Coordinated Attack Modeling Based on Attack Tree

Wang Yijun,Xue Zhi

DOI: https://doi.org/10.3969/j.issn.1009-8054.2006.03.024

2006-01-01

Abstract:As attack approach developed from one-step attack to coordinated attack, this article proposed stratified attack tree based on traditional attack tree. Learning from the format of IDMEF, a modular approach is introduced. We take IP-spoofing as an example.

What problem does this paper attempt to address?

An Network Attack Modeling Method Based on MLL-AT

yan fen,yin xinchun,huang hao

DOI: https://doi.org/10.1016/j.phpro.2012.02.260

2012-01-01

Physics Procedia

Abstract:In this paper, the method of modeling attack using attack tree is researched. The main goal is effectively using attack tree to model and express multi-stage network attacks. We expand and improve the traditional attack tree. The attack nodes in traditional attack tree are redefined, and the attack risk of leaf node is quantified. On those basis, the mentality and method of building MLL-AT (Multi-Level & Layer Attack Tree) are proposed. The improved attack tree can model attack more accurately, in particular to multi-stage network attacks. And the new model can also be used to evaluate system's risk, to distinguish between varying system security threat degrees caused by different attack sequences.
Modeling Attack, Defense and Threat Trees and the Cyber Kill Chain, ATT&CK and STRIDE Frameworks as Blackboard Architecture Networks

Jeremy Straub

DOI: https://doi.org/10.1109/smartcloud49737.2020.00035

2020-11-01

Abstract:Multiple techniques for modeling cybersecurity attacks and defense have been developed. The use of tree- structures as well as techniques proposed by several firms (such as Lockheed Martin’s Cyber Kill Chain, Microsoft’s STRIDE and the MITRE ATT&CK frameworks) have all been demonstrated. These approaches model actions that can be taken to attack or stopped to secure infrastructure and other resources, at different levels of detail. This paper builds on prior work on using the Blackboard Architecture for cyberwarfare and proposes a generalized solution for modeling framework/paradigm-based attacks that go beyond the deployment of a single exploit against a single identified target. The Blackboard Architecture Cyber Command Entity attack Route (BACCER) identification system combines rules and facts that implement attack type determination and attack decision making logic with actions that implement reconnaissance techniques and attack and defense actions. BACCER’s efficacy to model examples of tree-structures and other models is demonstrated herein.
Modeling of the Mimic Defense Based on Heterogeneous Redundancy

QIN Junning,HAN Jiajia,ZHOU Sheng,WU Chunming,CHEN Shuangxi,ZHAO Ruoyan,ZHANG Jiangyu

DOI: https://doi.org/10.11959/j.issn.1000-0801.2020143

2020-01-01

Abstract:The unbalanced development status of network security was introduced.The main hazards and the mechanism model of penetration testing were described,and the inherent shortcomings of many existing traditional defense methods were analyzed.However,new method of the mimic defense model makes the attack information obtained invalid by dynamically selecting the executive set and adaptively changing the system composition.The same attack mode is difficult to be maintained or reproduced.Based on the attack chain model,the traditional defensetechnology and mimic defense technology were analyzed and compared,and it was demonstrated that it had a protective role in multiple stages of the attack chain.Finally,the effectiveness and superiority of the mimic defense was verified by experiments,and the model was summarized and prospected.
Research on an attack knowledge based enhanced at-tack tree model

Guodong Chen,Yanyi Huang

DOI: https://doi.org/10.1109/CSSS.2011.5974699

2011-01-01

Abstract:To resolve this issue of the documentation description and refined extent of the enhanced attack tree model, defined and formated to the type and the properties of the enhanced attack tree nodes, by the inductive analysis of the attack behavior, determined the level of abstraction of the enhanced attack tree model, achieved the format description of the attack behavior, established an effective attack pattern library; Moreover, by the classification of the attack behavior from the attack phase, the type of attacked operating system and the type of attacked target, achieved a pre-compiled attacks, reduced the search space of the attack pattern and improved the network attack graph generation speed and efficiency.
How Effective Are the Prevailing Attack-Defense Models for Cybersecurity Anyway?

