(IJCSIS) International Journal of Computer Science and Information Security,Vol. 9, No. 11, November 2011
In 1978, Information Science Institute at University of Southern California launched project called ProtectionAnalysis (PA). It was an effort to sort errors in operatingsystem, applications and discover techniques which candetect weaknesses in software errors . The PA report firstcame up with ten categories but after further the numbers of categories were reduced to four global errors: domain errors,validation error, naming error, and serialization error.
In 1995, Bishop presented his vision of a taxonomy whichwas different from the previous taxonomies. His work includes vulnerabilities in UNIX and the classificationschemes were based on the basics of these vulnerabilities.Bishop presented his taxonomy in the form of 6 axes(Nature, Time of introduction, Exploitation domain, Effectdomain, Minimum number, Minimum number and Source).
Taxonomy based on Computer Attacks1)
Landwehr et al., taxonomy
Landwehr presented their taxonomy on computerprograms and security flaws along with 50 actual flaws. Asearlier taxonomies collected data during the development of the software Landwehr paid attention to the security flawsthat happen after the software is released for use. Landwehrtaxonomy mainly emphasize on organizing flaws, addingnew ones and users can get information on which part of thesystem is causing more trouble. The flaws were broken downon the basis of genesis (how), time of introduction (when),and location (where). These three categories are explained indetail in the next section .
Origin of flaw
The important part in this section is the method throughwhich security flaw is inserted into the system. First find outwhether it was done by proper planning or it happenedaccidentally. Landwehr argued that sometimes this could beconfusing because program like remote debugging havedeliberately given functions which at the same time canprovide unintentional security flaws.The next category is the harmfulness of the flaws.Damaging flaws contain trojan horse, trapdoor, and logicbomb; these threats can further be classified in duplicatingand non-duplicating threats. Another category underintentional flaw is covert channels which transferinformation against the will of the system designer .
Time of introduction
To find exactly when the flaw was introduced duringsoftware development, Landwehr proposed the second stagecalled time of introduction which was further divided intothree components: development, maintenance, and operation.During the development phase different implementations aredone in order to meet certain conditions. If theseimplementations are not properly done there are chances of aflaw being activated. Programmers can make differentmistakes in these activities such as not complying with theterms of software requirements during source coding.Maintenance is the time when the software is released butstill being used on testing purposes. Landwehr pointed outthat during the maintenance time programmers usually fix aflaw but do not track it back to the source, this could awakemore flaws. Moreover, due to viruses or unauthorized accessthere could be changes done in the software during theoperation time. Operation time is when the software is out inthe market and organizations are using them .
The third phase in the taxonomy was the location of theflaw. The location was divided in two parts, software andhardware. Because mainly emphasis was on software, so itwas further divided into operating system, support software,and application software. Some of the flaws under operatingsystem can take place if the system did not accuratelyinitialized the defense measure or an outsider gainadmittance because of a fault in memory management .
Howard presented in his PhD thesis the taxonomy of computer and network attacks. His taxonomy was based onthe trail an attack goes along rather than the security flaws.His process-based taxonomy consists of five stages:attackers, tools, access, results and objectives .An attacker could be any one who purposefully cracksinto a computer. Attackers could be different types of peoplesuch as hackers, terrorists, and vandals. These attackersutilize some form of tools in order to get admittance. Varietyof tools is available, ranging from user command to datatapping. By using the vulnerabilities in implementation,design, and configuration an attacker can get access. Theresults of this can be corruption of information, disclosure of information or denial of service. Through this process theattackers accomplish the objectives which can be financial orpolitical gain. This process based taxonomy is very useful forunderstanding how the attack process works. However, if motivation and objectives are not given any importance thistaxonomy is not valuable. Howard and Thomas (1998) madechanges in the process-based taxonomy but failed infulfilling the requirements .
Hansman criticized on Howard’s taxonomy because itexplains the attack process and does not clarify attacks whichhappen on daily basis. For example the Code Red wormcannot be classified using the Howard taxonomy. Hansman’sapproach was to categorize computer attacks such as virus,worms, and trojans; attacks which a user faces every day.Also, Hansman wanted a taxonomy in which attacks withmultiple threats (blended attacks) can be classified. For thesereasons Hansman proposed a new taxonomy which consistsof dimensions .
In the first dimension attacks are classified by attack vectors. Attack vector is the way attackers gain access totheir targets so that certain payloads or harmful contents canbe transported. It provides the path for hackers to break intoa system or network; it can also give exact information aboutan attack. For example, Melissa virus propagates through e-