, a simple, quick, and quantitative assessment is required to aid in diagnosis. A clinic-based modified hair fall count in 60 seconds is proposed as a new, simple, and quick method for evaluating hair loss.Objectives: To assess bias and limit of agreement between the new Clinic-based modified hair fall count in 60 seconds (CBMHFC 60-S) and conventional home-based hair fall count in 60 seconds (HBHFC 60-S) determining hair fall in women with diffuse hair loss.Materials and Methods: Seventy-five women with diffuse alopecia recruited from Al-Salam Teaching Hospital, Mosul, Iraq underwent assessment of hair fall count by using two instruments, new single reading (CBMHFC 60-S) and conventional three reading (HBHFC 60-S). A multistage statistical analysis of validity tests was used to assess the performance of CBMHFC 60-S in comparison to HBHFC 60-S. These included the estimation of the difference between both methods; correlation and prediction; and lastly estimating accuracy (amount of bias and limits of agreement) using Bland Altman blot. A P-value < 0.05 was considered a statistically significant difference.Results: A non-statistically significant difference (P-value = 0.06) in average hair fall count was estimated by CBMHFC 60-S and HBFHFC 60-S (15.81 ± 7.16 vs 18.18 ± 8.56). A very highly significant linear relationship between both tests (r = 0.434, P-value <0.0001). A regression analysis yields the following prediction equation [CBMHFC 60-S = 9.21 + 0.36* (HBHFC 60-S)]. Bland-Altman blot revealed a high accuracy of the CBHFC 60-S. The count was less than HBHFC 60-S count by an average of 2.38 hairs. The 95% CI of CBMHFC 60-s  in comparison to HBHFC 60-S will fall between -18.95 and 14.19.Conclusion: The new single reading CBMHFC-60S estimation of hair fall count was a valid test reflected by its strong association with an average of three readings of conventional HBHFC-60 and high concordance (low bias and high precision).

Currently, the assessment of autonomy and functional ability involves clinical rating scales. However, scales are often limited in their ability to provide objective and sensitive information. By contrast, information and communication technologies may overcome these limitations by capturing more fully functional as well as cognitive disturbances associated with Alzheimer disease (AD). We investigated the quantitative assessment of autonomy in dementia patients based not only on gait analysis but also on the participant performance on instrumental activities of daily living (IADL) automatically recognized by a video event monitoring system (EMS). Three groups of participants (healthy controls, mild cognitive impairment, and AD patients) had to carry out a standardized scenario consisting of physical tasks (single and dual task) and several IADL such as preparing a pillbox or making a phone call while being recorded. After, video sensor data were processed by an EMS that automatically extracts kinematic parameters of the participants’ gait and recognizes their carried out activities. These parameters were then used for the assessment of the participants’ performance levels, here referred as autonomy. Autonomy assessment was approached as classification task using artificial intelligence methods that takes as input the parameters extracted by the EMS, here referred as behavioral profile. Activities were accurately recognized by the EMS with high precision. The most accurately recognized activities were “prepare medication” with 93% and “using phone” with 89% precision. The diagnostic group classifier obtained a precision of 73.46% when combining the analyses of physical tasks with IADL. In a further analysis, the created autonomy group classifier which obtained a precision of 83.67% when combining physical tasks and IADL. Results suggest that it is possible to quantitatively assess IADL functioning supported by an EMS and that even based on the extracted data the groups could be classified with high accuracy. This means that the use of such technologies may provide clinicians with diagnostic relevant information to improve autonomy assessment in real time decreasing observer biases.

In this paper we address the problem of distributing model checking of timed automata. We demonstrate through four real life examples that the combined processing and memory resources of multi-processor computers can be effectively utilized. The approach assumes a distributed memory model and is applied to both a network of workstations and a symmetric multiprocessor machine. However, certain unexpected phenomena have to be taken into account. We show how in the timed case the search order of the state space is crucial for the effectiveness and scalability of the exploration. An effective heuristic to counter the effect of the search order is provided. Some of the results open up for improvements in the single processor case.

Several analytical conditions and detection limits of various metal elements were examined with regard to the determination of these elements by photoelectric spectrometry in the combination of high-frequency plasma torch apparatus and Ebert-type grating spectrometer (GE-340), using nitrogen as the carrier gas. All the calibration curves for the elements showed good linearity and standard deviations of calcium, zinc, tin, lead, and bismuth were in the range of 1.0–3.2%. It was found that, among the various elements, aluminium, zinc, tungsten, and lead, which are difficult to be determined by flame-spectrometric analysis, can be determined with good sensitivity and high precision by the present method.

For decades now the oil companies and the communities they operate in the vicinity of have had a kind of love-hate relationship with many ups and downs on the way. On the one hand the communities love the economic benefit and regional advancement that the oil companies bring in their wake while on the other they decry the real as well as imaginary environmental, health or safety related threats posed by the oil, gas and petrochemical plants operating in their midst. As the population increases with time so does the demand for land required for urban development. This by necessity results in building of residential and commercial areas in close proximity of process plants, refinery and other oil handling facilities. This paper highlights the need for mutual cooperation that must exist amongst all parties concerned: the Company, the urbanization and planning bodies, community leaders, public servants, journalists and industrialists. This cooperation can only materialize through mutual trust which in turn can only be generated through a better understanding by all of the actual risks associated with various oil refining and oil handling facilities and the risk mitigation measure that the Company employs to ensure all real risks are reduced to a level as low as is reasonably practicable. The concept of "zero-risk" being attainable in a process environment is infeasible. For land use decision-making we must apply formal techniques of quantitative risk assessment (QRA) and other recognized risk evaluation methods that are being used by many government organizations in Europe and North America. The UK Health and Safety Executive (HSE) have issued quite comprehensive guidelines on this topic which have found acceptance worldwide. This paper briefly explains how the QRA technique works and provides several real life examples of use of QRA in land use planning in Bahrain. There is an immediate need for rational risk mitigation by the Company and rational risk acceptance by the community -- all for the sake of common national interest and vision for the future. Creation of a joint review board working in an advisory capacity might be the answer.