Fuzzy quantitative attack tree analysis

Thi Kim Nhung Dang,Milan Lopuhaä-Zwakenberg,Mariëlle Stoelinga

2024-01-23

Abstract:Attack trees are important for security, as they help to identify weaknesses and vulnerabilities in a system. Quantitative attack tree analysis supports a number security metrics, which formulate important KPIs such as the shortest, most likely and cheapest attacks.

Cryptography and Security

What problem does this paper attempt to address?

Efficient Algorithms for Quantitative Attack Tree Analysis

Carlos E. Budde,Mariëlle Stoelinga

DOI: https://doi.org/10.1109/CSF51468.2021.00041

2021-05-22

Abstract:Numerous analysis methods for quantitative attack tree analysis have been proposed. These algorithms compute relevant security metrics, i.e. performance indicators that quantify how good the security of a system is, such as the most likely attack, the cheapest, or the most damaging one. This paper classifies attack trees in two dimensions: proper trees vs. directed acyclic graphs (i.e. with shared subtrees); and static vs. dynamic gates. For each class, we propose novel algorithms that work over a generic attribute domain, encompassing a large number of concrete security metrics defined on the attack tree semantics. We also analyse the computational complexity of our methods.

Cryptography and Security,Data Structures and Algorithms
Efficient and Generic Algorithms for Quantitative Attack Tree Analysis

Milan Lopuhaä-Zwakenberg,Carlos E. Budde,Mariëlle Stoelinga

DOI: https://doi.org/10.1109/TDSC.2022.3215752

2022-12-11

Abstract:Numerous analysis methods for quantitative attack tree analysis have been proposed. These algorithms compute relevant security metrics, i.e. performance indicators that quantify how good the security of a system is; typical metrics being the most likely attack, the cheapest, or the most damaging one. However, existing methods are only geared towards specific metrics or do not work on general attack trees. This paper classifies attack trees in two dimensions: proper trees vs. directed acyclic graphs (i.e. with shared subtrees); and static vs. dynamic gates. For three out of these four classes, we propose novel algorithms that work over a generic attribute domain, encompassing a large number of concrete security metrics defined on the attack tree semantics; dynamic attack trees with directed acyclic graph structure are left as an open problem. We also analyse the computational complexity of our methods.

Cryptography and Security,Data Structures and Algorithms
Quantitative Questions on Attack-Defense Trees

Barbara Kordy,Sjouke Mauw,Patrick Schweitzer

DOI: https://doi.org/10.48550/arXiv.1210.8092

2012-10-31

Abstract:Attack-defense trees are a novel methodology for graphical security modeling and assessment. The methodology includes visual, intuitive tree models whose analysis is supported by a rigorous mathematical formalism. Both, the intuitive and the formal components of the approach can be used for quantitative analysis of attack-defense scenarios. In practice, we use intuitive questions to ask about aspects of scenarios we are interested in. Formally, a computational procedure, defined with the help of attribute domains and a bottom-up algorithm, is applied to derive the corresponding numerical values. This paper bridges the gap between the intuitive and the formal way of quantitatively assessing attack-defense scenarios. We discuss how to properly specify a question, so that it can be answered unambiguously. Given a well specified question, we then show how to derive an appropriate attribute domain which constitutes the corresponding formal model. Since any attack tree is in particular an attack-defense tree, our analysis is also an advancement of the attack tree methodology.

Cryptography and Security
Discovering, quantifying, and displaying attacks

Roberto Vigo,Flemming Nielson,Hanne Riis Nielson

DOI: https://doi.org/10.2168/LMCS-12%284%3A5%292016

2016-10-19

Abstract:In the design of software and cyber-physical systems, security is often perceived as a qualitative need, but can only be attained quantitatively. Especially when distributed components are involved, it is hard to predict and confront all possible attacks. A main challenge in the development of complex systems is therefore to discover attacks, quantify them to comprehend their likelihood, and communicate them to non-experts for facilitating the decision process. To address this three-sided challenge we propose a protection analysis over the Quality Calculus that (i) computes all the sets of data required by an attacker to reach a given location in a system, (ii) determines the cheapest set of such attacks for a given notion of cost, and (iii) derives an attack tree that displays the attacks graphically. The protection analysis is first developed in a qualitative setting, and then extended to quantitative settings following an approach applicable to a great many contexts. The quantitative formulation is implemented as an optimisation problem encoded into Satisfiability Modulo Theories, allowing us to deal with complex cost structures. The usefulness of the framework is demonstrated on a national-scale authentication system, studied through a Java implementation of the framework.

