dinesha ranathunga | University of Adelaide (original) (raw)

Papers by dinesha ranathunga

2019 Military Communications and Information Systems Conference (MilCIS), 2019

In this paper we examine computational workload modelling in a generic maritime combat system. We... more In this paper we examine computational workload modelling in a generic maritime combat system. We show how to construct models so that executable modelling can then be used to experiment with different hardware approaches for cost, power or performance improvements. This can assist in identifying problems earlier in the design lifecycle than by using traditional design methodologies such as prototyping. We use a generic sonar suite as an exemplar, showing the considerations required in building executable models for traditional and adaptive beamforming algorithms.

ArXiv, 2018

IoT devices are increasingly being implicated in cyber-attacks, driving community concern about t... more IoT devices are increasingly being implicated in cyber-attacks, driving community concern about the risks they pose to critical infrastructure, corporations, and citizens. In order to reduce this risk, the IETF is pushing IoT vendors to develop formal specifications of the intended purpose of their IoT devices, in the form of a Manufacturer Usage Description (MUD), so that their network behavior in any operating environment can be locked down and verified rigorously. This paper aims to assist IoT manufacturers in developing and verifying MUD profiles, while also helping adopters of these devices to ensure they are compatible with their organizational policies. Our first contribution is to develop a tool that takes the traffic trace of an arbitrary IoT device as input and automatically generates a MUD profile for it. We contribute our tool as open source, apply it to 28 consumer IoT devices, and highlight insights and challenges encountered in the process. Our second contribution is ...

Rubin and Greer stated that “The single most important factor of your firewall’s security is how ... more Rubin and Greer stated that “The single most important factor of your firewall’s security is how you configure it.” [18]. However, firewall configuration is known to be difficult to get right. In particular domains, such as SCADA networks, while there are best practice standards that help, an overlooked component is the specification of firewall reporting policies. Our research tackles this question from first principles: we ask what are the uses of firewall reports, and we allow these to guide how reporting should be performed. We approach the problem by formalising the notion of scope and granularity of a report across several dimensions: time, network elements, policies, etc.

IEEE Transactions on Dependable and Secure Computing, 2020

IoT devices are increasingly being implicated in cyberattacks, raising community concern about th... more IoT devices are increasingly being implicated in cyberattacks, raising community concern about the risks they pose to critical infrastructure, corporations, and citizens. In order to reduce this risk, the IETF is pushing IoT vendors to develop formal specifications of the intended purpose of their IoT devices, in the form of a Manufacturer Usage Description (MUD), so that their network behavior in any operating environment can be locked down and verified rigorously. This paper aims to assist IoT manufacturers in developing and verifying MUD profiles, while also helping adopters of these devices to ensure they are compatible with their organizational policies and track device network behavior using their MUD profile. Our first contribution is to develop a tool that takes the traffic trace of an arbitrary IoT device as input and automatically generates the MUD profile for it. We contribute our tool as open source, apply it to 28 consumer IoT devices, and highlight insights and challenges encountered in the process. Our second contribution is to apply a formal semantic framework that not only validates a given MUD profile for consistency, but also checks its compatibility with a given organizational policy. We apply our framework to representative organizations and selected devices, to demonstrate how MUD can reduce the effort needed for IoT acceptance testing. Finally, we show how operators can dynamically identify IoT devices using known MUD profiles and monitor their behavioral changes in their network.

IEEE Transactions on Dependable and Secure Computing, 2020

Reliable network-policy specification requires abstractions that can naturally model policies tog... more Reliable network-policy specification requires abstractions that can naturally model policies together with rigorous formal foundations to reason about these policies. Current specifications satisfy one of these requirements or the other, but not both. A Metagraph is a generalized graph theoretic structure that overcomes this limitation. They are a natural way of expressing high-level end-to-end network policies. The rich formal foundations provided by metagraph algebra help analyze important network-policy properties such as reachability, redundancy and consistency. These features make metagraphs a clear choice for modeling and reasoning about policies in Formally-Verifiable Policy-Defined Networking (FV-PDN): a network-programming paradigm which has verifiability built-in. In this paper, we demonstrate the use of metagraphs in policy specification by modeling and analyzing real policies from a large university network. We show their benefit in FV-PDN by developing a prototype solution which automatically refines metagraph-based high-level policies to device configurations and deploys them to a SDN-based emulated network.

