Predicting Availability of Systems using BBN in Aspect-Oriented Risk-Driven Development (AORDD)

Existing security standards targets qualitative evaluation of the security level of a system against a set of predefined levels. When doing trade-off between treatment strategies, we need to supplement the qualitative evaluation with quantitative estimates of operational security. Quantitative evaluation, such as probabilistic analysis, is frequently used within the dependability domain. To estimate and make trade-off decisions regarding security treatments, we separate treatments from the primary functionality model, and model treatment strategies as aspects using AspectOriented Modeling (AOM). In this paper, we develop a Bayesian Belief Network (BBN) based prediction system for estimating system availability. Availability is estimated using the variables mean time to misuse (MTTM), mean effort to misuse (METM), impact of misuse (MI), and frequency of misuse (MF). Misuses are addressed using treatment strategies. The quality of treatment strategies is estimated using the variables treatment cost (TC) and treatment effect (TE).