The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> G. Research Works on Taxonomies (MC-TY) <s> Multicast communication is becoming the basis for a growing number of applications. It is therefore critical to provide sound security mechanisms for multicast communication. Yet, existing security protocols for multicast offer only partial solutions. We first present a taxonomy of multicast scenarios on the Internet and point out relevant security concerns. Next we address two major security problems of multicast communication: source authentication, and key revocation. Maintaining authenticity in multicast protocols is a much more complex problem than for unicast; in particular, known solutions are prohibitively inefficient in many cases. We present a solution that is reasonable for a range of scenarios. This approach can be regarded as a 'midpoint' between traditional message authentication codes and digital signatures. We also present an improved solution to the key revocation problem. <s> BIB001 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> G. Research Works on Taxonomies (MC-TY) <s> A wide range of security services may be available to applications in a heterogeneous computer network environment. Resource management systems (RMSs) responsible for assigning computing and network resources to tasks need to know the resource-utilization costs associated with the various network security services. In order to understand the range of security services all RMS needs to manage, a preliminary security service taxonomy is defined. The taxonomy is used as a framework for defining the costs associated with network security services. <s> BIB002 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> G. Research Works on Taxonomies (MC-TY) <s> Addressing security threats and risks through software quality design factors. <s> BIB003 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> G. Research Works on Taxonomies (MC-TY) <s> Evolution is one of the major issues affecting system dependability as well as engineering activities and environments. The most common understanding considers evolution as a phenomenon that needs to be avoided. By contrast this paper takes into account evolution as a necessary feature of computerbased systems. This paper reviews a taxonomy of evolution identifying a conceptual framework to analyse evolutionary phenomena of computer-based systems as well as models of evolutions and their limits. The taxonomy of evolution points out different dependability aspects of computer-based systems. In conclusion, this paper provides a conceptual framework to analyse evolution and its influence on the dependability of computer-based systems. <s> BIB004 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> G. Research Works on Taxonomies (MC-TY) <s> This paper gives the main definitions relating to dependability, a generic concept including as special case such attributes as reliability, availability, safety, confidentiality, integrity, maintainability, etc. Basic definitions are given first. They are then commented upon, and supplemented by additional definitions, which address the threats to dependability (faults, errors, failures), and the attributes of dependability. The discussion on the attributes encompasses the relationship of dependability with security, survivability and trustworthiness. <s> BIB005 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> G. Research Works on Taxonomies (MC-TY) <s> Network security visualization is a relatively new field and is quickly gaining momentum. Network security visualization allows the display and projection of the network or system data, in hope to efficiently monitor and protect the system from any intrusions or possible attacks. Intrusions and attacks are constantly continuing to increase in number, size, and complexity. Textually reading through log files or other textual sources is currently insufficient to secure a network or system. Using graphical visualization, security information is presented visually, and not only by text. Without network security visualization, reading through log files or other textual sources is an endless and aggravating task for network security analysts. Visualization provides a method of displaying large volume of information in a relatively small space. It also makes patterns easier to detect, recognize, and analyze. This can help security experts to detect problems that may otherwise be missed in reading text based log files. Network security visualization has become an active research field in the past six years and a large number of visualization techniques have been proposed. A comprehensive analysis of the existing techniques is needed to help network security designers make informed decisions about the appropriate visualization techniques under various circumstances. Moreover, a taxonomy of the existing visualization techniques is needed to classify the existing network security visualization techniques and present a high level overview of the field. In this thesis, the author surveyed the field of network security visualization. Specifically, the author analyzed the network security visualization techniques from the perspective of data model, visual primitives, security analysis tasks, user interaction, and other design issues. Various statistics were generated from the literatures. Based on this analysis, the author has attempted to generate useful guidelines and principles for designing effective network security visualization techniques. The author also proposed a taxonomy for the security visualization techniques. To the author’s knowledge, this is the first attempt to generate a taxonomy for