Examples with DefenseCondition com.ge.verdict.attackdefensecollector.adtree.DefenseCondition used on opensource projects

Example 1 with DefenseCondition

use of com.ge.verdict.attackdefensecollector.adtree.DefenseCondition in project VERDICT by ge-high-assurance.

the class DTreeConstructor method constructInternal.

/**
 * Inductively-defined function over attack-defense trees.
 *
 * <p>The mapping from attack-defense tree to defense tree is pretty straightforward. One of the
 * most important things to note is that AND and OR nodes are transposed in the transformation
 * because they mean opposite things in a defense tree compared to an attack-defense tree. (An
 * attack-defense tree is "how to attack", whereas a defense tree is "how to defend".)
 *
 * @param adtree
 * @return
 */
private Optional<DTree> constructInternal(ADTree adtree) {
    if (adtree instanceof Attack) {
        Attack attack = (Attack) adtree;
        ALeaf aleaf = new ALeaf(attack);
        // keep track of all attack leaves
        if (!attackALeafMap.containsKey(attack)) {
            attackALeafMap.put(attack, new LinkedHashSet<>());
        }
        attackALeafMap.get(attack).add(aleaf);
        return Optional.of(aleaf);
    } else if (adtree instanceof Defense) {
        Defense defense = (Defense) adtree;
        defenses.add(defense);
        return Optional.of(new DNot(constructDefenseTree(defense)));
    } else if (adtree instanceof ADAnd) {
        ADAnd adand = (ADAnd) adtree;
        // Transpose and/or
        return Optional.of(new DOr(adand.children().stream().map(this::constructInternal).flatMap(elem -> elem.isPresent() ? Stream.of(elem.get()) : Stream.empty()).collect(Collectors.toList())));
    } else if (adtree instanceof ADOr) {
        ADOr ador = (ADOr) adtree;
        // Transpose and/or
        return Optional.of(new DAnd(ador.children().stream().map(this::constructInternal).flatMap(elem -> elem.isPresent() ? Stream.of(elem.get()) : Stream.empty()).collect(Collectors.toList())));
    } else if (adtree instanceof ADNot) {
        ADNot adnot = (ADNot) adtree;
        return constructInternal(adnot.child()).map(DNot::new);
    } else if (adtree instanceof DefenseCondition) {
        DCondition dcond = new DCondition((DefenseCondition) adtree);
        dconditions.add(dcond);
        return Optional.of(dcond);
    } else {
        throw new RuntimeException("got invalid adtree type: " + adtree.getClass().getCanonicalName());
    }
}

Example 2 with DefenseCondition

use of com.ge.verdict.attackdefensecollector.adtree.DefenseCondition in project VERDICT by ge-high-assurance.

the class DependentRules method getComponentDependence.

public static Optional<ADTree> getComponentDependence(SystemModel component, String attackName) {
    List<ADTree> paths = new ArrayList<>();
    switch(attackName) {
        case "CAPEC-21":
            for (ConnectionModel connection : component.getIncomingConnections()) {
                if ("Untrusted".equals(connection.getAttributes().get("connectionType"))) {
                    // Vul-CAPEC-21-1
                    paths.add(new DefenseCondition(connection.getAttackable(), "deviceAuthentication", 1));
                }
            }
            for (ConnectionModel connection : component.getOutgoingConnections()) {
                if ("Untrusted".equals(connection.getAttributes().get("connectionType"))) {
                    // Vul-CAPEC-21-2
                    paths.add(new DefenseCondition(connection.getAttackable(), "deviceAuthentication", 1));
                }
            }
            return mkRet(component.getAttackable(), attackName, paths);
        case "CAPEC-112":
            for (ConnectionModel connection : component.getIncomingConnections()) {
                // Vul-CAPEC-112-1, Vul-CAPEC-112-3, Vul-CAPEC-112-5
                paths.add(new DefenseCondition(connection.getAttackable(), "deviceAuthentication", 1));
                // Vul-CAPEC-112-2, Vul-CAPEC-112-4, Vul-CAPEC-112-6
                paths.add(new DefenseCondition(connection.getAttackable(), "encryptedTransmission", 1));
            }
            return mkRet(component.getAttackable(), attackName, paths);
        case "CAPEC-114":
            for (ConnectionModel connection : component.getIncomingConnections()) {
                // Vul-CAPEC-114-1, Vul-CAPEC-114-2, Vul-CAPEC-114-3
                paths.add(new DefenseCondition(connection.getAttackable(), "deviceAuthentication", 1));
            }
            return mkRet(component.getAttackable(), attackName, paths);
        case "CAPEC-115":
            for (ConnectionModel connection : component.getIncomingConnections()) {
                // Vul-CAPEC-115-1, Vul-CAPEC-115-2, Vul-CAPEC-115-3
                paths.add(new DefenseCondition(connection.getAttackable(), "deviceAuthentication", 1));
            }
            return mkRet(component.getAttackable(), attackName, paths);
        case "CAPEC-390":
            paths.add(new DefenseCondition(component.getAttackable(), "physicalAccessControl", 1));
            return mkRet(component.getAttackable(), attackName, paths);
        default:
            return Optional.empty();
    }
}