Security metrics have received significant attention. However, they have not been
systematically explored based on the understanding of attack-defense interactions, which …

This paper critically surveys previous work on quantitative representation and analysis of
security. Such quantified security has been presented as a general approach to precisely …

Disruption of electric power operations can be catastrophic on national security and the
economy. Due to the complexity of widely dispersed assets and the interdependences …

The development of techniques for quantitative, model-based evaluation of computer system
dependability has a long and rich history. A wide array of model-based evaluation …

In this work we examine the feasibility of quantitatively characterizing some aspects of
security. In particular, we investigate if it is possible to predict the number of vulnerabilities …

When you think about how far and fast computer science has progressed in recent years, it's
not hard to conclude that a seven-year old handbook may fall a little short of the kind of …

Complex software and network based information server systems may exhibit failures. Quite
often, such failures may not be accidental. Instead some failures may be caused by …

The attack graph is an abstraction that reveals the ways an attacker can leverage
vulnerabilities in a network to violate a security policy. When used with attack graph-based …

Network security metrics (NSMs) based on models allow to quantitatively evaluate the
overall resilience of networked systems against attacks. For that reason, such metrics are of …

We propose a new model for estimating the time to compromise a system component that is
visible to an attacker. The model provides an estimate of the expected value of the time-to …