]> ReSIST Ontology ReSIST Ontology The ReSIST Ontology encompasses concepts within the fields of research in Resilient, Survivable and Dependable Systems 0.2.5 2006-11-28 ReSIST NoE Dependability And Security Two somehat overlapping concepts, with dependability being an integrating concept that encompasses the attributes: availability, reliability, safety:, integrity and maintainability, while security encompasses comfidentiality as well as integrity and availability. Dependability, High Confidence, Survivability The original definition of dependability is: the ability to deliver service that can justifiably be trusted. The alternate definition, that provides the criterion for deciding if the service is dependable, is: the dependability of a system is the ability to avoid service failures that are more frequent and more severe than is acceptable. Dependence The dependence of system A on system B represents the extent to which system A's dependability is (or would be) affected by that of System B. Trust Accepted dependence - where the dependence of a user on a given system represents the extent to which the user's dependability is (or would be) affected by that of the system. (The acceptance of this state of affairs by the user may be willing or unwilling, and careful or even unthinking.) Attribute Of Dependable Systems The dependability properties that are expected from a system, and in terms of which a system's dependability can be assessed with respect to the threats and the means to oppose these threats. Availability 1) Readiness for correct service; 2) Measure of the delivery of correct service with respect to the alternation of correct and incorrect service. Integrity The absence of improper system alterations. Maintainability 1) Ability to undergo repairs and modifications; 2) Measure of the continuous delivery of incorrect service; 3) Measure of the time to restoration from the last failure occurrence. Reliability 1) Continuity of correct service; 2) Measure of continuous delivery of correct service; 3) Measure of the time to failure. Safety 1) Absence of catastrophic failures affecting the system user(s) and its environment; 2) Measure of the continuous delivery of either correct service or incorrect service after non-catastrophic failure; 3) Measure of the time to catastrophic failure. Robustness Dependability with respect to external faults. Security A composite of the attributes of confidentiality, integrity and availability, requiring the concurrent existence of a) availability for authorized actions only, b) confidentiality, and c) integrity (the absence of improper system state alterations) with 'improper' having the meaning 'unauthorized'. Attribute Of Secure Systems The security properties that are expected from a system, and in terms of which a system's security can be assessed with respect to the threats and the means to oppose these threats. Availability 1) Readiness for correct service; 2) Measure of the delivery of correct service with respect to the alternation of correct and incorrect service. Confidentiality The absence of unauthorized disclosure of information. Integrity The absence of improper system alterations. Accountability Availability and integrity of the identity of the person who performed an operation. Authenticity The integrity of a message content and origin, and possibly of other information, such as the time of emission Nonrepudiability The availability and integrity of the identity of the sender of a message (non-repudiation of the origin), or of the receiver (non-repudiation of reception). Means To Attain Dependable And Secure Systems Many means have been developed to attain the various attributes of dependability and security. These can be grouped into four major categories: fault prevention, fault tolerance, fault removal, fault forecasting. Fault prevention and fault tolerance aim to provide the ability to deliver a service that can be trusted, while fault removal and fault forecasting aim to reach confidence in that ability by justifying that the functional and the dependability & security specifications are adequate and that the system is likely to meet them. Fault Forecasting The means of estimating the present number, the future incidence, and the likely consequences of faults. Ordinal Evaluation, Qualitative Evaluation Qualitative, or ordinal, evaluation, aims to identify, classify, and rank a system's failure modes, or the event combinations (component failures or environmental conditions) that would lead to system failures. Probabilistic Evaluation, Quantitative Evaluation Quantitative, or probabilistic, evaluation, aims to evaluate in terms of probabilities the extent to which specified dependability and or security attributes are satisfied Evaluation Testing, Operational Testing Testing for the purpose of evaluating a system's behaviour with respect to fault occurrences or activations. Modelling A statistical means of evaluating the dependability and security of a complex dynamic system. Performability A performance-related measure of dependability, particularly used for evaluating degradable systems. Dependability And Security Benchmarks Procedures to assess measures of the behavior of a system in the presence of faults, enabling the integration of the various techniques of fault forecasting in a unified framework. Such a benchmark enables a) characterization of the dependability and security of a system, and b) comparison of alternative or competitive solutions according to one or several attributes. Fault Prevention Means of preventing the occurrence or introduction of faults. Fault