Abstract:Summary & Conclusions Model-based evaluation in cybersecurity has a long history. Attack Graphs (AGs) and Attack Trees (ATs) were the earlier developed graphical security models for cybersecurity analysis. However, they have limitations (e.g., scalability problem, state-space explosion problem, etc.) and lack the ability to capture other security features (e.g., countermeasures). To address the limitations and to cope with various security features, a graphical security model named attack countermeasure tree (ACT) was developed to perform security analysis by taking into account both attacks and countermeasures. In our research, we have developed different variants of a hierarchical graphical security model to solve the complexity, dynamicity, and scalability issues involved with security models in the security analysis of systems. In this paper, we summarize and classify security models into the following; graph-based, tree-based, and hybrid security models. We discuss the development of a hierarchical attack representation model (HARM) and different variants of the HARM, its applications, and usability in a variety of domains including the Internet of Things (IoT), Cloud, Software- Defined Networking, and Moving Target Defenses. Moreover, we discuss the pros and cons of each variant of HARM based on its applications and usage. Furthermore, several security metrics have been developed to be used with the graphical security model (including HARMs) to analyze the security posture of the systems and evaluate the effectiveness of defense mechanisms which is also being taken as input into optimization algorithms to compute optimal defense deployment. Thus, we provide the classification of the security metrics, including their discussions. Finally, we highlight existing problems and suggest future research directions in the area of graphical security models and applications. As a result of this work, a decision-maker can understand which type of HARM will suit their network or security analysis requirements.

A logging maturity and decision model for the selection of intrusion detection cyber security solutions

Comparing Decision Support Approaches for Cyber Security Investment

A comprehensive model of information security factors for decision-makers

Enhancing cybersecurity defenses: a multicriteria decision-making approach to MITRE ATT&CK mitigation strategy

Markov Decision Process For Automatic Cyber Defense

Maintainable Log Datasets for Evaluation of Intrusion Detection Systems

A hybrid dynamic decision making methodology for defensive information technology contingency measure selection in the presence of cyber threats

Quantifiable & Comparable Evaluations of Cyber Defensive Capabilities: A Survey & Novel, Unified Approach

Model-based Cybersecurity Analysis: Past Work and Future Directions

An Adaptable Approach for Successful SIEM Adoption in Companies

Thinking about intrusion kill chains as mechanisms

Predictive Cyber-security Analytics Framework: A non-homogenous Markov model for Security Quantification

Advanced Cybersecurity Enhancement through Mathematical Models: A Comprehensive Approach Using Statistical Methods, Cryptographic Techniques, and Machine Learning Algorithms (SVM, Random Forest, and Neural Networks) for Behavior-Based Malware Detection

Usefulness of data flow diagrams and large language models for security threat validation: a registered report

Different Mechanisms of Machine Learning and Optimization Algorithms Utilized in Intrusion Detection Systems

Formal Mental Models for Human-Centered Cybersecurity

Enhanced Intrusion Detection Systems Performance with UNSW-NB15 Data Analysis

Evaluating Attacker Risk Behavior in an Internet of Things Ecosystem

Machine learning methods for cyber security intrusion detection: Datasets and comparative study

Modeling of Intrusion and Defense for Assessment of Cyber Security at Power Substations.

Toward cost-sensitive modeling for intrusion detection and response