Quantitative Attack Tree Analysis via Priced Timed Automata

Kumar, Rajesh; Ruijters, Enno Jozef Johannes; Stoelinga, Mariëlle

doi:10.1007/978-3-319-22975-1_11

Cited by 62 publications

(87 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Arnold et al [23] analysed the timing of attack scenarios using continuous-time Markov chains, but do not reason about strategies; [24] used priced time automata and the Uppaal model checker to analyse attack trees, but without probabilities. More recently, [25] explored how stochastic timed automata can be used to study attack-defence scenarios where timing plays a central role.…”

Section: Related Workmentioning

confidence: 99%

Quantitative Verification and Synthesis of Attack-Defence Scenarios

Aslanyan

Nielson

Parker

2016

2016 IEEE 29th Computer Security Foundations Symposium (CSF)

View full text Add to dashboard Cite

Abstract-Attack-defence trees are a powerful technique for formally evaluating attack-defence scenarios. They represent in an intuitive, graphical way the interaction between an attacker and a defender who compete in order to achieve conflicting objectives. We propose a novel framework for the formal analysis of quantitative properties of complex attack-defence scenarios, using an extension of attack-defence trees which models temporal ordering of actions and allows explicit dependencies in the strategies adopted by attackers and defenders. We adopt a game-theoretic approach, translating attack-defence trees to two-player stochastic games, and then employ probabilistic model checking techniques to formally analyse these models. This provides a means to both verify formally specified security properties of the attack-defence scenarios and, dually, to synthesise strategies for attackers or defenders which guarantee or optimise some quantitative property, such as the probability of a successful attack, the expected cost incurred, or some multi-objective trade-off between the two. We implement our approach, building upon the PRISM-games model checker, and apply it to a case study of an RFID goods management system.

show abstract

Section: Related Workmentioning

confidence: 99%

Quantitative Verification and Synthesis of Attack-Defence Scenarios

Aslanyan

Nielson

Parker

2016

2016 IEEE 29th Computer Security Foundations Symposium (CSF)

View full text Add to dashboard Cite

show abstract

“…Attack trees have been equipped with various semantics [40,25,23] and supported by tools [2,21]. They have also been enhanced with various methods for quantitative analysis [27,4,33,5,43,10,12,36,37,35], which allow determining for a given attack tree, for example, an organisation's losses due to an attack, the probability that such an attack succeeds, or the cost of a successful attack [22].…”

Section: Introductionmentioning

confidence: 99%

Attribute evaluation on attack trees with incomplete information

Buldas

Gadyatskaya

Lenin

et al. 2020

Computers & Security

View full text Add to dashboard Cite

Attack trees are considered a useful tool for security modelling because they support qualitative as well as quantitative analysis. The quantitative approach is based on values associated to each node in the tree, expressing, for instance, the minimal cost or probability of an attack. Current quantitative methods for attack trees allow the analyst to, based on an initial assignment of values to the leaf nodes, derive the values of the higher nodes in the tree. In practice, however, it shows to be very difficult to obtain reliable values for all leaf nodes. The main reasons are that data is only available for some of the nodes, that data is available for intermediate nodes rather than for the leaf nodes, or even that the available data is inconsistent. We address these problems by developing a generalisation of the standard bottom-up calculation method in three ways. First, we allow initial attributions of non-leaf nodes. Second, we admit additional relations between attack steps beyond those provided by the underlying attack tree semantics. Third, we support the calculation of an approximative solution in case of inconsistencies. We illustrate our method, which is based on constraint programming, by a comprehensive case study.

show abstract

“…For example, Buldas et al [6], Jürgenson and Willemson [14] introduced multi-parameter attack trees with interdependent variables; Dalton et al [7] have proposed analysing attack trees as Generalized Stochastic Petri Nets; Arnold et al [2] applied interactive Input/Output Markov Chains to enhance temporal and stochastic dependencies analysis in attack trees. Kumar et al [17] have considered priced timed automata for analysis of attack trees. This work defines a translation for each leaf node and each gate in an attack tree into a priced timed automaton.…”

Section: Introductionmentioning

confidence: 99%

“…For doing this we develop a modelling framework for expressing the temporal behaviour of the attacker with the formalism networks of timed automata. Unlike the work of [17] the attack-defense-tree is not encoded as a timed automata -instead it is encoded as a boolean formula, which the attacker wishes to become true. This encoding allows us to apply state-of-the-art model checking tools and techniques to perform fully automated analyses of the modelled system, both qualitative (boolean) analysis and quantitative (probabilistic) analysis.…”

Section: Introductionmentioning

confidence: 99%

Modelling Attack-defense Trees Using Timed Automata

Gadyatskaya

Hansen

Larsen

et al. 2016

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Performing a thorough security risk assessment of an organisation has always been challenging, but with the increased reliance on outsourced and off-site third-party services, i.e., "cloud services", combined with internal (legacy) IT-infrastructure and -services, it has become a very difficult and time-consuming task. One of the traditional tools available to ease the burden of performing a security risk assessment and structure security analyses in general is attack trees [19,23,24], a tree-based formalism inspired by fault trees, a well-known formalism used in safety engineering. In this paper we study an extension of traditional attack trees, called attack-defense trees, in which not only the attacker's actions are modelled, but also the defensive actions taken by the attacked party [15]. In this work we use the attack-defense tree as a goal an attacker wants to achieve, and separate the behaviour of the attacker and defender from the attack-defense-tree. We give a fully stochastic timed semantics for the behaviour of the attacker by introducing attacker profiles that choose actions probabilistically and execute these according to a probability density. Lastly, the stochastic semantics provides success probabilitites for individual actions. Furthermore, we show how to introduce costs of attacker actions. Finally, we show how to automatically encode it all with a network of timed automata, an encoding that enables us to apply state-of-the-art model checking tools and techniques to perform fully automated quantitative and qualitative analyses of the modelled system.

show abstract

Quantitative Attack Tree Analysis via Priced Timed Automata

Cited by 62 publications

References 25 publications

Quantitative Verification and Synthesis of Attack-Defence Scenarios

Quantitative Verification and Synthesis of Attack-Defence Scenarios

Attribute evaluation on attack trees with incomplete information

Modelling Attack-defense Trees Using Timed Automata

Contact Info

Product

Resources

About