Attack countermeasure trees (ACT): towards unifying the constructs of attack and defense trees

Attack tree (AT) is one of the widely used non-state-space models for security analysis. The basic formalism of AT does not take into account defense mechanisms. Defense trees (DTs) have been developed to investigate the effect of defense mechanisms using measures such as attack cost, security investment cost, return on attack (ROA), and return on investment (ROI). DT, however, places defense mechanisms only at the leaf nodes and the corresponding ROI/ROA analysis does not incorporate the probabilities of attack. In attack response tree (ART), attack and response are both captured but ART suffers from the problem of state-space explosion, since solution of ART is obtained by means of a state-space model. In this paper, we present a novel attack tree paradigm called attack countermeasure tree (ACT) which avoids the generation and solution of a state-space model and takes into account attacks as well as countermeasures (in the form of detection and mitigation events). In ACT, detection and mitigation are allowed not just at the leaf node but also at the intermediate nodes while at the same time the state-space explosion problem is avoided in its analysis. We study the consequences of incorporating countermeasures in the ACT using three case studies (ACT for BGP attack, ACT for a SCADA attack and ACT for malicious insider attacks). Copyright © 2011 John Wiley & Sons, Ltd.

[1]  Z W Birnbaum,et al.  ON THE IMPORTANCE OF DIFFERENT COMPONENTS IN A MULTICOMPONENT SYSTEM , 1968 .

[2]  Edward J. Sondik,et al.  The Optimal Control of Partially Observable Markov Processes over a Finite Horizon , 1973, Oper. Res..

[3]  Y. Tong,et al.  Optimal arrangement of components via pairwise rearrangements , 1989 .

[4]  Edward G. Amoroso,et al.  Fundamentals of computer security technology , 1994 .

[5]  F. C. Meng Comparing the importance of system components by some structural characteristics , 1996, IEEE Trans. Reliab..

[6]  Kishor S. Trivedi,et al.  Performance And Reliability Analysis Of Computer Systems (an Example-based Approach Using The Sharpe Software , 1997, IEEE Transactions on Reliability.

[7]  Michael A. Johnson,et al.  Supervisory Control and Data Acquisition (SCADA) Systems , 1999 .

[8]  Rodolphe Ortalo,et al.  Experimenting with Quantitative Evaluation Tools for Monitoring Operational Security , 1999, IEEE Trans. Software Eng..

[9]  Bruce Schneier,et al.  Secrets and Lies: Digital Security in a Networked World , 2000 .

[10]  Andrew P. Moore,et al.  Attack Modeling for Information Security and Survivability , 2001 .

[11]  Jerald Dawkins,et al.  A structural framework for modeling multi-stage network attacks , 2002, Proceedings. International Conference on Parallel Processing Workshop.

[12]  George H Baker,et al.  Supervisory Control and Data Acquisition (SCADA) Systems , 2002 .

[13]  Sean Convery,et al.  An Attack Tree for the Border Gateway Protocol , 2003 .

[14]  Scott D. Lathrop,et al.  Modeling Network Attacks Major , 2003 .

[15]  Kishor S. Trivedi,et al.  Importance analysis with Markov chains , 2003, Annual Reliability and Maintainability Symposium, 2003..

[16]  William H. Sanders,et al.  Model-based evaluation: from dependability to security , 2004, IEEE Transactions on Dependable and Secure Computing.

[17]  Sjouke Mauw,et al.  Foundations of Attack Trees , 2005, ICISC.

[18]  Marco Cremonini,et al.  Evaluating Information Security Investments from Attackers Perspective: the Return-On-Attack (ROA) , 2005, WEIS.

[19]  Robert F. Mills,et al.  Developing an Insider Threat Model Using Functional Decomposition , 2005, MMM-ACNS.

[20]  Wes Sonnenreich,et al.  Return On Security Investment (ROSI) - A Practical Quantitative Modell , 2005, J. Res. Pract. Inf. Technol..

[21]  P. Saiz,et al.  Application of 'attack trees' in security analysis of digital contents e-commerce protocols with copyright protection , 2005, Proceedings 39th Annual 2005 International Carnahan Conference on Security Technology.

[22]  Stefano Bistarelli,et al.  Defense trees for economic evaluation of security investments , 2006, First International Conference on Availability, Reliability and Security (ARES'06).

[23]  Stefano Bistarelli,et al.  Strategic Games on Defense Trees , 2006, Formal Aspects in Security and Trust.

[24]  Zhuoqing Morley Mao,et al.  Accurate Real-time Identification of IP Prefix Hijacking , 2007, 2007 IEEE Symposium on Security and Privacy (SP '07).

[25]  E. Todeva Networks , 2007 .

[26]  Vijay Varadharajan,et al.  A Novel Security Risk Evaluation for Information Systems , 2007, 2007 Japan-China Joint Workshop on Frontier of Computer Science and Technology (FCST 2007).

[27]  Richard A. Raines,et al.  A framework for analyzing and mitigating the vulnerabilities of complex systems via attack and protection trees , 2007 .

[28]  Douglas C. Montgomery,et al.  Border Gateway Protocol Security , 2007 .

[29]  Paul Kearney,et al.  A risk-driven security analysis method and modelling language , 2007 .

[30]  Deep Medhi,et al.  Dependability and security models , 2009, 2009 7th International Workshop on Design of Reliable Communication Networks.

[31]  Igor Nai Fovino,et al.  Integrating cyber attacks within fault trees , 2009, Reliab. Eng. Syst. Saf..

[32]  Kishor S. Trivedi,et al.  SHARPE at the age of twenty two , 2009, PERV.

[33]  Kishor S. Trivedi,et al.  Performance and Reliability Analysis of Computer Systems: An Example-Based Approach Using the SHARPE Software Package , 2012 .

[34]  Bruce Schneier,et al.  DIGITAL SECURITY IN A NETWORKED WORLD , 2013 .

[35]  William H. Sanders,et al.  Ieee Transactions on Parallel and Distributed Systems Rre: a Game-theoretic Intrusion Response and Recovery Engine , 2022 .

[36]  T. Tidwell,et al.  Modeling Internet Attacks , 2022 .