SoftwareX, 2017

In this paper we present MGtoolkit: an open-source Python package for implementing metagraphs-a f... more In this paper we present MGtoolkit: an open-source Python package for implementing metagraphs-a first of its kind. Metagraphs are commonly used to specify and analyse business and computer-network policies alike. MGtoolkit can help verify such policies and promotes learning and experimentation with metagraphs. The package currently provides purely textual output for visualising metagraphs and their analysis results.

Proceedings of the 13th International Joint Conference on e-Business and Telecommunications, 2016

A common goal in network-management is security. Reliable security requires confidence in the lev... more A common goal in network-management is security. Reliable security requires confidence in the level of protection provided. But, many obstacles hinder reliable security management; most prominent is the lack of built-in verifiability in existing management paradigms. This shortfall makes it difficult to provide assurance that the expected security outcome is consistent pre-and post-deployment. Our research tackles the problem from first principles: we identify the verifiability requirements of robust security management, evaluate the limitations of existing paradigms and propose a new paradigm with verifiability built in: Formally-Verifiable Policy-Defined Networking (FV-PDN). In particular, we pay attention to firewalls which protect network data and resources from unauthorised access. We show how FV-PDN can be used to configure firewalls reliably in mission critical networks to protect them from cyber attacks.

IEEE Transactions on Network and Service Management, 2016

Firewall configuration is an important activity for any modern day business. It is particularly a... more Firewall configuration is an important activity for any modern day business. It is particularly a critical task for the supervisory control and data acquisition (SCADA) networks that control power stations, water distribution, factory automation, etc. Lack of automation tools to assist with this critical task has resulted in unoptimised, error prone configurations that expose these networks to cyber attacks. Automation can make designing firewall configurations more reliable and their deployment increasingly cost-effective. Best practices have been proposed by the industry for developing high-level security policy (e.g., ANSI/ISA 62443-1-1). But these best practices lack specification in several key aspects needed to allow a firewall to be automatically configured. For instance, the standards are vague on how firewall management policies should be captured at a high-level using its specifications. In this paper, we uncover these missing pieces and propose extensions. We apply our extended best-practice specification to real-world firewall case studies to achieve multiple objectives: 1) to evaluate the usefulness of the refined best-practice in the automated specification of firewalls and 2) to illustrate that even in simple cases, SCADA networks are often insecure due to their misconfigured firewalls.

2016 IEEE Symposium on Computers and Communication (ISCC), 2016

Firewalls are a crucial element of any modern day business; they protect data and resources in a ... more Firewalls are a crucial element of any modern day business; they protect data and resources in a communications network from unauthorised access. In particular domains, such as SCADA networks, there are guidelines for firewall configuration, but currently there are no automated means to test compliance. Our research tackles this from first principles: we ask how firewall policies can be described at a high-level, independent of firewall-vendor and network minutiae. The semantic foundations we propose allow us to compare network-wide firewall policies and check if they are equivalent; or one is contained in the other in meaningful ways. These foundations also enable policy change-impact analysis and help identify functional discrepancies between multiple policy designs from users in distinct policy subdomains (e.g., SCADA engineers, Corporate admins).

Lecture Notes in Computer Science, 2016

Rubin and Greer stated that "The single most important factor of your firewall's security is how ... more Rubin and Greer stated that "The single most important factor of your firewall's security is how you configure it." [18]. However, firewall configuration is known to be difficult to get right. In particular domains, such as SCADA networks, while there are best practice standards that help, an overlooked component is the specification of firewall reporting policies. Our research tackles this question from first principles: we ask what are the uses of firewall reports, and we allow these to guide how reporting should be performed. We approach the problem by formalising the notion of scope and granularity of a report across several dimensions: time, network elements, policies, etc.

