powerLang: a probabilistic attack simulation language for the power domain

Abstract

Cyber-attacks these threats, the cyber security assessment of IT and OT infrastructures can foster a higher degree of safety and resilience against cyber-attacks. Therefore, the use of attack simulations based on system architecture models is proposed. To reduce the effort of creating new attack graphs for each system under assessment, domain-specific languages (DSLs) can be employed. DSLs codify the common attack logics of the considered domain.Previously, MAL (the Meta Attack Language) was proposed, which serves as a framework to develop DSLs and generate attack graphs for modeled infrastructures. In this article, powerLang as a MAL-based DSL for modeling IT and OT infrastructures in the power domain is proposed. Further, it allows analyzing weaknesses related to known attacks. To comprise powerLang, two existing MAL-based DSL are combined with a new language focusing on industrial control systems (ICS). Finally, this first version of the language was validated against a known cyber-attack.

A Method for Assigning Probability Distributions in Attack Simulation Languages

“…As mentioned earlier, it is a common issue for MAL-based languages to have only a few attack steps and defenses with probability distributions (e.g., [8], [39]). Therefore, we propose a method that guides future developers to find such probabilities and assign them to MAL-based languages.…”

“…Therefore, MAL was proposed to create MAL-based languages. Till date, several MAL-based languages have been proposed, such as enterpriseLang [7] for modeling cyber attacks on enterprise IT systems, powerLang [8] for power-related IT and OT infrastructures, and coreLang [32] for common IT infrastructures.…”

“…In Figure 2, the red arrows represent the possible attack path that attackers can take to achieve their goals. First, attackers send spearphishing emails containing malicious links (i.e., spearphishingLink 7 ), leveraging userExecution 8 . Users clicking on the links can lead to the exploitation of a service vulnerability via exploitationForClientExecution 9 .…”

“…Therefore, it is essential to define probability distributions for most attack steps and defenses of MAL-based languages to provide more realistic simulation results for their system model instances. However, studies on assessing such probability distributions are scarce, and we often rely on security experts to model them [8].…”

“…To provide more realistic simulation results, some MAL-based languages (e.g., [8]) defined probability distributions on a few attack steps and defenses to express the attackers' efforts needed to exploit certain attack steps. Unfortunately, most of them lack a systematic approach to assign probability distributions to more than a few random steps, which would be needed for a robust and complete language.…”