SecML: A Proposed Modeling Language for CyberSecurity Cybersecurity is a comparatively new discipline, related to computer science, electrical engineering, and similar subjects. As a newer discipline it lacks some of the tools found in more established subject areas. As one example, many engineering disciplines have modeling languages specific for that engineering discipline. As two examples, software engineering utilizes Unified Modeling Language (UML) and systems engineering uses System Modeling Language (SysML). Cybersecurity engineering lacks such a generalized modeling language. Cybersecurity as a profession would be enhanced with a security specific modeling language. This paper describes such a modeling language. The model is described in sufficient detail to be actionable and applicable. However, suggestions for future work are also provided.

Assurance for CyberSecurity with AssumeGuarantee Reasoning Design of cybersecurity solutions for a network is a challenging problem as it involves the integration of several complex components such as routers, servers, computers, smart devices, that include not only essential networking algorithms but also security algorithms. This is further complicated by the need to have robust security policies implemented to prevent violation of confidentiality as the networked devices interact. The design of such complex networked systems demand a more rigorous approach to the modeling and analysis at a higher level of abstraction, which can be inherited from the field of formal methods in software engineering for safety critical systems. Presently, network or security engineers do not use a formal method based software engineering approach to design and build cybersecurity systems. Thus, we propose a software engineering based formal approach to model and analyze cybersecurity, that along with identification of concrete requirements enables automated analysis to guarantee cybersecurity properties are satisfied within the network. In this research paper, we discuss an ontology guided assumeguarantee based formal approach to model and analyze a designed network. To enable this approach, a domain specific language is designed that allows association of assumptions with components in the network that allows verifying the satisfaction of contracts that are guarantees. The formal language designed includes reserved words are guided by the CyberSecurity domain and the semantic reasoning is based on formal architectural representation.