Identifying a preferred countermeasure strategy for attack graphs

Attack graphs capture sequences of actions that an intruder can take to lead the system to an undesirable state. They have proven to be important tools for administrators to analyse and devise countermeasures to be deployed in the face of an attack. We consider preferences over countermeasures that the administrator may hold when devising a strategy to thwart the attacker's goals. We present a formalism based on CI-nets to represent and reason about such preferences. We present a method to find an intervention strategy in terms of a set of countermeasures that is guaranteed to thwart any attack on the system, which is also most preferred.