Daojing He,Sammy Chan,Yan Zhang,Chunming Wu,Bing Wang

DOI: https://doi.org/10.1109/mis.2013.105

IF: 6.744

2014-01-01

IEEE Intelligent Systems

Abstract:Attack-defense models play an important role in the design of cybersecurity systems. Here, the authors review some traditional and prevailing attack-defense models along with their weaknesses. Then, they survey some recently proposed paradigm shifts to these models based on which more effective security strategies can be designed. Further, they provide some suggestions on how to adopt the new models, and present challenges that need to be addressed in this field.
EI-MTD: Moving Target Defense for Edge Intelligence Against Adversarial Attacks

Yaguan Qian,Yankai Guo,Qiqi Shao,Jiamin Wang,Bin Wang,Zhaoquan Gu,Xiang Ling,Chunming Wu

DOI: https://doi.org/10.1145/3517806

2021-01-01

Abstract:Edge intelligence has played an important role in constructing smart cities, but the vulnerability of edge nodes to adversarial attacks becomes an urgent problem. A so-called adversarial example can fool a deep learning model on an edge node for misclassification. Due to the transferability property of adversarial examples, an adversary can easily fool a black-box model by a local substitute model. Edge nodes in general have limited resources, which cannot afford a complicated defense mechanism like that on a cloud data center. To address the challenge, we propose a dynamic defense mechanism, namely EI-MTD. The mechanism first obtains robust member models of small size through differential knowledge distillation from a complicated teacher model on a cloud data center. Then, a dynamic scheduling policy, which builds on a Bayesian Stackelberg game, is applied to the choice of a target model for service. This dynamic defense mechanism can prohibit the adversary from selecting an optimal substitute model for black-box attacks. We also conduct extensive experiments to evaluate the proposed mechanism, and results show that EI-MTD could protect edge intelligence effectively against adversarial attacks in black-box settings.
How hard can it be? Quantifying MITRE attack campaigns with attack trees and cATM logic

Stefano M. Nicoletti,Milan Lopuhaä-Zwakenberg,Mariëlle Stoelinga,Fabio Massacci,Carlos E. Budde

2024-10-19

Abstract:The landscape of cyber threats grows more complex by the day. Advanced Persistent Threats carry out systematic attack campaigns against which cybersecurity practitioners must defend. Examples of such organized attacks are operations Dream Job, Wocao, WannaCry or the SolarWinds Compromise. To evaluate which risks are most threatening, and which campaigns to prioritize against when defending, cybersecurity experts must be equipped with the right toolbox. In particular, they must be able to (a) obtain likelihood values for each attack campaign recorded in the wild and (b) reliably and transparently operationalize these values to carry out quantitative comparisons among campaigns. This will allow security experts to perform quantitatively-informed decision making that is transparent and accountable. In this paper we construct such a framework by: (1) quantifying the likelihood of attack campaigns via data-driven procedures on the MITRE knowledge base and (2) introducing a methodology for automatic modelling of MITRE intelligence data: this is complete in the sense that it captures any attack campaign via template attack tree models. (3) We further propose a computational framework to carry out this comparisons based on the cATM formal logic, and implement this into an open-source Python tool. Finally, we validate our approach by quantifying the likelihood of all MITRE campaigns, and comparing the likelihood of the Wocao and Dream Job MITRE campaigns -- generated with our proposed approach -- against "ad hoc" traditionally-built attack tree models, demonstrating how our methodology is substantially lighter in modelling effort, and still capable of capturing all the quantitative relevant data.

Cryptography and Security,Logic in Computer Science
Defense of Advanced Persistent Threat on Industrial Internet of Things With Lateral Movement Modeling

Jichao Bi,Shibo He,Fengji Luo,Wenchao Meng,Luyue Ji,Da-Wen Huang

DOI: https://doi.org/10.1109/TII.2022.3231406

IF: 12.3

2023-01-01

IEEE Transactions on Industrial Informatics

Abstract:Industrial Internet of Things (IIoT) is vulnerable to advanced persistent threat (APT). In this article, we study a scenario in which APT is launched to attack IIoT devices. Considering the APTs lateral movement, a node-level state evolution model is established to calculate the probability of every device in an IIoT system to be compromised by APT. Based on this, a Stackelberg game model is proposed for the APT attacker and defender, which can accurately describe the gaming process. An effective computational approach is developed to obtain the potential Stackelberg equilibrium strategy pair of the game. Extensive case studies and comparison studies are conducted to validate the effectiveness of the proposed method.
Correlating Multi-Step Attack and Constructing Attack Scenarios Based on Attack Pattern Modeling

