2022/09/29 by Salman Manzoor, Manzoor, Salman, Antonios Gouglidis +5
Computer Science · #Asset (computer security) #Cloud computing #Computer science #Computer security #Cryptography and Security (cs.CR) #Distributed computing #FOS: Computer and information sciences #Information and Cyber Security #Network Security and Intrusion Detection #Operating system #Software System Performance and Reliability #TRACE (psycholinguistics) #Virtual machine #Vulnerability (computing) #cs.CR
paper · pdf · doi:10.48550/arxiv.2209.14795
published in arXiv (Cornell University) (Cornell University) · 32 pages, 14 figures
arxiv created 2022/09/29 · openalex publication_date 2022/09/29 · arxiv updated 2022/09/30 · openalex created_date 2025/10/10 · openalex updated_date 2026/08/05
Many effective Threat Analysis (TA) techniques exist that focus on analyzing threats to targeted assets (e.g., components, services). These techniques consider static interconnections among the assets. However, in dynamic environments, such as the Cloud, resources can instantiate, migrate across physical hosts, or decommission to provide rapid resource elasticity to the users. It is evident that existing TA techniques cannot address all these requirements. In addition, there is an increasing number of complex multi-layer/multi-asset attacks on Cloud systems, such as the Equifax data breach. Hence, there is a need for threat analysis approaches that are designed to analyze threats in complex, dynamic, and multi-layer Cloud environments. In this paper, we propose ThreatPro that addresses the analysis of multi-layer attacks and supports dynamic interconnections in the Cloud. ThreatPro facilitates threat analysis by developing a technology-agnostic information flow model, which represents the Cloud's functionality through a set of conditional transitions. The model establishes the basis to capture the multi-layer and dynamic interconnections during the life-cycle of a Virtual Machine (VM). Specifically, ThreatPro contributes in (a) enabling the exploration of a threat's behavior and its propagation across the Cloud, and (b) assessing the security of the Cloud by analyzing the impact of multiple threats across various operational layers/assets. Using public information on threats from the National Vulnerability Database (NVD), we validate ThreatPro's capabilities, i.e., (a) identify and trace actual Cloud attacks and (b) speculatively postulate alternate potential attack paths.