Removal Means of reducing the number and severity of faults. Validation The checking of a system specification - the difference between validation and verification is that validation is ensuring "you built the right product" and verification is ensuring "you built the product right." [Wikipedia] Verification The checking that a system meets its specification - the difference between validation and verification is that validation is ensuring "you built the right product" and verification is ensuring "you built the product right." [Wikipedia] Dynamic Verification Verifying a system through exercising it; the inputs supplied to the system can be either symbolic in the case of symbolic execution, or actual in the case of verification testing, usually simply termed testing. Symbolic Execution Verifying a system through exercising it constitutes dynamic verification; the inputs supplied to the system can be either symbolic in the case of symbolic execution, or actual in the case of verification testing, usually simply termed testing. Testing Verifying a system through exercising it constitutes dynamic verification; the inputs supplied to the system can be either symbolic in the case of symbolic execution, or actual in the case of verification testing, usually simply termed testing. Deterministic Testing A form of testing in which the test patterns are predetermined by a selective choice. Random Testing, Statistical Testing A form of testing in which the test patterns are selected according to a defined probability distribution on the input domain; ; the distribution and the number of input data are determined according to the given fault model or criteria. Oracle Problem In statistical testing of a system, observing the test outputs and deciding whether or not they satisfy the verification conditions is known as the oracle problem. Golden Unit A reference system againt which the results from a system under test are compared, so as to test for physical faults. Back To Back Testing A means of testing for physical faults involving comparing the results from a system under test for a given input sequence against those from a prototype, or another implementation of the same specification. Static Verification A process of checking some required characterisitcs of a software system, e.g. via model checking, static analysis or formal verification. Model Checking Model checking is a method of algorithmically verifying that a model (derived from a design) satisfies a given aspect of this design's formal specification. Static Analysis A method of automated analysis of computer software that is performed without actually executing programs built from that software, but instead on a version of the source code or the object code. Theorem Proving The proving of mathematical theorems by a computer program, in particular as part of a system verification task. Verification Condition Assertions that are generated as part of the task of system verification and which, if proved by a theorem prover, will verify that the component is correct. Nonregression Verification After a fault has been removed, the verification process should normally be repeated in order to check that fault removal had no undesired consequences; such verification is usually termed non regression verification. Fault Tolerance, Resilience, Self Repair, Self Healing Means of avoiding service failures despite the presence of faults. Error Detection, Error Checking The action of identifying the presence of an erroneous system state. Concurrent Detection Error detection that takes place during normal service delivery. Preemptive Detection Error detection that takes place while normal service delivery is suspended, checking a system for latent errors and dormant faults. Self Checking Component A component which has the required functional processing capability together with concurrent error detection mechanisms. Recovery Error and/or fault handling Error Handling, Error Control, Error Correction 1) Transformation of an erroneous state into an error-free state; 2) Rollback, compensation, or rollforward. Compensation A form of error handling that can be provided in the case that the erroneous state contains enough redundancy to enable its transformation into an error-free state. Rollback A form of error handling in which the state transformation consists of bringing a system back to a saved state that existed prior to error occurrence. RollForward A form of error handling in which the restart state is a new state. Fault Handling 1) Prevention of faults from being activated again, and 2) Fault diagnosis, fault isolation, system reconfiguration, system reinitialization. Diagnosis The identification of the cause, i.e. the fault(s) that led to the existence of one or more errors, and potentially to system failure. Isolation Physical or logical exclusion of faulty components from further particpation in service delivery, i.e. making the fault a dormant one. Reconfiguration The action of either switching in spare components or re-assigning tasks among non-failed components. Reinitialisation A form of fault handling that involves resetting a system to its initial state. Fault Masking Fault masking, or simply masking, results from the systematic usage of compensation. Such masking will conceal a possibly progressive and eventually fatal loss of protective redundancy. Error Confinement Area That part of a system's potential activites beyond which errors are prevented from propogating, for example via the provision of self-checking mechanisms. Design Diversity An approach to the production of