Zhijie Liu,Chongjun Wang,Shifu Chen

DOI: https://doi.org/10.1109/ISA.2008.11

2008-01-01

Abstract:Most cyber-attacks are not single attack actions. They are multi-step attacks composed by a set of attack actions. Although techniques used by attackers can be diverse, attack patterns are generally finite. So we need to find attack steps that are correlated in an attack scenario. By studying the patterns of multi-step cyber attacks, an algorithm is presented for correlating multi-step cyber attacks and constructing attack scenario system based on modeling multi-step cyber attacks. When alerts appear, the algorithm turns them into corresponding attack models based on the knowledge base and correlates them, whether alert or not is based on the weighted cost in the attack path graph and the attack degree of the corresponding host. And attack scenarios can be constructed by correlating the attack path graphs. Moreover, the model can detect intrusion alerts in real time and revise the attack scenarios. Experiments on the DARPA IDS test dataset show the validity of the algorithm.
CoTree: A Side-Channel Collision Tool to Push the Limits of Conquerable Space

Changhai Ou,Debiao He,Kexin Qiao,Shihui Zheng,Siew-Kei Lam,Fan Zhang

DOI: https://doi.org/10.1109/tcad.2023.3288512

IF: 2.9

2023-01-01

IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems

Abstract:By introducing collision information into divide-and-conquer distinguishers, the existing collision-optimized side-channel attacks transform the given candidate space into a significantly smaller collision space, thus achieving more efficient key recovery. However, the candidates of the first several subkeys shared by collision chains are still repeatedly detected, which happens very frequently and brings huge computational overhead. To alleviate this, we propose a highly efficient collision-optimized attack named collision tree (CoTree). This collision detection tool exploits tree structure to store the chains created from the same subchain on the same branch, thus significantly reducing the storage requirements. It then benefits from the properties of both tree and collisions and exploits a top-down tree building procedure and traverses each node only once when detecting their collisions with a candidate of the subkey currently under consideration. Finally, unlike the traditional top-down node removal, CoTree launches a bottom-up branch removal procedure to remove the chains unsatisfying the collision conditions from the tree after traversing all the considered candidates of this subkey, thus avoiding the traversal of the branches satisfying the collision condition. These strategies make our CoTree significantly alleviate the repetitive collision detection, and our experiments verify that it significantly outperforms the existing works.
Streamlining Attack Tree Generation: A Fragment-Based Approach

Irdin Pekaric,Markus Frick,Jubril Gbolahan Adigun,Raffaela Groner,Thomas Witte,Alexander Raschke,Michael Felderer,Matthias Tichy

2023-10-01

Abstract:Attack graphs are a tool for analyzing security vulnerabilities that capture different and prospective attacks on a system. As a threat modeling tool, it shows possible paths that an attacker can exploit to achieve a particular goal. However, due to the large number of vulnerabilities that are published on a daily basis, they have the potential to rapidly expand in size. Consequently, this necessitates a significant amount of resources to generate attack graphs. In addition, generating composited attack models for complex systems such as self-adaptive or AI is very difficult due to their nature to continuously change. In this paper, we present a novel fragment-based attack graph generation approach that utilizes information from publicly available information security databases. Furthermore, we also propose a domain-specific language for attack modeling, which we employ in the proposed attack graph generation approach. Finally, we present a demonstrator example showcasing the attack generator's capability to replicate a verified attack chain, as previously confirmed by security experts.

Cryptography and Security,Information Retrieval
A Stochastic Modeling of Coordinated Internal and External Attacks

Xiaohu Li,Shouhuai Xu

2007-01-01

Abstract:Traditional security analyses are often geared towards cryptographic primitives or protocols. Although such analyses are absolutely necessary, they cannot address a defender’s need for insight into which aspects of a networked system have a significant impact on its security, and how to tune its configurations or parameters so as to improve security, against coordinated internal and external attacks. Such insights may only be offered by appropriate theoretic security models, which have long been sought but not much progress has been made. This paper reports our first step towards modeling coordinated internal and external attacks against networked systems.
A Hierarchical Model for Distributed Attacks