network security visualization. Finally, the author evaluated the existing network security visualization techniques and discussed their characteristics and limitations. For future research, the author also discussed some open research problems in this field. This research is a step towards a thorough analysis of the problem space and the solution space in network security visualization. INDEX WORDS: Network security, Security visualization, Taxonomy, Anomalies, Security information. A SURVEY, TAXONOMY, AND ANALYSIS OF NETWORK SECURITY VISUALIZATION TECHNIQUES by Rawiroj Robert Kasemsri A Thesis Submitted in Partial Fulfillment of the Requirements for the Degree of Master of Science in the College of Arts and Sciences Georgia State University <s> BIB006 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> G. Research Works on Taxonomies (MC-TY) <s> It is well known that security properties are not preserved by refinement, and that refinement can introduce new, covert, channels, such as timing channels. The finalisation step in refinement can be analysed to identify some of these channels, as unwanted finalisations that can break the assumptions of the formal model. We introduce a taxonomy of such unwanted finalisations, and give examples of attacks that exploit them. <s> BIB007 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> G. Research Works on Taxonomies (MC-TY) <s> Although Internet users are expected to respond in various ways to privacy threats from online companies, little attention has been paid so far to the complex nature of how users respond to these threats. This paper has two specific goals in its effort to fill this gap in the literature. The first, so that these outcomes can be systematically investigated, is to develop a taxonomy of information privacy-protective responses (IPPR). This taxonomy consists of six types of behavioral responses-refusal, misrepresentation, removal, negative word-of-mouth, complaining directly to online companies, and complaining indirectly to third-party organizations-that are classified into three categories: information provision, private action, and public action. Our second goal is to develop a nomological model with several salient antecedents-concerns for information privacy, perceived justice, and societal benefits from complaining-of IPPR, and to show how the antecedents differentially affect the six types of IPPR. The nomological model is tested with data collected from 523 Internet users. The results indicate that some discernible patterns emerge in the relationships between the antecedents and the three groups of IPPR. These patterns enable researchers to better understand why a certain type of IPPR is similar to or distinct from other types of IPPR. Such an understanding could enable researchers to analyze a variety of behavioral responses to information privacy threats in a fairly systematic manner. Overall, this paper contributes to researchers' theory-building efforts in the area of information privacy by breaking new ground for the study of individuals' responses to information privacy threats. <s> BIB008 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> G. Research Works on Taxonomies (MC-TY) <s> Systematic approaches to measuring security are needed in order to obtain evidence of the security performance of products or an organization. In this study we survey the emerging security metrics approaches from the academic, governmental and industrial perspectives and aim to bridge the gap between information security management and Information and Communication Technology (ICT) product security practices. If common metrics approaches between different security disciplines can be found, this will advance our holistic understanding and capabilities, both in management and engineering practices. <s> BIB009 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> G. Research Works on Taxonomies (MC-TY) <s> To obtain evidence of the security of different products or organizations, systematic approaches to measuring security are needed. We introduce a high abstraction level taxonomy to support the development of feasible security metrics, along with a survey of the emerging security metrics from the academic, governmental and industrial perspectives. With our taxonomy, we strive to bridge the gap between information security management and ICT products, and services security engineering. We believe that if common metrics approaches between different security disciplines can be found, this will advance our holistic understanding and capabilities, both in security management and engineering. Our taxonomy is based on comparing earlier taxonomy approaches and analyzing types of security metrics. Based on the survey, a discussion of future research directions is given in order to prompt advances in the field. <s> BIB010 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> G. Research Works on Taxonomies (MC-TY) <s> Mobile devices such as laptops, PDAs and cell phones have become essential tools for enterprise productivity, but they are in fact significantly more vulnerable to attack than desktop computers. This paper provides a broad overview of threats to mobile devices and the data that resides on them, as well as available defenses. It provides a taxonomy that divides threats to mobile devices into seven categories: malware, phishing and social engineering, direct attack by hackers, data communication interception and spoofing, loss and theft of devices, malicious insider actions, and user policy violations. It then discusses security technologies that can be applied against each of these threat types, including firewalls, anti-virus and zero