systems, involving the provision of the same function from separate designs and implementations. Reflection The process by which a computer program of the appropriate type can be modified in the process of being executed, in a manner that depends on abstract features of its code and its runtime behavior. Figuratively speaking, it is then said that the program has the ability to "observe" and possibly to modify its own structure and behavior. [Wikipedia] Coverage, Fault Tolerance Coverage A measure of the representativeness of the situations to which a system is subjected during its analysis compared to the actual situations that the system will be confronted with during its operational life. Error And Fault Handling Coverage A measure of the representativeness of the situations to which a system's provisions for error and fault handling are subjected during their analysis compared to the actual situations that they will be confronted with during the system's operational life. Failure Mode Coverage A measure of the representativeness of the failure mode situations to which a system is subjected during its analysis compared to the actual situations that the system will be confronted with during its operational life. Assumption Coverage A measure of the representativeness of the assumptions which are during the analysis of a system compared to the actual situations that the system will be confronted with during its operational life. Threats To Dependable And Secure Systems The threats to the dependability and/or security of a system can be classified as faults, errors, and failures. Error The part of the total state of a system that may lead to its subsequent service failure. Error Domain The error domain combies the concepts of errors of content and of timing. Content Error An error such that should there be a resulting failure the content of the information delivered at the service interface (i.e., the service content) will deviate from implementing the system function. Timing Error A timing error is one that could lead to a timing failure, i.e. a failure such that the time of arrival or the duration of the information delivered at the service interface (i.e., the timing of service delivery) deviates from implementing the system function. Error Consistency The extent to which a set of errors are consistent, i.e. are in agreement, with each other. Consistent Error An error that occures identically in given circumstances, so that any resulting incorrect service is perceived identically by all system users. Inconsistent Error An error that occures differently in given circumstances, with the result that any resulting incorrect service might be perceived differently by various system users Error Consequences The possible effects, i.e.further errors and failures, of an error. Minor Error A minor error is one such that the harmful consequences of the failures that it could lead to are of similar cost to the benefits provided by correct service delivery. Catastrophic Error An error whose potential harmful consequences are orders of magnitude, or even incommensurably, higher in cost than the benefit provided by correct service delivery. Single Error Single errors are errors that affect one component only. Multiple Related Errors Some faults (e.g., a burst of electromagnetic radiation) can simultaneously cause errors in more than one component. Such errors are called multiple related errors. Detected Error An error is detected if its presence is indicated by an error message or error signal. Latent Error Errors that are present but not detected are latent errors. Failure An event that occurs when the service that a system delivers deviates from the correct service. Failure Phase An indication of whether the failure occurs during systerm service or system development Service Failure A service failure, often abbreviated to failure, is an event that occurs when a system's delivered service deviates from correct service. Development Failure A complete development failure causes the development process to be terminated before a system is accepted for use and placed into service. Complete Development Failure A failure that causes the development process to be terminated before a system is accepted for use and placed into service. Budget Failure A failure that occurs when the funds or time required to complete the development effort exceed what is acceptable. Schedule Failure A development failure such that the projected delivery schedule slips to a point in the future where the system would be technologically obsolete or functionally inadequate for the user's needs. Partial Development Failure A development failure that is of insufficient severity to lead to project termination. Downgrading A form of partial development failure, in which a developed system is delivered with less functionality, lower performance, or is predicted to have lower dependability or security, than was required in the original system specification. Overrun Budget or schedule overruns occur when the development is completed, but the funds or time needed to complete the effort exceed the original estimates. Failure Consequence The severity of theeffects of a failure on a system's enviroment. Catastrophic Failure A failure whose harmful consequences are orders of magnitude, or even incommensurably, higher in cost than the benefit provided by correct service delivery. Minor Failure A minor failure is one such that the harmful consequences are of similar cost to the benefits provided by correct service delivery Failure Domain The types of failure: content, early or late timing, halt or