DARPA Information Assurance Program dynamic defense experiment summary

Experimental comparison of attack trees and misuse cases for security threat identification

“…DARPA has run a number of experiments where attack trees have been used, see for instance [25,27]. However, the purpose of these experiments was not to evaluate attack trees, but to evaluate the defence strategies and mechanisms employed by the team or system in responding to attacks from the outside.…”

Biologically-inspired Complex Adaptive Systems approaches to Network Intrusion Detection

“…In red teaming a team of security experts, referred to as the red team, act as attackers and tries to break-in the system by using and developing sophisticated attack tools while another group of experts, referred to as the blue team, lines up to defend the system. Such an exercise was conducted by DARPA under its Information Assurance program which showed the advantages of using red teaming (Wood and Duggan, 1999;Kewley and Bouchard, 2001). A similar antagonistic mutual relationship is found between the inhabitants of natural echo systems, such as the relationships between the plants and the herbivores or hosts and parasites.…”

Using Attack-Defense Trees to Analyze Threats and Countermeasures in an ATM: A Case Study

“…In [4,5], Edge et al modeled an online banking scenario and homeland security via deriving protection trees from ATrees. Following the approach of [7], a methodology to construct ATrees based on the system architecture, risk assessment study outcomes and a security knowledge base is proposed in [14]. This methodology follows a layered approach to generate skeletons of attack trees.…”