Firewall configuration is critical, yet often conducted manually with inevitable errors, leaving ... more Firewall configuration is critical, yet often conducted manually with inevitable errors, leaving networks vulnerable to cyber attack [40]. The impact of misconfigured firewalls can be catastrophic in Supervisory Control and Data Acquisition (SCADA) networks. These networks control the distributed assets of industrial systems such as power generation and water distribution systems. Automation can make designing firewall configurations less tedious and their deployment more reliable. In this paper, we propose ForestFirewalls, a high-level approach to configuring SCADA firewalls. Our goals are three-fold. We aim to: first, decouple implementation details from security policy design by abstracting the former; second, simplify policy design; and third, provide automated checks, pre and post-deployment, to guarantee configuration accuracy. We achieve these goals by automating the implementation of a policy to a network and by auto-validating each stage of the configuration process. We tes...

Proceedings of the 2018 Workshop on IoT Security and Privacy, 2018

IoT devices are increasingly being implicated in cyber-attacks, raising community concern about t... more IoT devices are increasingly being implicated in cyber-attacks, raising community concern about the risks they pose to critical infrastructure, corporations, and citizens. In order to reduce this risk, the IETF is pushing IoT vendors to develop formal specifications of the intended purpose of their IoT devices, in the form of a Manufacturer Usage Description (MUD), so that their network behavior in any operating environment can be locked down and verified rigorously. This paper aims to assist IoT manufacturers in developing and verifying MUD profiles, while also helping adopters of these devices to ensure they are compatible with their organizational policies. Our first contribution is to develop a tool that takes the traffic trace of an arbitrary IoT device as input and automatically generates the MUD profile for it. We contribute our tool as open source, apply it to 28 consumer IoT devices, and highlight insights and challenges encountered in the process. Our second contribution is to apply a formal semantic framework that not only validates a given MUD profile for consistency, but also checks its compatibility with a given organizational policy. Finally, we apply our framework to representative organizations and selected devices, to demonstrate how MUD can reduce the effort needed for IoT acceptance testing. CCS CONCEPTS • Security and privacy → Formal methods and theory of security;

ACM Transactions on Management Information Systems, 2021

Healthcare data are arguably the most private of personal data. This very private information in ... more Healthcare data are arguably the most private of personal data. This very private information in the wrong hands can lead to identity theft, prescription fraud, insurance fraud, and an array of other crimes. Electronic-health systems such as My Health Record in Australia holds great promise in sharing medical data and improving healthcare quality. But, a key privacy issue in these systems is the misuse of healthcare data by “authorities.” The recent General Data Protection Regulation (GDPR) introduced in the EU aims to reduce personal-data misuse. But, there are no tools currently available to accurately reconcile a domestic E-health policy against the GDPR to identify discrepancies. Reconciling privacy policies is also non-trivial, because policies are often written in free text, making them subject to human interpretation. In this article, we propose a tool that allows the description of E-health privacy policies, represents them using formal constructs making the policies precise...

Proceedings of the 1st ACM Workshop on Cyber-Physical System Security - CPSS '15, 2015

Firewall configuration is a critical activity for the Supervisory Control and Data Acquisition (S... more Firewall configuration is a critical activity for the Supervisory Control and Data Acquisition (SCADA) networks that control power stations, water distribution, factory automation, etc. The American National Standards Institute (ANSI) provides specifications for the best practices in developing high-level security policy [9]. However, firewalls continue to be configured manually, a common but error prone process. Automation can make designing firewall configurations more reliable and their deployment increasingly cost-effective. ANSI best practices lack specification in several key aspects needed to allow a firewall to be automatically configured. In this paper we discuss the missing aspects of the existing best practice specifications and propose solutions. We then apply our corrected best practice specifications to real SCADA firewall configurations and evaluate their usefulness for high-level automated specification of firewalls.

