Hybrid extensions for stateful attack graphs

Louthan, George; Haney, Michael; Hardwicke, Phoebe; Hawrylak, Peter J.; Hale, John

doi:10.1145/2602087.2602106

Cited by 12 publications

(5 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The term attack graph refers to a number of related techniques for security analysis, revolving around the use of a formal state space model in which state transitions represent the actions of an attacker or other force (Li et al, 2021) (Louthan et al, 2014) (Phillips & Swiler, 1998). Terminology related to attack graphs varies significantly across authors.…”

Section: Attack Graphsmentioning

confidence: 99%

“…Attack graph analysis requires a state-transition model defining a state space and possible transitions between states. One approach used by researchers is to model each state as a collection of assets and facts, where facts may describe properties of individual assets or relationships among assets (Li et al, 2021) (Louthan et al, 2014). Transitions can be defined indirectly using exploit patterns with specified preconditions and postconditions, which may contain free variables that must be bound to assets to create a concrete transition.…”

Section: Attack Graphsmentioning

confidence: 99%

“…A state-transition model theoretically defines a complete, static graph describing all states and transitions. Since that graph is likely infinite or intractable to compute, practical analysis often involves computing a subgraph from a specific starting state, possibly using a pruning criterion such as a finite search depth (Louthan et al, 2014). We use the term attack graph to refer to the computed subgraph.…”

Section: Attack Graphsmentioning

confidence: 99%

See 2 more Smart Citations

Decolonizing Information Technology Design: A Framework for Integrating Indigenous Knowledge in Design Science Research

Chung,

Shedlock,

Corbett

2024

Proceedings of the Annual Hawaii International Conference on System Sciences

View full text Add to dashboard Cite

Many self-adaptive, autonomous systems rely on component technologies to report anomalies to planning processes that can choose adaptations. What if the analysis technologies themselves need to be adapted? We consider an intrusion detection system (IDS) supported by two component technologies that assist its decision making: a neural network that finds security anomalies and an attack graph that informs the IDS about system states of interest. The IDS purpose is to send alerts regarding security anomalies. Planning processes respond to alerts by selecting mitigation strategies. Mitigations are imposed system-wide and can result in adaptations to the analysis technology, such as the IDS. Without adaptation the IDS can become stagnate in its detection quality. In this paper, we describe an architectural design for an adaptive layer that works directly with an IDS. We examine two use cases involving different mitigation strategies and their impacts on the IDS's supporting components.

show abstract

Section: Attack Graphsmentioning

confidence: 99%

Section: Attack Graphsmentioning

confidence: 99%

Section: Attack Graphsmentioning

confidence: 99%

See 1 more Smart Citation

Decolonizing Information Technology Design: A Framework for Integrating Indigenous Knowledge in Design Science Research

Chung,

Shedlock,

Corbett

2024

Proceedings of the Annual Hawaii International Conference on System Sciences

View full text Add to dashboard Cite

show abstract

“…A Hybrid Attack Graph (HAG) was modeled by [32], using linguistics and type extensions of traditional attack graph given the necessary inputs of asset, topology, and fact declarations in the typed grammar. The HAG was illustrated through an example of an attacker who is trying to compromise an automotive car by forcing it to drivetoward a wall.…”

Section: Related Workmentioning

confidence: 99%

Automatic Hybrid Attack Graph (AHAG) Generation for Complex Engineering Systems

Ibrahim

Alsheikh

2019

Processes

View full text Add to dashboard Cite

Complex Engineering Systems are subject to cyber-attacks due to inherited vulnerabilities in the underlying entities constituting them. System Resiliency is determined by its ability to return to a normal state under attacks. In order to analyze the resiliency under various attacks compromising the system, a new concept of Hybrid Attack Graph (HAG) is introduced. A HAG is a graph that captures the evolution of both logical and real values of system parameters under attack and recovery actions. The HAG is generated automatically and visualized using Java based tools. The results are illustrated through a communication network example.

show abstract

“…Louthan et al [10] describe an approach to modeling hybrid systems, such as programmed control systems and cyber physical systems, that interact with the physical world. Their method used what they term a hybrid attack graph.…”

Section: Attack Graph Modelsmentioning

confidence: 99%