Method for Attack Tree Data Transformation and Import Into IT Risk Analysis Expert Systems
Source abstract
Abstract
Information technology (IT) security risk analysis preventatively helps organizations in identifying their vulnerable systems or internal controls. Some researchers propose expert systems (ES) as the solution for risk analysis automation since risk analysis by human experts is expensive and timely. By design, ES need a knowledge base, which must be up to date and of high quality. Manual creation of databases is also expensive and cannot ensure stable information renewal. These facts make the knowledge base automation process very important. This paper proposes a novel method of converting attack trees to a format usable by expert systems for utilizing the existing attack tree repositories in facilitating information and IT security risk analysis. The method performs attack tree translation into the Java Expert System Shell (JESS) format, by consistently applying ATTop, a software bridging tool that enables automated analysis of attack trees using a model-driven engineering approach, translating attack trees into the eXtensible Markup Language (XML) format, and using the newly developed ATES (attack trees to expert system) program, performing further XML conversion into JESS compatible format. The detailed method description, along with samples of attack tree conversion and results of conversion experiments on a significant number of attack trees, are presented and discussed. The results demonstrate the high method reliability rate and viability of attack trees as a source for the knowledge bases of expert systems used in the IT security risk analysis process.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Information and Cyber Security · Network Security and Intrusion Detection · Digital and Cyber Forensics
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Information Systems, Vilnius Gediminas Technical University, Saulėtekio al. 11, 10223 Vilnius, Lithuania
References (55)
Show source-provided references
1. Development of a Risk Assessment Model for IT Risk Self-Assessment Expert System for SMEs
2. Abraham, A. (2005). Rule-Based Expert Systems. Handbook of Measuring System Design, John Wiley and Sons.10.1002/0471497398.mm422 ↗
3. Akerkar, R.A., and Sajja, P.S. (2010). KnowledgeBased Systems, Jones & Bartlett Publishers.
4. Fuzzy neural networks to create an expert system for detecting attacks by sql injection10.5769/J201801001 ↗
5. Knowledge Based System for Diagnosing Guava Problems
6. Atymtayeva, L., Kozhakhmet, K., and Bortsova, G. (2014). Building a Knowledge Base for Expert System in Information Security. Soft Computing in Artificial Intelligence, Springer.10.1007/978-3-319-05515-2_7 ↗
7. Realization of expert intrusion detection system based on the results of datasets and machine learning algorithm analysis
8. Pinto, F.J. (2019, January 26–28). Application of the Bayesian Model in Expert Systems. Proceedings of the International Symposium on Distributed Computing and Artificial Intelligence, Ávila, Spain.10.1007/978-3-030-23946-6_13 ↗
9. Automated Expert System Knowledge Base Development Method for Information Security Risk Analysis10.15837/ijccc.2019.6.3668 ↗
10. Vitkus, D., Jezukevičiūtė, J., and Goranin, N. (2020). Dynamic Expert System-Based Geographically Adapted Malware Risk Evaluation Method. Int. J. Comput. Commun. Control, 15.10.15837/ijccc.2020.3.3865 ↗
11. Attack detection application with attack tree for mobile system using log analysis10.1007/s11036-018-1012-4 ↗
12. Fault tree analysis for safety/security verification in aviation software10.3390/electronics2010041 ↗
13. Rios, E., Rego, A., Iturbe, E., Higuero, M., and Larrucea, X. (2020). Continuous Quantitative Risk Management in Smart Grids Using Attack Defense Trees. Sensors, 20.10.3390/s20164404 ↗
14. Qiu, S., Liu, Q., Zhou, S., and Wu, C. (2019). Review of artificial intelligence adversarial attack and defense technologies. Appl. Sci., 9.10.3390/app9050909 ↗