2018 Sixth International Symposium on Computing and Networking (CANDAR), 2018

Modern system administrators need to monitor disclosed software vulnerabilities and address appli... more Modern system administrators need to monitor disclosed software vulnerabilities and address applicable vulnerabilities via patching, reconfiguration and other measures. In 2017, over 14,000 new vulnerabilities were disclosed, so, a key question for administrators is which vulnerabilities to prioritise. The Common Vulnerability Scoring System (CVSS) is often used to decide which vulnerabilities pose the greatest risk and hence inform patching policy. A CVSS score is indicative of a vulnerability severity, but it doesn't predict the time to exploit for a vulnerability. A prediction of exploit delay would greatly assist vendors in prioritising their patch releases and system administrators in prioritising the installation of these patches. In this paper, we study the effect of CVSS metrics on the time until a proof of concept exploit is developed. We use the National Vulnerability Database (NVD) and the Exploit Database, which represent two of the largest listings of vulnerabilities and exploit data, to show how CVSS metrics can provide better insight into exploit delay. We also investigate the time lag associated with populating CVSS metrics and find that the median delay has increased rapidly from a single day prior to 2017 to 19 days in 2018. This is an alarming trend, given the rapid decline in median vulnerability exploit time from 296 days in 2005 to six days in 2018.

Proceedings of the 13th International Joint Conference on e-Business and Telecommunications, 2016

Model Based Systems Engineering (MBSE) is accepted as a key enabler for evaluating requirements a... more Model Based Systems Engineering (MBSE) is accepted as a key enabler for evaluating requirements and designs of combat systems. Systems Execution Modelling (SEM) is an MBSE approach that allows the software system to be modelled independently from the target hardware, inferring hardware characteristics by direct stimulation and measurement. SEM builds a system model out of simple workers, and this paper proposes enhancements to existing workload models to better support the evaluation of combat systems in heterogeneous compute environments comprised of CPUs and GPUs.

2019 Military Communications and Information Systems Conference (MilCIS), 2019

In this paper we examine computational workload modelling in a generic maritime combat system. We... more In this paper we examine computational workload modelling in a generic maritime combat system. We show how to construct models so that executable modelling can then be used to experiment with different hardware approaches for cost, power or performance improvements. This can assist in identifying problems earlier in the design lifecycle than by using traditional design methodologies such as prototyping. We use a generic sonar suite as an exemplar, showing the considerations required in building executable models for traditional and adaptive beamforming algorithms.

ArXiv, 2018

IoT devices are increasingly being implicated in cyber-attacks, driving community concern about t... more IoT devices are increasingly being implicated in cyber-attacks, driving community concern about the risks they pose to critical infrastructure, corporations, and citizens. In order to reduce this risk, the IETF is pushing IoT vendors to develop formal specifications of the intended purpose of their IoT devices, in the form of a Manufacturer Usage Description (MUD), so that their network behavior in any operating environment can be locked down and verified rigorously. This paper aims to assist IoT manufacturers in developing and verifying MUD profiles, while also helping adopters of these devices to ensure they are compatible with their organizational policies. Our first contribution is to develop a tool that takes the traffic trace of an arbitrary IoT device as input and automatically generates a MUD profile for it. We contribute our tool as open source, apply it to 28 consumer IoT devices, and highlight insights and challenges encountered in the process. Our second contribution is ...

Rubin and Greer stated that “The single most important factor of your firewall’s security is how ... more Rubin and Greer stated that “The single most important factor of your firewall’s security is how you configure it.” [18]. However, firewall configuration is known to be difficult to get right. In particular domains, such as SCADA networks, while there are best practice standards that help, an overlooked component is the specification of firewall reporting policies. Our research tackles this question from first principles: we ask what are the uses of firewall reports, and we allow these to guide how reporting should be performed. We approach the problem by formalising the notion of scope and granularity of a report across several dimensions: time, network elements, policies, etc.