Peng Ning,Sushil Jajodia,X. Sean Wang

DOI: https://doi.org/10.1007/978-1-4615-0467-2_6

2004-01-01

Abstract: In this chapter, we present a model to represent distributed attacks based on the concept of system view presented in Chapter 3. However, instead of developing a completely new model, we extend a model named ARMD [Lin et al., 1998, Lin, 1998], which was developed for host-based intrusion detection. There are several other models that could be used instead of ARMD, including rule based languages (e.g., P-BEST [Lindqvist and Porras, 1999] and RUSSEL [Mounji et al., 1995]), the State Transition Analysis Tool (STAT) [Il-gun et al., 1995, Vigna and Kermmerer, 1998, Vigna and Kemmerer, 1999], and the Colored Petri Automata (CPA) [Kumar, 1995, Kumar and Spafford, 1994].
Analysis and Research of Attack Model

CHEN Chun-xia,HUANG Hao

DOI: https://doi.org/10.3969/j.issn.1001-3695.2005.07.040

2005-01-01

Abstract:It needs to further investigate t echnology of network attack to protect the network security. Attack models can help in describing and analyzing the course of attack structurely and effectively, further more, they can help in sharing the security knowledge and improving the efficiency of attack detectio n and security prediction. This article analyzes and compares several attack mod els in common use at present,and then prospects the future directions of attack model research in the end.
Quantitative Questions on Attack-Defense Trees

Barbara Kordy,Sjouke Mauw,Patrick Schweitzer

DOI: https://doi.org/10.48550/arXiv.1210.8092

2012-10-31

Abstract:Attack-defense trees are a novel methodology for graphical security modeling and assessment. The methodology includes visual, intuitive tree models whose analysis is supported by a rigorous mathematical formalism. Both, the intuitive and the formal components of the approach can be used for quantitative analysis of attack-defense scenarios. In practice, we use intuitive questions to ask about aspects of scenarios we are interested in. Formally, a computational procedure, defined with the help of attribute domains and a bottom-up algorithm, is applied to derive the corresponding numerical values. This paper bridges the gap between the intuitive and the formal way of quantitatively assessing attack-defense scenarios. We discuss how to properly specify a question, so that it can be answered unambiguously. Given a well specified question, we then show how to derive an appropriate attribute domain which constitutes the corresponding formal model. Since any attack tree is in particular an attack-defense tree, our analysis is also an advancement of the attack tree methodology.

Cryptography and Security
A Model of APT Attack Defense Based on Cyber Threat Detection

Yue Li,Teng Zhang,Xue Li,Ting Li

DOI: https://doi.org/10.1007/978-981-13-6621-5_10

2019-01-01

Abstract:AbstractThe targets of Advanced Persistent Threat (APT) are mainly concentrate on national key information infrastructure, key research institutes, and large commercial companies, for the purpose of stealing sensitive information, trade secrets or destroying important infrastructure. Traditional protection system is difficult to detect the APT attack, due to the method of the APT attack is unknown and uncertain. And the persisted evolution ability destroyed the traditional protection methods based on feature detection. Therefore, this paper based on the theory of red-blue confrontation, to construct the game model of attack and defense. And then combined the APT offense and defense experience, presents a model based on cyber threat detection to deal with APT attacks.
Vulnerability Assessment on WAMS Communication System Based on Attack Tree Model

张恺伦,江全元

2013-01-01

Abstract:With the promotion and application of wide area measurement systems (WAMS) in power system, the security of its communication system is attracting a growing body of research. To analyze the vulnerability of WAMS communication infrastructures when facing network intrusions, an assessing method of vulnerability based on attack tree model is proposed. First, the attack tree model of WAMS communication system is established, which directly reflects the intrusion scenarios when the system is maliciously attacked. Second, a more reasonable assessing method for the vulnerability of passwords and ports is proposed, as well as the vulnerability of the system with all scenarios taken into consideration. Finally, the paper puts forth the concept of vulnerability sensitivity, which can quantitatively evaluate the effect of changes in the leaf vulnerability on the system, so as to find out the critical port.
Coordinated Topology Attacks in Smart Grid Using Deep Reinforcement Learning