15. Ingoldsby, T.R. (2010). Attack Tree-Based Threat Risk Analysis, Amenaza Technologies Limited.
16. Attack-Defense-Trees and other Security Modeling Tools
17. Kordy, B., Kordy, P., Mauw, S., and Schweitzer, P. (2013). ADTool: Security analysis with attack-defense trees. Quantitative Evaluation of Systems, Springer.10.1007/978-3-642-40196-1_15 ↗
18. Bridging two worlds: Reconciling practical risk assessment methodologies with theory of attack trees
19. Wysopal, C. (2014). Threat Modeling: Designing for Security, John Wiley & Sons, Inc.
20. Information Security Risk Assessment Method for Ship Control System Based on Fuzzy Sets and Attack Trees
21. Fila, B., and Wideł, W. (2020, January 22–26). Exploiting attack–defense trees to find an optimal set of countermeasures. Proceedings of the 2020 IEEE 33rd Computer Security Foundations Symposium (CSF), Boston, MA, USA.10.1109/CSF49147.2020.00035 ↗
22. Moore, A.P., Ellison, R.J., and Linger, R.C. (2001). Attack Modelling for Information Security and Survivability, Carnegie Mellon University, Software Engineering Institute.10.21236/ADA387544 ↗
23. Attack Trees
24. Huistra, D.J. (2016). Automated gEneration of Attack Trees by Unfolding Graph Transformation Systems. [Master’s Thesis, University of Twente].
25. DAG-based attack and defense modeling: Don’t miss the forest for the attack trees10.1016/j.cosrev.2014.07.001 ↗
26. Threat modeling using attack trees
27. Salter, C., Saydjari, O.S., Schneier, B., and Wallner, J. (1998, January 22–25). Toward a secure system engineering methodolgy. Proceedings of the 1998 Workshop on New Security Paradigms—NSPW ’98, Charlottsville, VA, USA.10.1145/310889.310900 ↗
28. Sheyner, O., and Wing, J. (2003, January 4–7). Tools for generating and analyzing attack graphs. Proceedings of the International Symposium on Formal Methods for Components and Objects, Leiden, The Netherlands.10.1007/978-3-540-30101-1_17 ↗
29. Gadyatskaya, O., Jhawar, R., Kordy, P., Lounis, K., Mauw, S., and Trujillo-Rasua, R. (2016, January 10–12). Attack trees for practical security assessment: Ranking of attack scenarios with ADTool 2.0. Proceedings of the International Conference on Quantitative Evaluation of Systems, Glasgow, UK.10.1007/978-3-319-43425-4_10 ↗
30. Vigo, R., Nielson, F., and Nielson, H.R. (2014, January 19–22). Automated generation of attack trees. Proceedings of the 2014 IEEE 27th Computer Security Foundations Symposium, Vienna, Austria.10.1109/CSF.2014.31 ↗
31. Wang, P., Lin, W.H., Kuo, P.T., Lin, H.T., and Wang, T.C. (2012, January 24–26). Threat risk analysis for cloud security based on Attack-Defense Trees. Proceedings of the 2012 8th International Conference on Computing Technology and Information Management (NCM and ICNIT), Seoul, Korea.
32. Pinchinat, S., Acher, M., and Vojtisek, D. (2014, January 14–17). Towards synthesis of attack trees for supporting computer-aided risk analysis. Proceedings of the International Conference on Software Engineering and Formal Methods, Amsterdam, The Netherlands.10.1007/978-3-319-15201-1_24 ↗
33. RFID Communication Block (2020, April 14). Security and Trust of Software Systems. Available online: https://satoss.uni.lu/projects/atrees/trees/block_communication.pdf.
34. Audinot, M., Pinchinat, S., and Kordy, B. (2017). Is my attack tree correct?. Computer Security—ESORICS 2017, Springer.10.1007/978-3-319-66402-6_7 ↗
35. Jhawar, R., Lounis, K., Mauw, S., and Ramírez-Cruz, Y. (2018). Semi-automatically Augmenting Attack Trees Using an Annotated Attack Tree Library. Security and Trust Management, Springer.10.1007/978-3-030-01141-3_6 ↗
36. Tentilucci, M., Roberts, N., Kandari, S., Johnson, D., Bogaard, D., Stackpole, B., and Markowsky, G. (2015, January 2–3). Crowdsourcing Computer Security Attack Trees. Proceedings of the 10th Annual Symposium on Information Assurance (ASIA’15), Albany, NY, USA.
