Abstract:The complexity of ICT infrastructures is continuously increasing, presenting a formidable challenge in safeguarding them against cyber attacks. In light of escalating cyber threats and limited availability of expert resources, organizations must explore more efficient approaches to assess their resilience and undertake proactive measures. Threat modeling is an effective approach for assessing the cyber resilience of ICT systems. One method is to utilize Attack Graphs, which visually represent the steps taken by adversaries during an attack. Previously, MAL (the Meta Attack Language) was proposed, which serves as a framework for developing Domain-Specific Languages (DSLs) and generating Attack Graphs for modeled infrastructures. coreLang is a MAL-based threat modeling language that utilizes such Attack Graphs to enable attack simulations and security assessments for the generic ICT domain. Developing domain-specific languages for threat modeling and attack simulations provides a powerful approach for conducting security assessments of infrastructures. However, ensuring the correctness of these modeling languages raises a separate research question. In this study we conduct an empirical experiment aiming to falsify such a domain-specific threat modeling language. The potential inability to falsify the language through our empirical testing would lead to its corroboration, strengthening our belief in its validity within the parameters of our study. The outcomes of this approach indicated that, on average, the assessments generated by attack simulations outperformed those of human experts. Additionally, both human experts and simulations exhibited significantly superior performance compared to random guessers in their assessments. While specific human experts occasionally achieved better assessments for particular questions in the experiments, the efficiency of simulation-generated assessments surpasses that of human domain experts.

Cyber security threat modeling based on the MITRE Enterprise ATT&CK Matrix

Empirical Evaluation of a Threat Modeling Language as a Cybersecurity Assessment Tool

Modeling Attack, Defense and Threat Trees and the Cyber Kill Chain, ATT&CK and STRIDE Frameworks as Blackboard Architecture Networks

How Effective Are the Prevailing Attack-Defense Models for Cybersecurity Anyway?

How hard can it be? Quantifying MITRE attack campaigns with attack trees and cATM logic

Model the System from Adversary Viewpoint: Threats Identification and Modeling

Network Security Modeling and Cyber Attack Simulation Methodology

Security Assessment Rating Framework for Enterprises using MITRE ATT&CK Matrix

Assessing MITRE ATT&CK Risk Using a Cyber-Security Culture Framework

Linking Common Vulnerabilities and Exposures to the MITRE ATT&CK Framework: A Self-Distillation Approach

MITRE ATT&CK: State of the Art and Way Forward

Building a Cybersecurity Risk Metamodel for Improved Method and Tool Integration

Asset-centric Threat Modeling for AI-based Systems

Cyberattack Models for Ship Equipment Based on the MITRE ATT&CK Framework

CVE2ATT&CK: BERT-Based Mapping of CVEs to MITRE ATT&CK Techniques

Defense of Advanced Persistent Threat on Industrial Internet of Things With Lateral Movement Modeling

Defining C-ITS Environment and Attack Scenarios

Identification and Verification of Attack-Tree Threat Models in Connected Vehicles

Run-time threat models for systematic and continuous risk assessment

ThreatModeling-LLM: Automating Threat Modeling using Large Language Models for Banking System