Calculating Adversarial Risk from Attack Trees: Control Strength and Probabilistic Attackers

Abstract

Attack trees are a well-known formalism for quantitative analysis of cyber attacks consisting of multiple steps and alternative paths. It is possible to derive properties of the overall attacks from properties of individual steps, such as cost for the attacker and probability of success. However, in existing formalisms, such properties are considered independent. For example, investing more in an attack step would not increase the probability of success. As this seems counterintuitive, we introduce a framework for reasoning about attack trees based on the notion of control strength, annotating nodes with a function from attacker investment to probability of success. Calculation rules on such trees are defined to enable analysis of optimal attacker investment. Our second result consists of the translation of optimal attacker investment into the associated adversarial risk, yielding what we call adversarial risk trees. The third result is the introduction of probabilistic attacker strategies, based on the fitness (utility) of available scenarios. Together these contributions improve the possibilities for using attack trees in adversarial risk analysis.

Security in Embedded Systems: A Model-Based Approach with Risk Metrics

“…These effort has been further extended by other researchers in different contexts, e.g. by LeMay et al [258], and by Pieters and Davarynejad [259].…”

“…Pieters and Davarynejad [259] also investigate how attacker profiles affect probabilities of success for an attack step. The authors distinguish static attacker properties (skills) and dynamic attacker properties (investment schemes).…”

PRIAM: A Privacy Risk Analysis Methodology

“…A natural way to express these relationships among harms, feared events and privacy weaknesses is through harm trees. Harm trees are akin to attack trees in computer security [4,12,14,27,28,41,43,44,45,46,53]. The use of this type of trees is not new for privacy, even if very few papers have been published on this topic.…”

The Attack Navigator

“…One can also consider attacker behaviour over time in order to get frequency metrics for risk analysis [17]. The similarity with economic models also means that there is quite a bit of uncertainty in the results of computations.…”