MP-RA: Towards a model-driven and pattern-based risk analysis of e-service fraud

Abstract

The increased technological transformation pushed service providers in re-designing their services and also transforming classical services into e-services. This opens the door for cyber criminals with a range of possibilities of committing fraud. Therefore, risk analysis of e-service fraud is an important requirement to prevent the fraud before it produces an actual loss. Traditional risk analysis approaches are prone to a number of problems due to the increased time consumption to identify threat scenarios through brainstorming, the high dependency on the competence of the people involved in the analysis, the lack of usability and re-usability of past experiences. Considering these problems, in this paper, we propose a framework for a Model-driven and Pattern-based Risk Analysis of e-service fraud (MP-RA), which aims to increase understanding of the target of assessment (ToA) by representing using graphical models, identify potential threat scenarios from the perspective of fraudsters using existing threat models and estimate the damage of threat scenarios for the main actor by which the analysis is intended for. The ultimate goal of the proposed framework is to increase the efficiency of decision makers to give informed decisions.