Abstract
Security is one of the major challenges for promoting the computer industry. Existing models for assessing security have mostly assumed that different hazards causing the security breach are independent of each other. Dependencies however can exist among different hazardous actions and they may affect the system security attribute greatly. This paper advances the state of the art in quantitative security risk assessment by modeling one such dependency, where multiple sequence-dependent hazardous actions are performed to launch a successful security cyber-attack. Continuous-time Markov chain and semi-Markov process-based methods are proposed to estimate the occurrence probability of a security risk for systems undergoing the sequential cyber-attacks. While the CTMC method is limited to the exponential state transition time, the proposed semi-Markov process-based approach is applicable to analyzing attacks with any arbitrary types of transition time distributions. Both methods are illustrated using case studies where Trojan attacks in the banking application are modeled and analyzed.