Towards a requirements-driven framework for detecting malicious behavior against software systems
Hamzeh Zawawy, Kostas Kontogiannis, John Mylopoulos, Serge Mankovskii · Conference of the Centre for Advanced Studies on Collaborative Research · 2011
Root cause determination for software failures that occurred due to intentional or unintentional third party activities is a difficult and challenging task. In this paper, we propose a new technique for identifying the root causes of system failures stemming from external interventions that is based first, on modeling the conditions by which a system delivers its functionality utilizing goal models, second on modeling the conditions by which system functionality can be compromised utilizing anti-goal models, third representing logged data as well as, goal and anti-goal models as rules and facts in a knowledge base and fourth, utilizing a probabilistic reasoning technique that is based on the use of Markov Logic Networks. The technique is evaluated in a medium size COTS based system and the DARPA 2000 Intrusion Detection data set.