Automatically Generating Security Models from System Models to Aid in the Evaluation of AMI Deployment Options

Abstract

System architects should use security models to gain insight into how different design choices impact the overall security of a system. However, it is often difficult for those who do not possess a security modeling background to construct such models. To overcome this challenge we present a case study that demonstrates a novel approach that uses an ontology-assisted model generator to automatically create ADVISE security models from intuitive hand-built system models. More specifically, we consider a case study of a hypothetical utility that wishes to select the most cost-effective of several different intrusion detection system approaches to defend its Advanced Metering Infrastructure (AMI) deployment. We construct an AMI-focused ontology that consists of system model elements, security model elements, and the mapping between the two. We then use the ontology in conjunction with the generator to create security models from a system model. Finally, we discuss the benefits of the use of the approach relative to previous approaches, including an explanation of how it significantly eases the burden of creating complex security models for users without prior security modeling experience.