Attacks Generation by Detecting Attack Surfaces

In the development process of software and systems, one of the main challenges is to detect the existing attack surfaces and their exact related attacks. In this paper, we address the issue of generating attacks related to systems that are designed by using SysML activity diagrams. For this purpose, we develop a practical framework to enable attack surfaces detection and producing their related attacks. First, we propose a formalization of SysML activity diagrams, then we rely on the standard catalog of attacks to build a library of attack patterns. The extracted patterns are modeled as SysML activity diagrams too. Finally, given an SysML activity diagram of a system and a library of SysML attack patterns, we propose an algorithm that automatically detects attacks surfaces relevant to a system under test and generate their related possible attacks.