Cryptography and Security,Logic in Computer Science
QuADTool: Attack-Defense-Tree Synthesis, Analysis and Bridge to Verification

Florian Dorfhuber,Julia Eisentraut,Katharina Klioba,Jan Kretinsky

2024-09-18

Abstract:Ranking risks and countermeasures is one of the foremost goals of quantitative security analysis. One of the popular frameworks, used also in industrial practice, for this task are attack-defense trees. Standard quantitative analyses available for attack-defense trees can distinguish likely from unlikely vulnerabilities. We provide a tool that allows for easy synthesis and analysis of those models, also featuring probabilities, costs and time. Furthermore, it provides a variety of interfaces to existing model checkers and analysis tools. Unfortunately, currently available tools rely on precise quantitative inputs (probabilities, timing, or costs of attacks), which are rarely available. Instead, only statistical, imprecise information is typically available, leaving us with probably approximately correct (PAC) estimates of the real quantities. As a part of our tool, we extend the standard analysis techniques so they can handle the PAC input and yield rigorous bounds on the imprecision and uncertainty of the final result of the analysis.

Cryptography and Security
Quantitative analysis of attack-fault trees via Markov decision processes

Milan Lopuhaä-Zwakenberg

2024-08-13

Abstract:Adequate risk assessment of safety critical systems needs to take both safety and security into account, as well as their interaction. A prominent methodology for modeling safety and security are attack-fault trees (AFTs), which combine the well-established fault tree and attack tree methodologies for safety and security, respectively. AFTs can be used for quantitative analysis as well, capturing the interplay between safety and security metrics. However, existing approaches are based on modeling the AFT as a priced-timed automaton. This allows for a wide range of analyses, but Pareto analsis is still lacking, and analyses that exist are computationally expensive. In this paper, we combine safety and security analysis techniques to introduce a novel method to find the Pareto front between the metrics reliability (safety) and attack cost (security) using Markov decision processes. This gives us the full interplay between safety and security while being considerably more lightweight and faster than the automaton approach. We validate our approach on a case study of cyberattacks on an oil pipe line.

Cryptography and Security
ATM: a Logic for Quantitative Security Properties on Attack Trees

Stefano M. Nicoletti,Milan Lopuhaä-Zwakenberg,E. Moritz Hahn,Mariëlle Stoelinga

2024-05-17

Abstract:Critical infrastructure systems - for which high reliability and availability are paramount - must operate securely. Attack trees (ATs) are hierarchical diagrams that offer a flexible modelling language used to assess how systems can be attacked. ATs are widely employed both in industry and academia but - in spite of their popularity - little work has been done to give practitioners instruments to formulate queries on ATs in an understandable yet powerful way. In this paper we fill this gap by presenting ATM, a logic to express quantitative security properties on ATs. ATM allows for the specification of properties involved with security metrics that include "cost", "probability" and "skill" and permits the formulation of insightful what-if scenarios. To showcase its potential, we apply ATM to the case study of a CubeSAT, presenting three different ways in which an attacker can compromise its availability. We showcase property specification on the corresponding attack tree and we present theory and algorithms - based on binary decision diagrams - to check properties and compute metrics of ATM-formulae.

