Automated Generation of Attack Trees

Abstract

Attack trees are widely used to represent threat scenarios in a succinct and intuitive manner, suitable for conveying security information to non-experts. The manual construction of such objects relies on the creativity and experience of specialists, and therefore it is error-prone and impracticable for large systems. Nonetheless, the automated generation of attack trees has only been explored in connection to computer networks and levering rich models, whose analysis typically leads to an exponential blow-up of the state space. We propose a static analysis approach where attack trees are automatically inferred from a process algebraic specification in a syntax-directed fashion, encompassing a great many application domains and avoiding incurring systematically an exponential explosion. Moreover, we show how the standard propositional denotation of an attack tree can be used to phrase interesting quantitative problems, that can be solved through an encoding into Satisfiability Modulo Theories. The flexibility and effectiveness of the approach is demonstrated on the study of a nationalscale authentication system, whose attack tree is computed thanks to a Java implementation of the framework.

Transforming Graphical System Models to Graphical Attack Models

“…In the example system, both Charlie and Alice own matching assets, so the transformation generates two possible attacks, one using Charlie's card, another using Alice's card. Clearly, the first transformation result does not necessarily represent an attack; generating such unwanted artefacts can either prohibited by restricting permissible actors in the policy, 4 or it can be dealt with in later phases that work on the generated attacks.…”

“…The generated attack takes account for all combinations hereof; some parts of the tree can be pruned or simplified in a later phase similar to [4]. Once the card and the pin have been obtained, Charlie moves to the location ATM and inputs the asset cash.…”

“…The goal of the defender is then to inhibit one or more of the attack steps, thereby prohibiting the overall attack, or at least making it more difficult or expensive. While attacks trees for purely technical attacks may be constructed by automated means [4,5], for example by scanning networks and identifying software versions, this is currently not possible for attacks exploiting the human factors. Actually, only few, if any, approaches to systematic risk assessment take such "human factor"-based attacks into consideration.…”

Attack-Graph Threat Modeling Assessment of Ambulatory Medical Devices

“…Based on these observations, their paper extends dynamic attack tree models using the ordered parallel behavior of AND-and OR-gates. Vigo et al [14] proposed an automated attack tree generator using a static analysis approach. The attack trees are automatically inferred from a process of algebraic specification and Satisfiability Modulo Theories in a syntax-directed fashion while avoiding exponential explosion.…”

Understanding How Components of Organisations Contribute to Attacks

“…Attack trees provide structure to the represented attacks by relating a node representing the goal of an attack with different alternative or required sub-goals, which an attacker may or must perform. This structure makes attack trees also an appropriate target for automated identification of attacks [4][5][6].…”