IEEE Transactions on Dependable and Secure Computing, 2020

IoT devices are increasingly being implicated in cyberattacks, raising community concern about th... more IoT devices are increasingly being implicated in cyberattacks, raising community concern about the risks they pose to critical infrastructure, corporations, and citizens. In order to reduce this risk, the IETF is pushing IoT vendors to develop formal specifications of the intended purpose of their IoT devices, in the form of a Manufacturer Usage Description (MUD), so that their network behavior in any operating environment can be locked down and verified rigorously. This paper aims to assist IoT manufacturers in developing and verifying MUD profiles, while also helping adopters of these devices to ensure they are compatible with their organizational policies and track device network behavior using their MUD profile. Our first contribution is to develop a tool that takes the traffic trace of an arbitrary IoT device as input and automatically generates the MUD profile for it. We contribute our tool as open source, apply it to 28 consumer IoT devices, and highlight insights and challenges encountered in the process. Our second contribution is to apply a formal semantic framework that not only validates a given MUD profile for consistency, but also checks its compatibility with a given organizational policy. We apply our framework to representative organizations and selected devices, to demonstrate how MUD can reduce the effort needed for IoT acceptance testing. Finally, we show how operators can dynamically identify IoT devices using known MUD profiles and monitor their behavioral changes in their network.

IEEE Transactions on Dependable and Secure Computing, 2020

Reliable network-policy specification requires abstractions that can naturally model policies tog... more Reliable network-policy specification requires abstractions that can naturally model policies together with rigorous formal foundations to reason about these policies. Current specifications satisfy one of these requirements or the other, but not both. A Metagraph is a generalized graph theoretic structure that overcomes this limitation. They are a natural way of expressing high-level end-to-end network policies. The rich formal foundations provided by metagraph algebra help analyze important network-policy properties such as reachability, redundancy and consistency. These features make metagraphs a clear choice for modeling and reasoning about policies in Formally-Verifiable Policy-Defined Networking (FV-PDN): a network-programming paradigm which has verifiability built-in. In this paper, we demonstrate the use of metagraphs in policy specification by modeling and analyzing real policies from a large university network. We show their benefit in FV-PDN by developing a prototype solution which automatically refines metagraph-based high-level policies to device configurations and deploys them to a SDN-based emulated network.

SoftwareX, 2017

In this paper we present MGtoolkit: an open-source Python package for implementing metagraphs-a f... more In this paper we present MGtoolkit: an open-source Python package for implementing metagraphs-a first of its kind. Metagraphs are commonly used to specify and analyse business and computer-network policies alike. MGtoolkit can help verify such policies and promotes learning and experimentation with metagraphs. The package currently provides purely textual output for visualising metagraphs and their analysis results.

Proceedings of the 13th International Joint Conference on e-Business and Telecommunications, 2016

A common goal in network-management is security. Reliable security requires confidence in the lev... more A common goal in network-management is security. Reliable security requires confidence in the level of protection provided. But, many obstacles hinder reliable security management; most prominent is the lack of built-in verifiability in existing management paradigms. This shortfall makes it difficult to provide assurance that the expected security outcome is consistent pre-and post-deployment. Our research tackles the problem from first principles: we identify the verifiability requirements of robust security management, evaluate the limitations of existing paradigms and propose a new paradigm with verifiability built in: Formally-Verifiable Policy-Defined Networking (FV-PDN). In particular, we pay attention to firewalls which protect network data and resources from unauthorised access. We show how FV-PDN can be used to configure firewalls reliably in mission critical networks to protect them from cyber attacks.

