Patent ID: 8832839

Claim:
A computer-implemented method for assessing an impact of a security attack on a software system, the method executed by the computer comprising the steps of: defining a system performance/reliability affecting metric for an observation period as a fraction of time the system satisfies a defined performance/reliability specification; defining a resource failure based Markov model and a plurality of resource usage based Markov models for the system, wherein each resource usage based model is associated with a corresponding resource configuration; using results of security test cases performed on said software system to obtain pass/fail results for each of a plurality of states of the resource failure based model and the resource usage based model for each corresponding resource configuration; solving the resource failure based Markov model and the plurality of resource usage based Markov models and obtaining a long term fraction of time each model spends on each of the plurality of states; and obtaining a measure of the system performance/reliability affecting metric by summing the states for a plurality of system performance requirements met using the pass/fail results obtained from the plurality of states of the resource failure based model and the resource usage based model for each corresponding resource configuration, and incorporating the long term fraction of time each model spends on each of the plurality of states.