State-Based Analysis in ADVISE

There is an increasing need for quantitative security metrics to empower the decision-making of system architects and administrators. We previously defined the ADVISE method, which combines a state-based security model and an adversary profile to generate quantitative metrics through simulation. Since simulation is often costly, particularly when applied to the analysis of rare events like successful attacks against a system, we extend the analysis methods of ADVISE to Markov chain analysis techniques that enable the efficient and accurate computation of a wide variety of quantitative security measures. With these analysis approaches, it is possible to extend the type of metrics available when using the ADVISE method while lifting previous restrictions placed on the adversary profile.