Abstract:In the design of software and cyber-physical systems, security is often perceived as a qualitative need, but can only be attained quantitatively. Especially when distributed components are involved, it is hard to predict and confront all possible attacks. A main challenge in the development of complex systems is therefore to discover attacks, quantify them to comprehend their likelihood, and communicate them to non-experts for facilitating the decision process. To address this three-sided challenge we propose a protection analysis over the Quality Calculus that (i) computes all the sets of data required by an attacker to reach a given location in a system, (ii) determines the cheapest set of such attacks for a given notion of cost, and (iii) derives an attack tree that displays the attacks graphically. The protection analysis is first developed in a qualitative setting, and then extended to quantitative settings following an approach applicable to a great many contexts. The quantitative formulation is implemented as an optimisation problem encoded into Satisfiability Modulo Theories, allowing us to deal with complex cost structures. The usefulness of the framework is demonstrated on a national-scale authentication system, studied through a Java implementation of the framework.

Semantics of Attack-Defense Trees for Dynamic Countermeasures and a New Hierarchy of Star-free Languages

Adversarial Formal Semantics of Attack Trees and Related Problems

Quantitative Questions on Attack-Defense Trees

Attack Trees with Sequential Conjunction

Automated generation of attack trees with optimal shape and labelling

ATM: a Logic for Quantitative Security Properties on Attack Trees

Efficient Algorithms for Quantitative Attack Tree Analysis

QuADTool: Attack-Defense-Tree Synthesis, Analysis and Bridge to Verification

Modeling Attack, Defense and Threat Trees and the Cyber Kill Chain, ATT&CK and STRIDE Frameworks as Blackboard Architecture Networks

Tree-depth, quantifier elimination, and quantifier rank.

On topology-related properties of abstract argumentation semantics. A correction and extension to Dynamics of argumentation systems: A division-based method.

Defense Semantics of Argumentation: Encoding Reasons for Accepting Arguments.

Attack-Defense Tree Based Security Assessment

Optimal Scheduling of Agents in ADTrees: Specialized Algorithm and Declarative Models

Efficient and Generic Algorithms for Quantitative Attack Tree Analysis

Parametric analyses of attack-fault trees

Optimal Scheduling of Agents in ADTrees: Specialised Algorithm and Declarative Models

Discovering, quantifying, and displaying attacks

Assessing the Understandability and Acceptance of Attack-Defense Trees for Modelling Security Requirements

Defense semantics of argumentation: revisit

Attack time analysis in dynamic attack trees via integer linear programming