Cryptography and Security,Logic in Computer Science
Information System Security Risk Evaluation Based on Attack Tree

甘早斌,吴平,路松峰,李瑞轩

DOI: https://doi.org/10.3969/j.issn.1671-0428.2006.11.013

2007-01-01

Abstract:This paper extended the attack tree model,and proposed a new quantitative risk evaluation method.While the risk value of the leaf node(atomic attack) was quantified,the multi-attribute utility theory was adopted,which could make the result more reasonable.Presented all algorithms for each steps of this new evaluation method that offered a good foundation for the implementation of the automatic evaluation tool.
Fuzzy Fault Trees Formalized

Thi Kim Nhung Dang,Milan Lopuhaä-Zwakenberg,Mariëlle Stoelinga

2024-03-13

Abstract:Fault tree analysis is a vital method of assessing safety risks. It helps to identify potential causes of accidents, assess their likelihood and severity, and suggest preventive measures. Quantitative analysis of fault trees is often done via the dependability metrics that compute the system's failure behaviour over time. However, the lack of precise data is a major obstacle to quantitative analysis, and so to reliability analysis. Fuzzy logic is a popular framework for dealing with ambiguous values and has applications in many domains. A number of fuzzy approaches have been proposed to fault tree analysis, but -- to the best of our knowledge -- none of them provide rigorous definitions or algorithms for computing fuzzy unreliability values. In this paper, we define a rigorous framework for fuzzy unreliability values. In addition, we provide a bottom-up algorithm to efficiently calculate fuzzy reliability for a system. The algorithm incorporates the concept of $\alpha$-cuts method. That is, performing binary algebraic operations on intervals on horizontally discretised $\alpha$-cut representations of fuzzy numbers. The method preserves the nonlinearity of fuzzy unreliability. Finally, we illustrate the results obtained from two case studies.

Artificial Intelligence
Attack tree metrics are operad algebras

Milan Lopuhaä-Zwakenberg

2024-01-18

Abstract:Attack Trees (ATs) are a widely used tool for security analysis. ATs can be employed in quantitative security analysis through metrics, which assign a security value to an AT. Many different AT metrics exist, and there exist multiple general definitions that aim to study a wide variety of AT metrics at once. However, these all have drawbacks: they do not capture all metrics, and they do not easily generalize to extensions of ATs. In this paper, we introduce a definition of AT metrics based on category theory, specifically operad algebras. This encompasses all previous definitions of AT metrics, and is easily generalized to extensions of ATs. Furthermore, we show that under easily expressed operad-theoretic conditions, existing metric calculation algorithms can be extended in considerable generality.

Cryptography and Security,Category Theory
Automated generation of attack trees with optimal shape and labelling

Olga Gadyatskaya,Sjouke Mauw,Rolando Trujillo-Rasuac,Tim A. C.Willemse

2024-07-10

Abstract:This article addresses the problem of automatically generating attack trees that soundly and clearly describe the ways the system can be attacked. Soundness means that the attacks displayed by the attack tree are indeed attacks in the system; clarity means that the tree is efficient in communicating the attack scenario. To pursue clarity, we introduce an attack-tree generation algorithm that minimises the tree size and the information length of its labels without sacrificing correctness. We achieve this by i) introducing a system model that allows to reason about attacks and goals in an efficient manner, and ii) by establishing a connection between the problem of factorising algebraic expressions and the problem of minimising the tree size. To the best of our knowledge, we introduce the first attack-tree generation framework that optimises the labelling and shape of the generated trees, while guaranteeing their soundness with respect to a system specification.

Cryptography and Security,Formal Languages and Automata Theory
Quantitative Risk Assessment of Threats on SCADA Systems Using Attack Countermeasure Tree

Xueqin Gao,Tao Shang,Da Li,Jianwei Liu

DOI: https://doi.org/10.1109/pst55820.2022.9851965

2022-01-01

Abstract:SCADA systems are one of the critical infrastructures and face many security threats. Attackers can control SCADA systems through network attacks, destroying the normal operation of the power system. It is important to conduct a risk assessment of security threats on SCADA systems. However, existing models for risk assessment using attack trees mainly focus on describing possible intrusions rather than the interaction between threats and defenses. In this paper, we comprehensively consider intrusion likelihood and defense capability and propose a quantitative risk assessment model of security threats based on attack countermeasure tree (ACT). Each leaf node in ACT contains two attributes: exploitable vulnerabilities and defense countermeasures. An attack scenario can be constructed by means of traversing the leaf nodes. We set up six indicators to evaluate the impact of security threats in attack scenarios according to NISTIR 7628 standard. Experimental results show the attack probability of security threats and high-risk attack scenarios in SCADA systems. We can improve defense countermeasures to protect against security threats corresponding to high-risk scenarios. In addition, the model can continually update risk assessments based on the implementation of the system’s defensive countermeasures.
Cost-damage analysis of attack trees

