Abstract:The landscape of cyber threats grows more complex by the day. Advanced Persistent Threats carry out systematic attack campaigns against which cybersecurity practitioners must defend. Examples of such organized attacks are operations Dream Job, Wocao, WannaCry or the SolarWinds Compromise. To evaluate which risks are most threatening, and which campaigns to prioritize against when defending, cybersecurity experts must be equipped with the right toolbox. In particular, they must be able to (a) obtain likelihood values for each attack campaign recorded in the wild and (b) reliably and transparently operationalize these values to carry out quantitative comparisons among campaigns. This will allow security experts to perform quantitatively-informed decision making that is transparent and accountable. In this paper we construct such a framework by: (1) quantifying the likelihood of attack campaigns via data-driven procedures on the MITRE knowledge base and (2) introducing a methodology for automatic modelling of MITRE intelligence data: this is complete in the sense that it captures any attack campaign via template attack tree models. (3) We further propose a computational framework to carry out this comparisons based on the cATM formal logic, and implement this into an open-source Python tool. Finally, we validate our approach by quantifying the likelihood of all MITRE campaigns, and comparing the likelihood of the Wocao and Dream Job MITRE campaigns -- generated with our proposed approach -- against "ad hoc" traditionally-built attack tree models, demonstrating how our methodology is substantially lighter in modelling effort, and still capable of capturing all the quantitative relevant data.

Quantitative analysis of attack-fault trees via Markov decision processes

Parametric analyses of attack-fault trees

Fusion Assessment of Safety and Security for Intelligent Industrial Unmanned Systems

Cost-damage analysis of attack trees

ATM: a Logic for Quantitative Security Properties on Attack Trees

Model-Based Generation of Attack-Fault Trees

Efficient and Generic Algorithms for Quantitative Attack Tree Analysis

Efficient Algorithms for Quantitative Attack Tree Analysis

Attack time analysis in dynamic attack trees via integer linear programming

QuADTool: Attack-Defense-Tree Synthesis, Analysis and Bridge to Verification

Fuzzy quantitative attack tree analysis

Quantitative Questions on Attack-Defense Trees

How hard can it be? Quantifying MITRE attack campaigns with attack trees and cATM logic

Attack-Defense Trees Based Cyber Security Analysis For Cpss

Threat Risk Analysis for Cloud Security Based on Attack-Defense Trees

Discovering, quantifying, and displaying attacks

Quantitative Risk Assessment of Threats on SCADA Systems Using Attack Countermeasure Tree

Predictive Cyber-security Analytics Framework: A non-homogenous Markov model for Security Quantification

Assessing the Understandability and Acceptance of Attack-Defense Trees for Modelling Security Requirements

Attack tree metrics are operad algebras

Fuzzy Fault Trees Formalized