Stochastic-based Semantics Of Attack-Defense Trees For Security Assessment

Abstract

Losses caused by cyber-attacks are considerably increasing each year. The need for an optimal security assessment methodology that combines mathematical foundations with practical and user-friendly representations has become imperatively crucial. In this paper, we propose a stochastic security assessment methodology that adopts attack-defense trees model to represent security scenarios, and stochastic models to perform both qualitative and quantitative assessment. We illustrate our approach with a simple but realistic example study.