IEEE Transactions on Network and Service Management, 2016

Firewall configuration is an important activity for any modern day business. It is particularly a... more Firewall configuration is an important activity for any modern day business. It is particularly a critical task for the supervisory control and data acquisition (SCADA) networks that control power stations, water distribution, factory automation, etc. Lack of automation tools to assist with this critical task has resulted in unoptimised, error prone configurations that expose these networks to cyber attacks. Automation can make designing firewall configurations more reliable and their deployment increasingly cost-effective. Best practices have been proposed by the industry for developing high-level security policy (e.g., ANSI/ISA 62443-1-1). But these best practices lack specification in several key aspects needed to allow a firewall to be automatically configured. For instance, the standards are vague on how firewall management policies should be captured at a high-level using its specifications. In this paper, we uncover these missing pieces and propose extensions. We apply our extended best-practice specification to real-world firewall case studies to achieve multiple objectives: 1) to evaluate the usefulness of the refined best-practice in the automated specification of firewalls and 2) to illustrate that even in simple cases, SCADA networks are often insecure due to their misconfigured firewalls.

2016 IEEE Symposium on Computers and Communication (ISCC), 2016

Firewalls are a crucial element of any modern day business; they protect data and resources in a ... more Firewalls are a crucial element of any modern day business; they protect data and resources in a communications network from unauthorised access. In particular domains, such as SCADA networks, there are guidelines for firewall configuration, but currently there are no automated means to test compliance. Our research tackles this from first principles: we ask how firewall policies can be described at a high-level, independent of firewall-vendor and network minutiae. The semantic foundations we propose allow us to compare network-wide firewall policies and check if they are equivalent; or one is contained in the other in meaningful ways. These foundations also enable policy change-impact analysis and help identify functional discrepancies between multiple policy designs from users in distinct policy subdomains (e.g., SCADA engineers, Corporate admins).

Lecture Notes in Computer Science, 2016

Rubin and Greer stated that "The single most important factor of your firewall's security is how ... more Rubin and Greer stated that "The single most important factor of your firewall's security is how you configure it." [18]. However, firewall configuration is known to be difficult to get right. In particular domains, such as SCADA networks, while there are best practice standards that help, an overlooked component is the specification of firewall reporting policies. Our research tackles this question from first principles: we ask what are the uses of firewall reports, and we allow these to guide how reporting should be performed. We approach the problem by formalising the notion of scope and granularity of a report across several dimensions: time, network elements, policies, etc.

Firewall configuration is critical, yet often conducted manually with inevitable errors, leaving ... more Firewall configuration is critical, yet often conducted manually with inevitable errors, leaving networks vulnerable to cyber attack [40]. The impact of misconfigured firewalls can be catastrophic in Supervisory Control and Data Acquisition (SCADA) networks. These networks control the distributed assets of industrial systems such as power generation and water distribution systems. Automation can make designing firewall configurations less tedious and their deployment more reliable. In this paper, we propose ForestFirewalls, a high-level approach to configuring SCADA firewalls. Our goals are three-fold. We aim to: first, decouple implementation details from security policy design by abstracting the former; second, simplify policy design; and third, provide automated checks, pre and post-deployment, to guarantee configuration accuracy. We achieve these goals by automating the implementation of a policy to a network and by auto-validating each stage of the configuration process. We tes...

Proceedings of the 2018 Workshop on IoT Security and Privacy, 2018

IoT devices are increasingly being implicated in cyber-attacks, raising community concern about t... more IoT devices are increasingly being implicated in cyber-attacks, raising community concern about the risks they pose to critical infrastructure, corporations, and citizens. In order to reduce this risk, the IETF is pushing IoT vendors to develop formal specifications of the intended purpose of their IoT devices, in the form of a Manufacturer Usage Description (MUD), so that their network behavior in any operating environment can be locked down and verified rigorously. This paper aims to assist IoT manufacturers in developing and verifying MUD profiles, while also helping adopters of these devices to ensure they are compatible with their organizational policies. Our first contribution is to develop a tool that takes the traffic trace of an arbitrary IoT device as input and automatically generates the MUD profile for it. We contribute our tool as open source, apply it to 28 consumer IoT devices, and highlight insights and challenges encountered in the process. Our second contribution is to apply a formal semantic framework that not only validates a given MUD profile for consistency, but also checks its compatibility with a given organizational policy. Finally, we apply our framework to representative organizations and selected devices, to demonstrate how MUD can reduce the effort needed for IoT acceptance testing. CCS CONCEPTS • Security and privacy → Formal methods and theory of security;

