Attribute evaluation on attack trees with incomplete information

Abstract

Attack trees are considered a useful tool for security modelling because they support qualitative as well as quantitative analysis. The quantitative approach is based on values associated to each node in the tree, expressing, for instance, the minimal cost or probability of an attack. Current quantitative methods for attack trees allow the analyst to, based on an initial assignment of values to the leaf nodes, derive the values of the higher nodes in the tree. In practice, however, it shows to be very difficult to obtain reliable values for all leaf nodes. The main reasons are that data is only available for some of the nodes, that data is available for intermediate nodes rather than for the leaf nodes, or even that the available data is inconsistent. We address these problems by developing a generalisation of the standard bottom-up calculation method in three ways. First, we allow initial attributions of non-leaf nodes. Second, we admit additional relations between attack steps beyond those provided by the underlying attack tree semantics. Third, we support the calculation of an approximative solution in case of inconsistencies. We illustrate our method, which is based on constraint programming, by a comprehensive case study.

A Minimum Defense Cost Calculation Method for Attack Defense Trees

“…In this paper, we directly apply the defense cost, and we do not specifically consider how the defense cost is obtained. One can refer to [42,43] for details on the defense cost calculation. In practice, the defense cost refers to the actual cost of the defender in a complete attack defense scenario.…”

Attack-Tree Series: A Case for Dynamic Attack Tree Analysis

“…In such cases, the bottom-up computation technique is infeasible. Buldas et al [5] have recently shown that intermediary data values can be used to complete the attack tree decoration process. Our current theory of attack-tree series with attributes, including temperature functions, is agnostic to the decoration process, as it only requires that all attack trees in the time-series are decorated.…”

“…We consider attack trees constructed from leaf nodes and two types of internal nodes (AND and OR). Following, e.g., [5], we will assume that all nodes of the attack tree are labeled.…”

Modelling Security Risk Scenarios Using Subjective Attack Trees

“…One important parameter in ATs used to analyse security risk is the likelihood of successful attacks (in literature, also referred to as security events). However, several probabilistic ATs [2,5,12,16,17,20] use precise values for likelihoods using the probabilistic approach. In many situations, it is difficult to elicit accurate probabilities due to lack of knowledge, or insufficient historical data, making the evaluation of risk in existing approaches unreliable.…”

“…(1) we develop a new model of ATs, called SAT, that takes second-order uncertainty into account. (2) we propose a methodology to derive opinions about security events based on the two criteria discussed in [1] using Subjective Logic. (3) we conduct an experimental evaluation that compares our approach with traditional ATs, demonstrating that the results differ and would lead to different decisions being made.…”