erratic Content Failure A failure such that the content of the information delivered at the service interface (i.e., the service content) deviates from implementing the system function. Non Numerical Content Failure A failure such that the content of the (non-numerical) information delivered at the service interface (i.e., the service content) deviates from implementing the system function. Numerical Content Failure A failure such that the content of the (numerical) information delivered at the service interface (i.e., the service content) deviates from implementing the system function. Timing Failure A timing failure occurs when the time of arrival or the duration of the information delivered at the service interface (i.e., the timing of service delivery) deviates from implementing the system function. Early Timing Failure Service is delivered too early by a system. Late Timing Failure Service is delivered too late by a system. Content And Timing Failure Content concerns the information delivered at a system' service iterface, timing concerns when this content is delivered Halt Failure, Halt A failure of a system such that the service is halted (the external state becomes constant, i.e., system activity, if there is any, is no longer perceptible to the users). Silent Failure, Silence A failure such that no service at all is delivered at a system's service interface (e.g., no messages are sent in a distributed system). Erratic Failure Failure such that, although a service is delivered (the system is not halted), it is erratic (e.g., babbling) Failure Detectability The indication of whether of not failures are signalled as such. Signalled Failure A failure such that the cessation of system service is signalled to the user. Unsignalled Failure Undetected incorrect and invalid service. False Alarm A reported detection of a failure when the system service is in fact correct. Consistency Of Failure The identicality, or otherwise, of the incorrect service perceived by system users. Consistent Failures Incorrect service is perceived identically by all system users. Inconsistent Failures, Byzantine Failure Failures such that some or all system users perceive differently incorrect service (some users may actually perceive correct service); inconsistent failures are often called Byzantine failures. Fault The adjudged or hypothesized cause of an error. Fault Phase The distinctio n between development and operational faults. Development Fault Development faults include all fault classes that occur during development of a system (from specification to realization). Operational Fault A fault that arises during usage of a system. Interaction Fault An external fault, i.e. a fault that is outside of the system boundaries, and propagates errors into the system via interaction or interference. Configuration Fault A broad class of human-made operational faults such as wrong setting of parameters that can affect security, networking, storage, middleware, etc. Reconfiguration Fault A fault that occurs during configuration changes performed during adaptive or augmentative maintenance performed concurrently with system operation (e.g., introduction of a new software version on a network server). System Boundaries System boundaries are the common frontier between systems and their environment. Internal Fault A fault that lies within the system boundaries. External Fault A fault that is outside of the system boundaries, and propagates errors into the system via interaction or interference. Phenomenological Cause Of Fault This term subsumes the concepts of a natural fault and a human-made fault. Natural Fault A fault that is due to adverse physical phenomena. Production Defect A type of fault, classed as a natural fault, that arises during hardware production. Human Made Fault A fault that is the result of human activity (or inactivity). Omission Fault An omission fault (or simply an omission) is a human-made fault, namely the absence of action when an action should be performed. Commission Fault Human-made fault resulting from a wrong action. Fault Dimension In particular, the distinction between hardware and software faults. Hardware Fault A fault that appears in, or affects, hardware. Software Fault A fault that affects programs or data. Fault Objective The distinction between malicious and non-malicious faults. Malicious Fault A fault that is created as an act of ill-will or in a spirit of mischief. Malicious Logic Fault Malicious logic faults encompass development faults such as Trojan horses, logic or timing bombs, and trapdoors, as well as operational faults such as viruses, worms, or zombies. Trojan Horse A program that masquerades as a useful service but exploits rights of the program's user - rights that are not possessed by the author of the Trojan horse - in a way the user does not intend. Logic Bomb, Timing Bomb A piece of code intentionally inserted into a software system that will set off a malicious function when specified conditions are met. Trapdoor A hidden piece of code that responds to a special input, allowing its user to access to resources without passing through the normal security enforcement mechanism. Virus A trojan horse that replicates itself by copying its code into other program files. Worm A trojan horse that replicates itself by creating new processes or files to contain its code, instead of modifying existing storage entities. Zombie A computer attached to a network that has been taken over by an outside user, e.g. in order to spread spam mail. Intrusion Attempt As operational external fault - it may be performed by system