Pareto Efficient Solutions of Attack-Defence Trees

Aslanyan, Zaruhi; Nielson, Flemming

doi:10.1007/978-3-662-46666-7_6

Cited by 44 publications

(60 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…An essential next step in risk assessment is to valuate the risk and impact of an attack, for example, by annotating the attack model with metrics and performing analyses on them [13]. This mapping can be achieved by associating the elements' identifiers with relevant metrics.…”

Section: Graphical System Modelsmentioning

confidence: 99%

Transforming Graphical System Models to Graphical Attack Models

Ivanova

Probst

Hansen

et al. 2016

Graphical Models for Security

View full text Add to dashboard Cite

Abstract. Manually identifying possible attacks on an organisation is a complex undertaking; many different factors must be considered, and the resulting attack scenarios can be complex and hard to maintain as the organisation changes. System models provide a systematic representation of organisations that helps in structuring attack identification and can integrate physical, virtual, and social components. These models form a solid basis for guiding the manual identification of attack scenarios. Their main benefit, however, is in the analytic generation of attacks. In this work we present a systematic approach to transforming graphical system models to graphical attack models in the form of attack trees. Based on an asset in the model, our transformations result in an attack tree that represents attacks by all possible actors in the model, after which the actor in question has obtained the asset.

show abstract

Section: Graphical System Modelsmentioning

confidence: 99%

Transforming Graphical System Models to Graphical Attack Models

Ivanova

Probst

Hansen

et al. 2016

Graphical Models for Security

View full text Add to dashboard Cite

show abstract

“…Properties of interest [13] of these attacks include required resources, such as time or money, likelihood of success, or impact of the attack based on annotations of the leaf nodes in attack trees. Analyses [14] also identify the Pareto frontier of incomparable properties, for example, the likelihood of success of an attack, and the required budget.…”

Section: Evaluating Attack Modelsmentioning

confidence: 99%

“…For the visualisation described in this article the mapping of leaf nodes to metrics and the analyses performed are irrelevant; we assume an attack tree and a mapping from its nodes to an analysis result. For the purpose of this work we have implemented simplified versions of [13,14].…”

Section: Evaluating Attack Modelsmentioning

confidence: 99%

“…Such methods may lead to sub-optimal solutions when optimising conflicting parameters, e.g., minimising cost while maximising probability; in this scenario it may not be possible to identify the attack that will result in the biggest gain for the attacker. Pareto-efficient solutions [14] result in combinations of these conflicting parameters, and can be used to approximate the results for comparable values. Figure 3 shows an example of a Pareto-efficient solutions for an attack tree that results in probability of a successful attacks ranging from 0 to 0.97 and the corresponding cost ranging from 0 to 695.…”

Section: Pareto-efficient Solutionsmentioning

confidence: 99%

See 1 more Smart Citation

Understanding How Components of Organisations Contribute to Attacks

Aslanyan

Probst

2016

Secure IT Systems

Self Cite

View full text Add to dashboard Cite

Abstract. Attacks on organisations today explore many different layers, including buildings infrastructure, IT infrastructure, and human factor -the physical, virtual, and social layer. Identifying possible attacks, understanding their impact, and attributing their origin and contributing factors is difficult. Recently, system models have been used for automatically identifying possible attacks on the modelled organisation. The generated attacks consider all three layers, making the contribution of building infrastructure, computer infrastructure, and humans (insiders and outsiders) explicit. However, this contribution is only visible in the attack trees as part of the performed steps; it cannot be mapped back to the model directly since the actions usually involve several elements (attacker and targeted actor or asset). Especially for large attack trees, understanding the relations between several model components quickly results in a large quantity of interrelations, which are hard to grasp. In this work we present several approaches for visualising attributes of attacks such as likelihood of success, impact, and required time or skill level. The resulting visualisations provide a link between attacks on an organisations and the contribution of parts of an organisation to the attack and its impact.

show abstract

“…Attack-defense trees are a notable extension of attack trees that include, besides attacker's actions, also defender's actions and model their interplay [3,15]. This extended formalism allows capturing more detailed scenarios, and incorporating the defender's perspective into an analysis.…”

Section: Introductionmentioning

confidence: 99%

Modelling Attack-defense Trees Using Timed Automata

Gadyatskaya

Hansen

Larsen

et al. 2016

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Performing a thorough security risk assessment of an organisation has always been challenging, but with the increased reliance on outsourced and off-site third-party services, i.e., "cloud services", combined with internal (legacy) IT-infrastructure and -services, it has become a very difficult and time-consuming task. One of the traditional tools available to ease the burden of performing a security risk assessment and structure security analyses in general is attack trees [19,23,24], a tree-based formalism inspired by fault trees, a well-known formalism used in safety engineering. In this paper we study an extension of traditional attack trees, called attack-defense trees, in which not only the attacker's actions are modelled, but also the defensive actions taken by the attacked party [15]. In this work we use the attack-defense tree as a goal an attacker wants to achieve, and separate the behaviour of the attacker and defender from the attack-defense-tree. We give a fully stochastic timed semantics for the behaviour of the attacker by introducing attacker profiles that choose actions probabilistically and execute these according to a probability density. Lastly, the stochastic semantics provides success probabilitites for individual actions. Furthermore, we show how to introduce costs of attacker actions. Finally, we show how to automatically encode it all with a network of timed automata, an encoding that enables us to apply state-of-the-art model checking tools and techniques to perform fully automated quantitative and qualitative analyses of the modelled system.

show abstract

Pareto Efficient Solutions of Attack-Defence Trees

Cited by 44 publications

References 24 publications

Transforming Graphical System Models to Graphical Attack Models

Transforming Graphical System Models to Graphical Attack Models

Understanding How Components of Organisations Contribute to Attacks

Modelling Attack-defense Trees Using Timed Automata

Contact Info

Product

Resources

About