Milan Lopuhaä-Zwakenberg,Mariëlle Stoelinga

DOI: https://doi.org/10.48550/arXiv.2304.05812

2023-04-12

Abstract:Attack trees (ATs) are a widely deployed modelling technique to categorize potential attacks on a system. An attacker of such a system aims at doing as much damage as possible, but might be limited by a cost budget. The maximum possible damage for a given cost budget is an important security metric of a system. In this paper, we find the maximum damage given a cost budget by modelling this problem with ATs, both in deterministic and probabilistic settings. We show that the general problem is NP-complete, and provide heuristics to solve it. For general ATs these are based on integer linear programming. However when the AT is tree-structured, then one can instead use a faster bottom-up approach. We also extend these methods to other problems related to the cost-damage tradeoff, such as the cost-damage Pareto front.

Cryptography and Security,Optimization and Control
Threat Risk Analysis for Cloud Security Based on Attack-Defense Trees

Ping Wang,Wen-Hui Lin,Pu-Tsun Kuo,Hui-Tang Lin

DOI: https://doi.org/10.4156/ijact.vol4.issue17.70

2012-01-01

Abstract:The existing attack trees and attack graphs schemes focused on depicting the possible intrusions by presenting the suspected attack profiles, not for interactions between threats and defenses. Consequently, it limits the adoption of the safeguards with which to select the effective defensive strategies. Accordingly, the present study proposes a new method for solving threat risk analysis problem by means of modified Attack-Defense Trees (ADT) considering the effect of both the attack cost and defense cost. The effectiveness of the proposed approach was evaluated by a set of metrics for mitigating new network threats, like APT attacks. In addition, an illustration case of threat risk analysis of cloud security is given to demonstrate our approach. Finally, the adaptability of the proposed scheme is investigated by the attributes comparison with that of the scheme presented by Edge et al. (2007). Overall, our approach provides an effective means of reconstructing the attack profiles and evaluating the countermeasures in the evolutional process of security management for cloud security.
Fusion Assessment of Safety and Security for Intelligent Industrial Unmanned Systems

Rongyao Cai,Xiao Xv,Zhengming Lu,Kexin Zhang,Yong Liu

DOI: https://doi.org/10.1109/isas61044.2024.10552597

2024-01-01

Abstract:Fault tree analysis is the most commonly used methodology in industrial safety analysis to predict the probability or frequency of system failure. Although fault tree analysis has been proposed for more than six decades, the assumptions used in most commercial fault tree analysis codes have not changed significantly, which limits the ability of the method to represent design, operation, and maintenance characteristics in the context of the increasing complexity and specialization of modern industrial systems. The basic setup of traditional fault trees is unable to include dependencies between events, time-varying failures, and repair rate realities to explain complex maintenance strategies. To address the above shortcomings, we propose a fusion tree model combining fault tree and attack tree, and simplify the causal structure of the fusion tree by modularization, and utilize the dynamic Markov model to represent the complex coupling relationship between components or nodes. Finally, we demonstrate the calculation process of fusion tree in pressure vessel systems with temporal control.
Attack-Defense Tree Based Security Assessment

Suguo Du,Haojin Zhu

DOI: https://doi.org/10.1007/978-1-4614-9357-0_3

2013-01-01

Abstract:In this Chapter, we present an attack-defense tree model for VANETs security and privacy problems, which considered both attacker's and defender's strategies. We also introduce two concepts of Return on Attack and Return on Investment to represent the potential gain from launching an attack or adopting a countermeasure. Both the attack-defense tree and the introduced concepts are preparation work for the attack-defense game analysis of later work in Chap. 4.
Computer security analysis model based on fault tree

Tao Zhang,Mingzeng Hu,Xiaochun YUN,Yongzheng Zhang,ming Zheng

DOI: https://doi.org/10.3321/j.issn:1002-0470.2005.07.004

2005-01-01

Abstract:System visitors were classified into five kinds by their privilege to access system resource by analysing computer resource, visitor privilege, security requirement, vulnerability, etc. The attacker can enhance his privilege using vulnerability. According to distribution of vulnerabilities privilege set, fault tree should be constructed to analyze the system security states under different security requirement condition, and this method could express qualitative security states using attack path and quantificational security states using attack success probability via analyzing fault tree.
Computer vulnerability evaluation using fault tree analysis