operators or administrators who are exceeding their rights, and may use physical means to cause faults: power fluctuation, radiation, wire-tapping, heating/cooling, etc. Non Malicious Fault A fault that is not created as an act of ill-will or in a spirit of mischief. Fault Intent The distinction between deliberate and non-deliberate faults. Deliberate Fault A fault created as a result of a conscious decision, with or without a malicious intent. Non Deliberate Fault A fault that is created as a result of an unconscious decision. Fault Capability This expreses the distinction between faults that occur accidentally, and those that are the result of incompetence. Accidental Fault Fault originating or arising inadvertently. Incompetence Fault A fault that is the result of human incompetence - a harmful mistake or bad decision made by a person who lacks the necessary professional competence. Fault Persistence The distinction between permanent and transient faults. Permanent Fault A fault whose presence is presumed to be continuous in time. Transient Fault A fault whose presence is bounded in time. Physical Fault A fault that effects hardware. Dependability And Security Provision The twin provision of dependability (availability, reliability, safety:, integrity and maintainability) and security (comfidentiality, integrity and availability). Fault Prevention Means of preventing the occurrence or introduction of faults. Fault Tolerance Means of avoiding service failures despite the presence of faults. Dependability And Security Analysis Dependability & security analysis covers both fault removal and fault forecasting, and is aimed at reaching confidence in the ability of a system to deliver a service that can be trusted. Fault Removal Means of reducing the number and severity of faults. Fault Forecasting The means of estimating the present number, the future incidence, and the likely consequences of faults. Fault Avoidance The association of fault prevention and fault removal. Fault Prevention Means of preventing the occurrence or introduction of faults. Fault Removal Means of reducing the number and severity of faults. Fault Acceptance The association of fault tolerance and fault forecasting, i.e., how to live with systems that are subject to faults. Fault Tolerance Means of avoiding service failures despite the presence of faults. Fault Forecasting Means of estimating the present number, the future incidence, and the likely consequences of faults. Entity Something that has a distinct, separate existence. System An entity that interacts with other entities, i.e., other systems, including hardware, software, humans, and the physical world with its natural phenomena. Fail Controlled System A system that is designed and implemented so that it fails only in specific modes of failure described in the dependability & security specification and only to an acceptable extent, e.g., with stuck output as opposed to delivering erratic values, silence as opposed to babbling, consistent as opposed to inconsistent failures. Fail Halt System, Fail Stop System A system whose failures are, to an acceptable extent, all halting failures. Fail Passive System A system whose failures are, to an acceptable extent, all ones that lead to a stuck service. Fail Silent System A system whose failures are, to an acceptable extent, all ones that lead to silence. Fail Safe System A system whose failures are, to an acceptable extent, all minor ones. System Specification A precise description of the system activity that is intended to be visible at a system's interface with its environment. System Life Cycle The life cycle of a system consists of two phases: development and use, which can alternate repeatedly. Development Phase A system's development phase includes all activities from presentation of the user's initial concept to the decision that the system has passed all acceptance tests and is ready to deliver service in its user's environment. Use Phase The use phase of a system's life begins when the system is accepted for use and starts the delivery of its services to the users. Service Delivery A period of system use during which (correct) service is being delivered. Service Outage A period of delivery of incorrect service from a system. Service Shutdown An intentional halt of system service by an authorized person or organization. Maintenance Following common usage, maintenance includes not only repairs, but also all modifications of a system that take place during the use phase of system life. Maintenance By Modification All modifications of a system that take place during the use phase of system life. Adaptive Maintenance Adjustment of a system to modifications of its structure (e.g., change of hardware, operating systems or system data-bases), the function being unchanged. Augmentative Maintenance Augmentation of a system's function by responding to customer - and designer - defined modifications (e.g., improve performance, add functionality). Repair A form of maintenance involving the reconstruction or renewal of part of an existing system. Corrective Maintenance 1) Repair of a system, its function and structure being unchanged; 2) Fault removal during the operational life of a system. Preventive Maintenance Corrective maintenance aimed at removing faults before they might cause errors during normal processing. Environment The other systems that have interacted or interfered, are interacting or interfering, or are likely to interact or interfere with the considered system. System Boundary A system boundary is the common frontier between the system and its environment.