# Model for Quantifying the Quality of Secure Service
## 3 Components of a Security Model
### Probability of Integrity  
Quantifying integrity is equally challenging. Integrity is a measure of the consistency, accuracy, and trustworthiness of data. Integrity implies that data has not been changed by unauthorized users in transit. One method of quantifying integrity is the \"prevention of unauthorized modification of information\" [10]. Under this assumption, unauthorized modification is _corruption_, resulting in  
\[P(l)=1-P(c) \tag{5}\]  
where \(P(l)\) is the probability of integrity and \(P(c)\) is the probability of corruption. Corruption here captures any damage to integrity yielding \"two notions of corruption \" where the  
\begin{table}
\begin{tabular}{c c c c} \hline \hline _P(int)_ & _P(dcr)_ & _P(dco)_ & _P(0)_ \\ \hline
1 & 1 & 0 & 0 \\
1 & 1 & 1 & 1 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Logical binary relationship for the probability of leakage.  
\"first leads us to a measure that we call _contamination_\" and the \"second leads us to... _suppression_\" [10]. Contamination may arise from adversarial action, _injection_, or non-adversarial input, _noise_. Further, an adversary may carefully inject portions of false data (a spoofing attack), inject massive amounts of false data to disable communications (the traditional DoS attack), or overtly jam a message with a false signal (traditional RF jamming).  
Therefore, we choose to classify DoS attacks as being an attack on the integrity of the data or message, not as an attack on the availability of the network. Again, inspired by PSMT [11], the set of all adversarial disruptors, \(A_{D}\), maps to a number of wires, \(\rho\), that the disruptors have access to; if one of the members of \(A_{D}\) has access to the information, then the probability of corruption exists.  
We, therefore, posit that corruption has three components: noise, data suppression, and data injection. The probability of noise occurring in a message, \(P(n)\), is the probability that a message will be adversely affected by noise. Noise is a natural phenomenon that happens regardless of the transmitter's capability. The probability of suppression, \(P(s)\), quantifies the probability that an adversary will suppress or jam the message, thus, preventing the receiver from obtaining the message6. Finally, the probability of injection, \(P(inj)\), quantifies the probability that an adversary will inject false data into the message. \(P(inj)\) requires the ability to insert malicious data into a data stream, a much more sophisticated activity than that of jamming7. Since noise is a natural phenomenon, it is consistently present and may influence \(P(s)\) and \(P(inj)\). Noise works cooperatively with \(P(s)\) since both cause the receiver to incorrectly receive the intended message. Based on these probabilities, the logical binary relationship for \(P(c)\) is shown in Table 2 and reflected as  
Footnote 6: [[https://www.cs.uc.edu/~census/](https://www.cs.uc.edu/~census/)]([https://www.cs.uc.edu/~census/](https://www.cs.uc.edu/~census/))  
\[1-P(c)=\big{(}1-P(n)\big{)}\times\big{(}1-P(s)\big{)}\times\big{(}1-P(inj) \big{)}. \tag{6}\]  
Equation (6) does not adequately capture the behavior of the system. Noise may be detrimental to data injection, making the injected data unusable. Due to the interaction between \(P(n)\) and \(P(inj)\), namely that noise affects both intended and malicious transmissions, a more comprehensive equation is  
\[\begin{split} P(c)=&\Big{(}\big{(}1-P(n)\big{)} \times P(inj)\Big{)}+\big{(}P(n)+P(s)\big{)}-\big{(}P(n)\times P(s)\big{)}\\ -&\Big{(}\big{(}1-P(n)\big{)}\times P(inj)\times \big{(}P(n)+P(s)\big{)}\Big{)}.\end{split} \tag{7}\]  
While less elegant than Equation (6), Equation (7) provides realistic results that account for all probabilities between 0 and 1 for each of the factors.