37. Attack Tree Translator and Analyzer ATTop (2020, March 18). University of Twente—Formal Methods and Tools. Available online: https://github.com/utwente-fmt/attop.
38. Common Attack Pattern Enumeration and Classification (2020, April 20). Mitre. Available online: https://capec.mitre.org.
39. Knowledge Base of Adversary Tactics and Techniques (2020, April 20). Mitre. Available online: https://attack.mitre.org.
40. A safety/security risk analysis approach of Industrial Control Systems: A cyber bowtie—Combining new version of attack tree with bowtie analysis10.1016/j.cose.2017.09.004 ↗
41. Library of Trees (2020, April 14). Security and Trust of Software Systems. Available online: https://satoss.uni.lu/projects/atrees/library.php.
42. Vintr, Z., Valis, D., and Malach, J. (2012, January 15–18). Attack tree-based evaluation of physical protection systems vulnerability. Proceedings of the 2012 IEEE International Carnahan Conference on Security Technology (ICCST), Boston, MA, USA.10.1109/CCST.2012.6393538 ↗
43. Attack trees with sequential conjunction
44. Pietre-Cambacedes, L., and Bouissou, M. (2010, January 28–30). Beyond attack trees: Dynamic security modeling with Boolean logic Driven Markov Processes (BDMP). Proceedings of the 2010 European Dependable Computing Conference, Valencia, Spain.10.1109/EDCC.2010.32 ↗
45. Russo, A., and Schurr, A. (2018). Effective Analysis of Attack Trees: A Model-Driven Approach. Fundamental Approaches to Software Engineering, Springer.
46. Mission oriented risk and design analysis of critical information systems10.5711/morj.10.2.19 ↗
47. McLaughlin, S., Podkuiko, D., Miadzvezhanka, S., Delozier, A., and McDaniel, P. (2010, January 6–10). Multi-vendor penetration testing in the advanced metering infrastructure. Proceedings of the 26th Annual Computer Security Applications Conference, Austin, TX, USA.10.1145/1920261.1920277 ↗
48. Bogaard, D., and Johnson, D. (2016, January 10–11). Producing and Evaluating Crowdsourced Computer Security Attack Trees. Proceedings of the 2016 IEEE Symposium on Technologies for Homeland Security (HST), Waltham, MA, USA.10.1109/THS.2016.7568951 ↗
49. Ru, Y., Wang, Y., Li, J., Liu, J., Yang, G., Yuan, K., and Liu, K. (2016, January 13–15). Risk assessment of cyber attacks in ECPS based on attack tree and AHP. Proceedings of the 2016 12th International Conference on Natural Computation, Fuzzy Systems and Knowledge Discovery (ICNC-FSKD 2016), Changsha, China.10.1109/FSKD.2016.7603218 ↗
50. Cole, E. (2020, April 14). SANS ICS Attack Surfaces. Available online: https://www.sans.org/summit-archives/file/summit-archive-1493739527.pdf.
51. Security risk assessment framework for smart car using the attack tree analysis10.1007/s12652-016-0442-8 ↗
52. Petrica, G., Axinte, S., Bacivarov, I.C., Firoiu, M., and Mihai, I.C. (July, January 29). Studying Cyber Security Threats to Web Platforms Using Attack Tree Diagrams. Proceedings of the 2017 9th International Conference on Electronics, Computers and Artificial Intelligence (ECAI), Targoviste, Romania.10.1109/ECAI.2017.8166456 ↗
53. Xiao, Y., Wang, Y.J., and Huang, Z.G. (2012, January 9–11). Survivability analysis of SOA based on attack tree models. Proceedings of the International Conference on Communication Technology Proceedings, Chengdu, China.
54. Understanding risk through attack tree analysis
55. (2020, February 17). OWASP Risk Rating Methodology. Available online: https://owasp.org/www-project-risk-assessment-framework/.