Abstract:The landscape of cyber threats grows more complex by the day. Advanced Persistent Threats carry out systematic attack campaigns against which cybersecurity practitioners must defend. Examples of such organized attacks are operations Dream Job, Wocao, WannaCry or the SolarWinds Compromise. To evaluate which risks are most threatening, and which campaigns to prioritize against when defending, cybersecurity experts must be equipped with the right toolbox. In particular, they must be able to (a) obtain likelihood values for each attack campaign recorded in the wild and (b) reliably and transparently operationalize these values to carry out quantitative comparisons among campaigns. This will allow security experts to perform quantitatively-informed decision making that is transparent and accountable. In this paper we construct such a framework by: (1) quantifying the likelihood of attack campaigns via data-driven procedures on the MITRE knowledge base and (2) introducing a methodology for automatic modelling of MITRE intelligence data: this is complete in the sense that it captures any attack campaign via template attack tree models. (3) We further propose a computational framework to carry out this comparisons based on the cATM formal logic, and implement this into an open-source Python tool. Finally, we validate our approach by quantifying the likelihood of all MITRE campaigns, and comparing the likelihood of the Wocao and Dream Job MITRE campaigns -- generated with our proposed approach -- against "ad hoc" traditionally-built attack tree models, demonstrating how our methodology is substantially lighter in modelling effort, and still capable of capturing all the quantitative relevant data.

Quantitative Questions on Attack-Defense Trees

Efficient Algorithms for Quantitative Attack Tree Analysis

Efficient and Generic Algorithms for Quantitative Attack Tree Analysis

QuADTool: Attack-Defense-Tree Synthesis, Analysis and Bridge to Verification

ATM: a Logic for Quantitative Security Properties on Attack Trees

Assessing the Understandability and Acceptance of Attack-Defense Trees for Modelling Security Requirements

Fuzzy quantitative attack tree analysis

Discovering, quantifying, and displaying attacks

Attack-Defense Tree Based Security Assessment

Semantics of Attack-Defense Trees for Dynamic Countermeasures and a New Hierarchy of Star-free Languages

Automated generation of attack trees with optimal shape and labelling

Cost-damage analysis of attack trees

Quantitative Risk Assessment of Threats on SCADA Systems Using Attack Countermeasure Tree

Quantitative analysis of attack-fault trees via Markov decision processes

How hard can it be? Quantifying MITRE attack campaigns with attack trees and cATM logic

A Survey of Automatic Generation of Attack Trees and Attack Graphs

Attack-Defense Trees Based Cyber Security Analysis For Cpss

Modeling Attack, Defense and Threat Trees and the Cyber Kill Chain, ATT&CK and STRIDE Frameworks as Blackboard Architecture Networks

Parametric analyses of attack-fault trees

Querying Fault and Attack Trees: Property Specification on a Water Network

A Novel Threat and Risk Assessment Mechanism for Security Controls in Service Management