Zhenhua Wang,Haibo He,Zhiqiang Wan,Yan Sun

DOI: https://doi.org/10.1109/tii.2020.2994977

IF: 12.3

2021-02-01

IEEE Transactions on Industrial Informatics

Abstract:In this article, we investigate the coordinated topology attacks in smart grid, which combine a physical topology attack and a cyber-topology attack. The physical attack first trips a transmission line. In order to deceive the control center, the attacker masks the outage signal of the tripped line in the cyber layer and then creates a fake outage signal for another transmission line. The goal of coordinated topology attacks is to overload a critical line (different from the physical tripped line and the fake outage line) by misleading the control center into making improper dispatch. In order to determine the attack strategy, we propose a deep-reinforcement-learning-based method to identify the physical tripped line and the fake outage line. Besides, in order to block the outage signal of the tripped line and create the fake outage signal with limited attack resources, we propose a deep-reinforcement-learning-based approach to determine the minimal attack resources. Numerical simulations verify the effectiveness of the proposed method.

automation & control systems,computer science, interdisciplinary applications,engineering, industrial
Efficient and Generic Algorithms for Quantitative Attack Tree Analysis

Milan Lopuhaä-Zwakenberg,Carlos E. Budde,Mariëlle Stoelinga

DOI: https://doi.org/10.1109/TDSC.2022.3215752

2022-12-11

Abstract:Numerous analysis methods for quantitative attack tree analysis have been proposed. These algorithms compute relevant security metrics, i.e. performance indicators that quantify how good the security of a system is; typical metrics being the most likely attack, the cheapest, or the most damaging one. However, existing methods are only geared towards specific metrics or do not work on general attack trees. This paper classifies attack trees in two dimensions: proper trees vs. directed acyclic graphs (i.e. with shared subtrees); and static vs. dynamic gates. For three out of these four classes, we propose novel algorithms that work over a generic attribute domain, encompassing a large number of concrete security metrics defined on the attack tree semantics; dynamic attack trees with directed acyclic graph structure are left as an open problem. We also analyse the computational complexity of our methods.

Cryptography and Security,Data Structures and Algorithms
Adaptive neural network tracking and controlling network attack node in WSN

Wei Wang,Zhilai Zhang,Zhihui Wang

2018-01-01

Abstract:At the time of formulating network attack strategy, information of target network is uncertain and the attacker lacks comprehensive, reliable and real-time attack basis, which makes it difficult to achieve attack effect. Hence, a scientific complex network attack method is proposed. The attackers’ income, loss, cost and encountered risk in network attack are analyzed and index system is established to comprehensively evaluate attack effect of network node with dynamic Bayesian network and overcome defects of static evaluation for target node by traditional evaluation method of node significance by relying on single index of network topology. Simulation experiment shows that such method combines more node relationship and observation relationship at the time of attack, avoids the gap between actual attack effect and theoretical expectation when attack is implemented by relying on static evaluation. In the meanwhile, it is more accurate in attack precision and of high attack efficiency.

Coordinated Attack Modeling Based on Attack Tree

An Network Attack Modeling Method Based on MLL-AT

Modeling Attack, Defense and Threat Trees and the Cyber Kill Chain, ATT&CK and STRIDE Frameworks as Blackboard Architecture Networks

Modeling of the Mimic Defense Based on Heterogeneous Redundancy

Research on an attack knowledge based enhanced at-tack tree model

How Effective Are the Prevailing Attack-Defense Models for Cybersecurity Anyway?

EI-MTD: Moving Target Defense for Edge Intelligence Against Adversarial Attacks

How hard can it be? Quantifying MITRE attack campaigns with attack trees and cATM logic

Defense of Advanced Persistent Threat on Industrial Internet of Things With Lateral Movement Modeling

Correlating Multi-Step Attack and Constructing Attack Scenarios Based on Attack Pattern Modeling

CoTree: A Side-Channel Collision Tool to Push the Limits of Conquerable Space

Streamlining Attack Tree Generation: A Fragment-Based Approach

A Stochastic Modeling of Coordinated Internal and External Attacks

A Hierarchical Model for Distributed Attacks

Analysis and Research of Attack Model

Quantitative Questions on Attack-Defense Trees

A Model of APT Attack Defense Based on Cyber Threat Detection

Vulnerability Assessment on WAMS Communication System Based on Attack Tree Model

Coordinated Topology Attacks in Smart Grid Using Deep Reinforcement Learning

Efficient and Generic Algorithms for Quantitative Attack Tree Analysis

Adaptive neural network tracking and controlling network attack node in WSN