day anti-malware software, intrusion prevention systems, virtual private networks, data encryption, device control and data leak prevention technologies. It suggests how to assess priorities among the different threats and defenses, and concludes with suggestions for further research. <s> BIB011 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> G. Research Works on Taxonomies (MC-TY) <s> Identity management system(s) (IDMS) do rely on tokens in order to function. Tokens can contribute to privacy or security risk in IDMS. Specifically, the characteristics of tokens contribute greatly to security and privacy risks in IDMS. Our understanding of how the characteristics of token contribute to privacy and security risks will help us manage the privacy and security risks in IDMS. In this article, we introduce a taxonomy of privacy and security risks contributing factors to improve our understanding of how tokens affect privacy and security in IDMS. The taxonomy is based on a survey of IDMS articles. We observed that our taxonomy can form the basis for a risk assessment model. <s> BIB012 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> G. Research Works on Taxonomies (MC-TY) <s> IoT is an intelligent collaboration of tiny sensors and devices giving new challenges to security and privacy in end to end communication of things. Protection of data and privacy of things is one of the key challenges in the IoT. Lack of security measures will result in decreased adoption among users and therefore is one of the driving factors in the success of the IoT. This paper gives an overview, analysis and taxonomy of security and privacy challenges in IoT. Finally, Security Model for IoT has been proposed. <s> BIB013 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> G. Research Works on Taxonomies (MC-TY) <s> Normally, software development practices concentrate to take all security requirements into account at design-time. Nevertheless, today's software products are intended to be used in mobile, or alternatively, in embedded devices whose environment changes during the application's execution. These kinds of changes occur especially in applications used in smart spaces. This enforces to think security concerns more dynamically. Thus, software has to be aware of its 1) security level in each time, and 2) changes in its environment that can cause security threats. Based on this awareness, software has to change its security mechanisms to fulfil security requirements in the current context. A security measurement is a key factor of this awareness. This work presents a micro-architecture for security adaptation and taxonomy of context information affecting to information security in smart spaces. The security measurement is the essential part of the micro-architecture. In addition, taxonomy describes concepts that have to be monitored in the smart space environment. <s> BIB014 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> G. Research Works on Taxonomies (MC-TY) <s> Virtualization is a term that refers to the abstraction of computer resources. The purpose of virtual computing environment is to improve resource utilization by providing a unified integrated operating platform for users and applications based on aggregation of heterogeneous and autonomous resources. More recently, virtualization at all levels (system, storage, and network) became important again as a way to improve system security, reliability and availability, reduce costs, and provide greater flexibility. This paper explains the basics of system virtualization and addresses pros and cons of virtualization along with taxonomy and challenges. <s> BIB015 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> G. Research Works on Taxonomies (MC-TY) <s> Software applications (programs) are implemented in a wide variety of languages and run on different execution environments. Programs contain vulnerabilities which can be detected before their deployment. Nevertheless, there exist some program vulnerabilities, which do not surface until a program is operational. No matter how much effort has been put during the development phases, building large vulnerability-free programs has proven extremely difficult in practice. Given that, it is very important to have a tool that can be used for online monitoring of programs in the operational stage. The tool can help to mitigate the consequences of some vulnerability exploitations, by early detection of attacks at runtime. Currently, many monitoring approaches have been proposed and applied in practice. However, there is no classification of these approaches to understand their common characteristics and limitations. In this paper, we present a taxonomy and classification of the state of the art approaches employed for monitoring program vulnerability exploitations (or attacks). We first classify the existing approaches based on a set of characteristics which are common in online attack detection approaches. Then, we present a taxonomy by classifying the approaches based on monitoring aspects that primarily differentiate among the approaches. We also discuss open issues and future research direction in the area of program vulnerability exploitation monitoring. The study will enable practitioners and researchers to differentiate among existing monitoring approaches. It will provide a guideline to consider the desired characteristics while developing monitoring approaches. <s> BIB016 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> G. Research Works on Taxonomies (MC-TY) <s> Abstract : The lack of a controlled vocabulary for malware analysis is a symptom of the field's immaturity and an impediment to its growth. Malware analysis is a splintered discipline, with many small teams that for cultural reasons do not, or cannot, readily communicate among themselves; this condition encourages the growth of many local dialects. This report presents the results of the Malware Analysis Lexicon (MAL) initiative, a small project to develop the discipline's first common vocabulary. <s> BIB017