ACM Transactions on Management Information Systems, 2021

Healthcare data are arguably the most private of personal data. This very private information in ... more Healthcare data are arguably the most private of personal data. This very private information in the wrong hands can lead to identity theft, prescription fraud, insurance fraud, and an array of other crimes. Electronic-health systems such as My Health Record in Australia holds great promise in sharing medical data and improving healthcare quality. But, a key privacy issue in these systems is the misuse of healthcare data by “authorities.” The recent General Data Protection Regulation (GDPR) introduced in the EU aims to reduce personal-data misuse. But, there are no tools currently available to accurately reconcile a domestic E-health policy against the GDPR to identify discrepancies. Reconciling privacy policies is also non-trivial, because policies are often written in free text, making them subject to human interpretation. In this article, we propose a tool that allows the description of E-health privacy policies, represents them using formal constructs making the policies precise...

Proceedings of the 1st ACM Workshop on Cyber-Physical System Security - CPSS '15, 2015

Firewall configuration is a critical activity for the Supervisory Control and Data Acquisition (S... more Firewall configuration is a critical activity for the Supervisory Control and Data Acquisition (SCADA) networks that control power stations, water distribution, factory automation, etc. The American National Standards Institute (ANSI) provides specifications for the best practices in developing high-level security policy [9]. However, firewalls continue to be configured manually, a common but error prone process. Automation can make designing firewall configurations more reliable and their deployment increasingly cost-effective. ANSI best practices lack specification in several key aspects needed to allow a firewall to be automatically configured. In this paper we discuss the missing aspects of the existing best practice specifications and propose solutions. We then apply our corrected best practice specifications to real SCADA firewall configurations and evaluate their usefulness for high-level automated specification of firewalls.

2018 Sixth International Symposium on Computing and Networking (CANDAR), 2018

Modern system administrators need to monitor disclosed software vulnerabilities and address appli... more Modern system administrators need to monitor disclosed software vulnerabilities and address applicable vulnerabilities via patching, reconfiguration and other measures. In 2017, over 14,000 new vulnerabilities were disclosed, so, a key question for administrators is which vulnerabilities to prioritise. The Common Vulnerability Scoring System (CVSS) is often used to decide which vulnerabilities pose the greatest risk and hence inform patching policy. A CVSS score is indicative of a vulnerability severity, but it doesn't predict the time to exploit for a vulnerability. A prediction of exploit delay would greatly assist vendors in prioritising their patch releases and system administrators in prioritising the installation of these patches. In this paper, we study the effect of CVSS metrics on the time until a proof of concept exploit is developed. We use the National Vulnerability Database (NVD) and the Exploit Database, which represent two of the largest listings of vulnerabilities and exploit data, to show how CVSS metrics can provide better insight into exploit delay. We also investigate the time lag associated with populating CVSS metrics and find that the median delay has increased rapidly from a single day prior to 2017 to 19 days in 2018. This is an alarming trend, given the rapid decline in median vulnerability exploit time from 296 days in 2005 to six days in 2018.

Proceedings of the 13th International Joint Conference on e-Business and Telecommunications, 2016

Model Based Systems Engineering (MBSE) is accepted as a key enabler for evaluating requirements a... more Model Based Systems Engineering (MBSE) is accepted as a key enabler for evaluating requirements and designs of combat systems. Systems Execution Modelling (SEM) is an MBSE approach that allows the software system to be modelled independently from the target hardware, inferring hardware characteristics by direct stimulation and measurement. SEM builds a system model out of simple workers, and this paper proposes enhancements to existing workload models to better support the evaluation of combat systems in heterogeneous compute environments comprised of CPUs and GPUs.