1. DEPENDABILITY ANALYSIS (towards Networked Information Systems) Ester Ciancamerla, Michele Minichino ENEA {ciancamerlae, minichino}@casaccia.enea.it In cooperation with Università del Piemonte Orientale, Università di Roma - La Sapienza NoE DeFINE – November 26, 27 - 2002 – Pisa - Italy

2. Understanding and characterising NIS On technological pushing real time and safety functions are moving from embedded isolated systems to systems based on telecommunication networks (even public, wireless and mobile) – impact of intrusion on safety and timeliness denial of service –logical faults and cascading failures –links with internet world –reconfiguration on external/internal events –…..

3. Modelling methods for dependability analysis Current modelling methods are not adeguate for NIS dependability analysis

4. Dependability analysis of NIS –a General Procedure to derive a Conceptual Model to capture into a single framework all dependability facets of NIS (by using an appropriate case study) (from top to down) –trying to unify the stochastic and functional analysis so that a same model could feed a stochastic analyser for performance evaluation a functional analyser for model checking (from bottom to up) –with the aim to reduce the gap between: The modelling power required for NIS and the actual modelling power of current tools for dependability analysis design and evaluation tools

5. Conceptual model Conceptual model refine existing design models in order to enable effective dependability analysis. help in deriving the NIS scope and operational concept, and explain how NIS functions are allocated to systems/subsystems/components, who is at the risk from the NIS, and how the environment might be affected by NIS internal events. which are the chains of cause and effect of failures/intrusions of the NIS and its recovery behaviour.

6. From bottom to up unifying stochastic and functional analysis Dependability modeling and analysis, even at layer of digital embedded systems, is actually dominated by two main lines:  functional analysis based on the description of the system in terms of discrete/continuous state automata (whose goal is to ascertain for conformity and reachability properties);  stochastic analysis (whose aim is to provide performance and dependability measures).

7. Modelling dilemmas There are two main dilemmas: 1. stochastic versus timed ; In stochastic models the timing of events is represented by means of random variables. The obtainable measures are: mean values and distributions In timed models the timing of events is represented by constant values or (non-deterministic) intervals. The obtainable measures are reachability properties and computer aided verification via model checking

8. Stochastic models explore the possibility of defining a chain of models of increasing semantical complexity: –from combinatorial models (e.g Fault Tree) –to models with localized dependencies (e.g. dynamic FT or Bayesian Networks) –to models based on the state space (Markov models and Petri nets). provide automatic translation algorithms for converting one model into a model of higher semantical complexity

9.  In discrete models the state space is discrete. The dynamic evolution of the system in time is represented as a sequence of transitions among discrete states.  Hybrid models contain discrete as well as continuous variables in the same model. Typical examples are discrete controllers that control continuous variables 2. discrete versus continuous (or hybrid). Modelling dilemmas

10. The unified heterogeneous model An unified view between formal methods and stochastic methods able to combine, in the same framework: - stochastic and deterministic timing; - discrete and continuous (hybrid) variables and used to feed: - a functional analyser for model checking - a stochastic analyzer for performance evaluation.

11. Final goal  A complete modelling coverage, moving from top to down abstraction layers of NIS, made of a Conceptual Model which feed a set of Heterogenous Models  The aim is  to partially overcame the inadeguacy of the modelling power of current tools to afford the modelling power required for NIS dependability analysis  and to reduce the gap between current design and evaluation tools

12. Moreover To implement a pilot version of computerised tools to partially support the proposed methodology for the unified heterogenous modelling To set up appropriate experiments on the Case Study, so that experimental data could be gathered and used as evidence for partially validating the models.