Tao Zhang,Mingzeng Hu,Xiaochun Yun,Yongzheng Zhang

DOI: https://doi.org/10.1007/978-3-540-31979-5_26

2005-01-01

Abstract:For analyzing computer system security, the system visitor could be classified into five kinds by his privilege to access system resource, and presented the model base on privilege escalation. The attacker can enhance his privilege by exploiting vulnerability, according to distribution of vulnerabilities privilege set, we could construct fault tree to reflect distinctly potential attack path, and so this method could quantificational express security state at different security policy via analyzing fault tree.
Attack time analysis in dynamic attack trees via integer linear programming

Milan Lopuhaä-Zwakenberg,Mariëlle Stoelinga

2023-09-09

Abstract:Attack trees (ATs) are an important tool in security analysis, and an important part of AT analysis is computing metrics. However, metric computation is NP-complete in general. In this paper, we showcase the use of mixed integer linear programming (MILP) as a tool for quantitative analysis. Specifically, we use MILP to solve the open problem of calculating the min time metric of dynamic ATs, i.e., the minimal time to attack a system. We also present two other tools to further improve our MILP method: First, we show how the computation can be sped up by identifying the modules of an AT, i.e. subtrees connected to the rest of the AT via only one node. Second, we define a general semantics for dynamic ATs that significantly relaxes the restrictions on attack trees compared to earlier work, allowing us to apply our methods to a wide variety of ATs. Experiments on a synthetic testing set of large ATs verify that both the integer linear programming approach and modular analysis considerably decrease the computation time of attack time analysis.

Cryptography and Security
Parametric analyses of attack-fault trees

Étienne André,Didier Lime,Mathias Ramparison,Mariëlle Stoelinga

DOI: https://doi.org/10.48550/arXiv.1902.04336

2019-05-09

Abstract:Risk assessment of cyber-physical systems, such as power plants, connected devices and IT-infrastructures has always been challenging: safety (i.e. absence of unintentional failures) and security (i.e. no disruptions due to attackers) are conditions that must be guaranteed. One of the traditional tools used to help considering these problems is attack trees, a tree-based formalism inspired by fault trees, a well-known formalism used in safety engineering. In this paper we define and implement the translation of attack-fault trees (AFTs) to a new extension of timed automata, called parametric weighted timed automata. This allows us to parametrize constants such as time and discrete costs in an AFT and then, using the model-checker IMITATOR, to compute the set of parameter values such that a successful attack is possible. Using the different sets of parameter values computed, different attack and fault scenarios can be deduced depending on the budget, time or computation power of the attacker, providing helpful data to select the most efficient counter-measure.

Cryptography and Security

Fuzzy quantitative attack tree analysis

Efficient Algorithms for Quantitative Attack Tree Analysis

Efficient and Generic Algorithms for Quantitative Attack Tree Analysis

Quantitative Questions on Attack-Defense Trees

Discovering, quantifying, and displaying attacks

QuADTool: Attack-Defense-Tree Synthesis, Analysis and Bridge to Verification

Quantitative analysis of attack-fault trees via Markov decision processes

ATM: a Logic for Quantitative Security Properties on Attack Trees

Information System Security Risk Evaluation Based on Attack Tree

Fuzzy Fault Trees Formalized

Attack tree metrics are operad algebras

Automated generation of attack trees with optimal shape and labelling

Quantitative Risk Assessment of Threats on SCADA Systems Using Attack Countermeasure Tree

Cost-damage analysis of attack trees

Threat Risk Analysis for Cloud Security Based on Attack-Defense Trees

Fusion Assessment of Safety and Security for Intelligent Industrial Unmanned Systems

Attack-Defense Tree Based Security Assessment

Computer security analysis model based on fault tree

Computer vulnerability evaluation using fault tree analysis

Attack time analysis in dynamic attack trees via integer linear programming

Parametric analyses of attack-fault trees