The Object Management Group's (OMG) Model Driven Architecture (MDA) strategy envisages a world where models play a more direct role in software production, being amenable to manipulation and transformation by machine. Model Driven Engineering (MDE) is wider in scope than MDA. MDE combines process and analysis with architecture. This article sets out a framework for model driven engineering, which can be used as a point of reference for activity in this area. It proposes an organisation of the modelling 'space' and how to locate models in that space. It discusses different kinds of mappings between models. It explains why process and architecture are tightly connected. It discusses the importance and nature of tools. It identifies the need for defining families of languages and transformations, and for developing techniques for generating/configuring tools from such definitions. It concludes with a call to align metamodelling with formal language engineering techniques.

Model Driven Engineering

An attack graph is a succinct representation of all paths through a system that end in a state where an intruder has successfully achieved his goal. Today Red Teams determine the vulnerability of networked systems by drawing gigantic attack graphs by hand. Constructing attack graphs by hand is tedious, error-prone, and impractical for large systems. By viewing an attack as a violation of a safety property, we can use off-the-shelf model checking technology to produce attack graphs automatically: a successful path from the intruder's viewpoint is a counterexample produced by the model checker In this paper we present an algorithm for generating attack graphs using model checking as a subroutine. Security analysts use attack graphs for detection, defense and forensics. In this paper we present a minimization analysis technique that allows analysts to decide which minimal set of security measures would guarantee the safety of the system. We provide a formal characterization of this problem: we prove that it is polynomially equivalent to the minimum hitting set problem and we present a greedy algorithm with provable bounds. We also present a reliability analysis technique that allows analysts to perform a simple cost-benefit trade-off depending on the likelihoods of attacks. By interpreting attack graphs as Markov Decision Processes we can use the value iteration algorithm to compute the probabilities of intruder success for each attack the graph.

Two Formal Analyses of Attack Graphs

We apply a model checker to the problem of test generation using a new application of mutation analysis. We define syntactic operators, each of which produces a slight variation on a given model. The operators define a form of mutation analysis at the level of the model checker specification. A model checker generates countersamples which distinguish the variations from the original specification. The countersamples can easily be turned into complete test cases, that is, with inputs and expected results. We define two classes of operators: those that produce test cases from which a correct implementation must differ, and those that produce test cases with which it must agree. There are substantial advantages to combining a model checker with mutation analysis. First, test case generation is automatic; each countersample is a complete test case. Second, in sharp contrast to program-based mutation analysis, equivalent mutant identification is also automatic. We apply our method to an example specification and evaluate the resulting test sets with coverage metrics on a Java implementation.

Using Model Checking to Generate Tests from Specifications | NIST

Manufacturers are faced with many challenges, such as globalization, disparate enterprise systems and a lack of platform maturity. These will only multiply as technology advances, offshore manufacturing increases and new ways of working emerge. To overcome these challenges, many manufacturers have embraced product lifecycle management (PLM) or have expanded the use of PLM processes and tools to manage product data effi ciently, with increased visibility and control over the life cycle of the product.

/pdf/product-lifecycle-management-4mlr7de931.pdf

Product lifecycle management

A survey of approaches combining safety and security for industrial control systems

This paper proposes an approach to support cloud brokers finding optimal configurations in the deployment of dependability and security sensitive cloud applications. The approach is based on model-driven principles and uses both UML and Bayesian Networks to capture, analyse and optimise cloud deployment configurations. While the paper is most focused on the initial allocation phase, the approach is extensible to the operational phases of the life-cycle. In such a way, a continuous improvement of cloud applications may be realised by monitoring, enforcing and re-negotiating cloud resources following detected anomalies and failures.

Automatic Resource Allocation for High Availability Cloud Services

Dynamic state machines for modelling railway control systems

Modern physical protection systems integrate a number of security systems (including procedures, equipments, and personnel) into a single interface to ensure an adequate level of protection of people and critical assets against malevolent human actions. Due to the critical functions of a protection system, the quantitative evaluation of its effectiveness is an important issue that still raises several challenges. In this paper we propose a model-driven approach to support the design and the evaluation of physical protection systems based on (a) UML models representing threats, protection facilities, assets, and relationships among them, and (b) the automatic construction of a Bayesian Network model to estimate the vulnerability of different system configurations. Hence, the proposed approach is useful both in the context of vulnerability assessment and in designing new security systems as it enables what-if and cost–benefit analyses. A real-world case study is further illustrated in order to validate and demonstrate the potentiality of the approach. Specifically, two attack scenarios are considered against the depot of a mass transit transportation system in Milan, Italy.

A model-driven approach for vulnerability evaluation of modern physical protection systems

Actors of railway systems are more and more required to achieve certain levels of system performances and acceptable standards of service quality offered to passengers. To reach this aim, effects on both supply and demand-side induced by different solutions, need to be assessed within design and real-time operation phases, especially when failures occur during service. To this purpose, in this paper an integrated framework is introduced to simulate railway operation considering also interactions with passengers demand. A practical application to a MRT line has been realized, analyzing impacts of two recovery strategies for different failure scenarios. Results underline the necessity of assessing both service availability and quality of service to identify the most effective intervention solution, and highlight the relevance of the proposed framework to support decisional processes.

A simulation framework for supporting design and real-time decisional phases in railway systems

The design of complex Physical Protection Systems (PPSs) still raises some challenges despite the high number of technologies for smart surveillance. One reason is the lack of effective methodologies able to support the PPS designer in evaluating the effectiveness of the system on varying design choices. Indeed, an estimation of the system vulnerability should be performed in the early phases of the PPS design. This paper introduces a model-based methodology for the quantitative estimation of the vulnerability of a PPS. The proposed methodology clearly defines a compositional approach which takes advantage from the usage of predefined patterns for the creation of vulnerability models. In particular, the paper proposes some Petri Net patterns able to capture the behavioural aspects of several assets and actors involved in attacking/defending scenarios.

Roberto Nardone

Papers

Automatic Resource Allocation for High Availability Cloud Services

Dynamic state machines for modelling railway control systems

A model-driven approach for vulnerability evaluation of modern physical protection systems

A simulation framework for supporting design and real-time decisional phases in railway systems

A Petri Net Pattern-Oriented Approach for the Design of Physical Protection Systems