A requires/provides model for computer attacks

By S. Templeton, K. Levitt. New Security Paradigms Workshop, 2001

437 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation (2007, background): “A more applicable area of alert correlation research is multistage attack recognition, in which predefined scenario templates capture multiple state transition sequences that may be initiated by multiple threat agents [40] [29].”
Scalable, graph-based network vulnerability analysis (2002, background): “Templeton and Levitt [16] develop a ‘requires/provides’ model for modeling chains of network attacks and reducing the complexity of such a model.”
A survey of coordinated attacks and collaborative intrusion detection (2010, background): “JIGSAW (Templeton and Levitt, 2000) is another attack specification language that is designed for identifying the casual relationship between individual alerts using pre and post-conditions.”
Comprehensive approach to intrusion detection alert correlation (2004, methodology): “Another example that uses pre and postconditions to identify causal relationships between alerts is JIGSAW [45].”
Efficient minimum-cost network hardening via exploit dependency graphs (2003, background): “Also, there has been work that emphasizes the modeling rather than the analysis of attacks [16][17].”