Search

Security threat and risk assessment of systems requires the integrated use of information from multiple knowledge bases. Such use is typically carried out ad-hoc by security experts in an unstructured manner. Also, this ad-hoc use of information often lacks foundations that allow for rigorous, disciplined applications of policy enforcement and the establishment of a well-integrated body of knowledge. This hinders organisational learning as well as the maturation of the threat modelling discipline. In this article, we uncover a newly developed extension of a state-of-the-art modelling tool that allows users to integrate and curate security-related information from multiple knowledge bases. Specifically, we provide catalogues of threats and security controls based on information from CAPEC, ATT&CK, and NIST SP800-53. We demonstrate the ability to curate security information using the designed solution. We highlight the contribution to improving the communication of security information, including the systematic mapping between user-defined security guidance and information derived from knowledge bases. The solution is open source and relies on model-to-model transformations and extendable threat and security control catalogues. Accordingly, the solution allows prospective users to adapt the modelling environment to their needs as well as keep it current with respect to evolving knowledge bases.

The cyber threat landscape is highly dynamic, posing a significant risk to the operations of systems and organisations. An organisation should, therefore, continuously monitor for new threats and properly contextualise them to identify and manage the resulting risks. Risk identification is typically performed manually, relying on the integration of information from various systems as well as subject matter expert knowledge. This manual risk identification hinders the systematic consideration of new, emerging threats. This paper describes a novel method to promote automated cyber risk identification: OnToRisk. This artificial intelligence method integrates information from various sources using formal ontology definitions, and then relies on these definitions to robustly frame cybersecurity threats and provide risk-related insights. We describe a successful case study implementation of the method to frame the threat from a newly disclosed vulnerability and identify its induced organisational risk. The case study is representative of common and widespread real-life challenges, and, therefore, showcases the feasibility of using OnToRisk to sustainably identify new risks. Further applications may contribute to establishing OnToRisk as a comprehensive, disciplined mechanism for risk identification.

Radar systems are mainly used for tracking aircraft, missiles, satellites, and watercraft. In many cases, information regarding the objects detected by a radar system is sent to, and used by, a peripheral consuming system, such as a missile system or a graphical user interface used by an operator. Those systems process the data stream and make real-time operational decisions based on the data received. Given this, the reliability and availability of information provided by radar systems have grown in importance. Although the field of cyber security has been continuously evolving, no prior research has focused on anomaly detection in radar systems. In this paper, we present an unsupervised deep-learning-based method for detecting anomalies in radar system data streams; we take into consideration the fact that a data stream created by a radar system is heterogeneous, i.e., it contains both numerical and categorical features with non-linear and complex relationships. We propose a novel technique that learns the correlation between numerical features and an embedding representation of categorical features in an unsupervised manner. The proposed technique, which allows for the detection of the malicious manipulation of critical fields in a data stream, is complemented by a timing-interval anomaly-detection mechanism proposed for the detection of message-dropping attempts. Real radar system data were used to evaluate the proposed method. Our experiments demonstrated the method’s high detection accuracy on a variety of data-stream manipulation attacks (an average detection rate of 88% with a false -alarm rate of 1.59%) and message-dropping attacks (an average detection rate of 92% with a false-alarm rate of 2.2%).

Model-based Systems Engineering (MBSE) approaches are a step forward in the evolution of computer-aided engineering, and yet, they often incorporate deficiencies that may jeopardize their practical utility and usability, as well as the validity of the resulting models. We demonstrate how a domain-specific modeling approach can relieve some hurdles in adopting MBSE, and how it can be used in tandem with a general-purpose modeling approach to augment and introduce rigor to models. Specifically, we demonstrate the consequences of theoretical issues that were previously identified in Object Process Methodology and suggest an approach to solve them. We use a generalized case-study—derived from extensive process modeling in both academia and industry—to show that a domain-specific model can significantly relax the user’s modeling effort. This demonstration is based on two quantitative metrics: the number of representational elements and available modeling tactics. We discuss the contribution of our approach to model quality, particularly with respect to its rigor and communicability.

The COVID-19 pandemic caught hospitals unprepared. The need to treat patients remotely and with limited resources led hospitals to identify a gap in their operational situational awareness. During the pandemic, Israeli Aerospace Industries helped hospitals to address the gap by designing a system to support their effective operation, management and decision making. In this paper, we report on the development of a functional, working prototype of the system using model-based engineering approach and tools. Our approach relies on domain-specific modeling, incorporating metamodeling and domain-specific representations based on the problem domain’s ontology. The tools practiced are those embedded into the Eclipse Modeling Framework—specifically, Ecore Tools and Sirius. While these technological tools are typically used to create dedicated, engineering-related modeling tools, in this work, we use them to create a functional system prototype. We discuss the advantages of our approach as well as the challenges with respect to the existing tools and their underlying technology. Based on the reported experience, we encourage practitioners to adopt model-based engineering as an effective way to develop systems. Furthermore, we call researchers and tool developers to improve the state-of-the-art as well as the existing implementations of pertinent tools to support model-based rapid prototyping.

The planning of system development efforts is crucial to the successful realization of projects. However, development planning typically lacks systematic, engineering discipline, and consequently risks project and business success. Model-based process design is a potential information systems approach to addressing the increasing complexity of such planning. We characterize the ontology of development process design, based on real-life observations and scientific publications. We then synthesize the required ontology with the desirable characteristics of models, and derive key requirements for model-based development process design. Next, these requirements are used to evaluate the adequacy of three prominent, standardized model-based process design approaches—BPMN, OPM and SPEM. The findings reveal that the surveyed models are a partial fit, and do not promote sound process design. Finally, by generalizing the categorical evaluation results, possible root causes for the identified inadequacies are proposed. A new model design, which should rely on the formulated requirements set, is called for, in pursuit of a wider adoption of model-based design paradigms and better information systems realization to support the development of complex systems.