16 works on taxonomies aim to describe domains and sub-domains:  ; BIB017 ; BIB012 ; BIB016 ; BIB013 ; BIB014 ; BIB015 ; BIB008 ; BIB011 ;  ; BIB006 ;  ; BIB007 ; BIB005 ; BIB003 ;  . Both generic proposals (Top-Level Taxonomies) and specific proposals (Task and Application Taxonomies) can be found in BIB009 , BIB010 , BIB004 , BIB001 , BIB002 , and  . After analysis of the selected works, the following caracteristics can be highlighted: BIB003 [86] present a taxonomy of security risks. This work aims to conceptualize threats and risks to assess the security (wide view). BIB005 BIB005 present the main concepts of Dependability, including its attributes (e.g., confidentiality, integrity, authenticity, etc.) and the threats to those attributes. This work shows the relationships between the concepts of "dependability", "security", "survivability" and "trustworthiness", which are usually described as synonymous. Clark et al. (2005) [84] present a taxonomy to categorize security attacks. The proposed taxonomy can provide a mechanism to infer on the probable incomplete aspects of a model.  [83] present a taxonomy of attacks to sensor networks and proposes solutions (countermeasures). Savola (2007b) [88] presents a top-level taxonomy of information security metrics. A survey of the main approaches of security metrics is presented. The academic, governmental and industrial perspectives are considered. Hu et al. (2008) [81] present a taxonomy of information security. According to the authors, there are two research communities working separately, namely: "Dependability" and "Security". The authors explain that the community of "Dependability" is more concerned about non-malicious failures and the community of "Security" is oriented to identify malicious failures and attacks. This work aims to integrate the two views into a single taxonomy. First, the authors describe the concept of "Dependability", subdivided into attributes, threats and faults. After integration with the attributes of the "Security" concept, the authors propose a conceptual framework. The framework is a set of the following attributes: Availability, Reliability, Integrity, Safety, Maintainability, Confidentiality, Authenticity, and Non-repudiation. The authors also present a classification of faults made by humans (HMF -Human-made faults), categorized into FUA (Faults with Unauthorized Access) and NFUA (Non-FUA -other faults). Subsequently, for each property, the structure of the FUA fault type is detailed. Friedman & Hoffman (2008) [80] present a taxonomy of threats and defenses. The paper presents the threats to mobile devices and their data, as well as the available defenses. The taxonomy divides the threats to mobile devices into seven categories, namely: malware; phishing and social engineering; direct hacker attacks; interception and spoofing of communication; loss and theft of the device; malicious use of internal actions; policy violations. Countermeasures are divided into: firewall; antivirus and zero day antimalware software; IPS; VPN; data encryption technologies for data leak prevention. The authors emphasize that the devices move out of the protected perimeter, connected to unknown environments, and they can also be lost or stolen. BIB015 BIB015 present a taxonomy of virtual machines vulnerabilities, including concepts and problems associated with these vulnerabilities. We can see that there are common characteristics with the current term "Cloud Computing". Evesti & Pantsar-Syväniemi (2010) BIB014 present a security taxonomy, in the context of mobile application environments. Current systems are intended for use in mobile or embedded devices and the environments changes during the execution of the application. Any changes in the operating environment (IT infrastructure) could cause security threats. For mobile applications, the operating environment is sometimes unknown or unstable. According to the authors, the software has to be constantly aware of its security level. Babar et al. (2010) BIB013 provide an overview, analysis and taxonomy of security and privacy challenges in the Internet of Things -IoT. The authors propose a security model for IoT. This paper presents: key properties for IoT; the specific challenges of the IoT domain; high-level security requirements for IoT; a definition of resilience to attacks. Paintsil & Fritsch (2011) BIB012 present a taxonomy of security risks. The taxonomy is based on a literature review of articles on IDMS (IDentity Management System). The taxonomy addresses the aspect of "authentication"; more specifically, how authentication tokens affect the privacy and security of IDMS. Mundie & Mcintire (2013) BIB017 proposes a Malware Analysis taxonomy. This paper presents the results of a project that aims to develop a common vocabulary of Malware Analysis (Malware Analysis Lexicon -MAL). According to the authors, there is not a controlled vocabulary for malware analysis because there are many local dialects and a lack of standardization of the concepts. This work can be used as a source for building security ontologies due to a glossary of terms. Wangen & Snekkenes (2014)  present a taxonomy of research issues in the Risk Management field. This paper aims to present the challenges for risk management of information security.