Attack Trees Research Articles

Identification of Security Scenarios in offshore Oil&Gas production facilities based on past incident analysis

Offshore Oil&Gas installations may be attractive targets of intentional attacks due to their presence in socio-political sensitive areas, their economic significance, and the high impact of scenarios that can be triggered by the mismanagement of the hazardous substances handled (e.g., crude oil, natural gas, etc.). In the present study, a new dataset including 112 past security-related incidents that affected the offshore Oil&Gas sector in the last decades was developed and analyzed using Exploratory Data Analysis (EDA), Root Cause Analysis (RCA), and Attack Tree Analysis (ATA). Significant differences were found in the types of threats and attack modes, with terrorism identified as the primary threat, followed by robbery and kidnapping. The identified scenarios caused fatalities, injuries, and asset damages at the targeted facilities, underscoring their potential to cause severe impacts, comparable to the outcomes of safety-related accidents. Tables linking identified attack modes, scenarios, and consequences specific contribution to the SVA workflow proposed by the API Recommended Practices 70 and 70I were obtained. Overall, the results obtained support the application of suitable Security Vulnerability/Risk Assessment (SVA/SRA) methodologies concerning the identification and characterization of adversaries, the definition of attack modes, the evaluation of effectiveness of existing security barriers, and the assessment of consequences.

Legacy ICS Cybersecurity Assessment Using Hybrid Threat Modeling—An Oil and Gas Sector Case Study

As security breaches are increasingly widely reported in today’s culture, cybersecurity is gaining attention on a global scale. Threat modeling methods (TMM) are a proactive security practice that is essential for pinpointing risks and limiting their impact. This paper proposes a hybrid threat modeling framework based on system-centric, attacker-centric, and risk-centric approaches to identify threats in Operational Technology (OT) applications. OT is made up of software and hardware used to manage, secure, and control industrial control systems (ICS), and its environments include factories, power plants, oil and gas refineries, and pipelines. To visualize the “big picture” of its infrastructure risk profile and improve understanding of the full attack surface, the proposed framework builds on several threat modeling methodologies: PASTA modeling, STRIDE, and attack tree components. Nevertheless, the continuity and stability of vital infrastructure will continue to depend heavily on legacy equipment. Thus, protecting the availability, security, and safety of industrial environments and vital infrastructure from cyberattacks requires operational technology (OT) cybersecurity. The feasibility of the proposed approach is illustrated with a case study from a real oil and gas production plant control system where numerous significant cyberattacks in recent years have targeted OT networks more frequently as hackers realized the possibility of disruption due to insufficient OT security, particularly for outdated systems. The proposed framework achieved better results in detecting threats and severity in the design of the case study system, helping to increase security and support cybersecurity assessment of legacy control systems.

Toward security quantification of serverless computing

Serverless computing is one of the recent compelling paradigms in cloud computing. Serverless computing can quickly run user applications and services regardless of the underlying server architecture. Despite the availability of several commercial and open-source serverless platforms, there are still some open issues and challenges to address. One of the key concerns in serverless computing platforms is security. Therefore, in this paper, we present a multi-layer abstract model of serverless computing for an security investigation. We conduct a quantitative analysis of security risks for each layer. We observe that the Attack Tree and Attack-Defense Tree methodologies are viable approaches in this regard. Consequently, we make use of the Attack Tree and the Attack-Defense Tree to quantify the security risks and countermeasures of serverless computing. We also propose a novel measure called the Relative Risk Matrix (RRM) to quantify the probability of attack success. Stakeholders including application developers, researchers, and cloud providers can potentially apply these findings and implications to better understand and further enhance the security of serverless computing.

A Cyber Risk Assessment Approach to Federated Identity Management Framework-Based Digital Healthcare System.

This paper presents a comprehensive and evidence-based cyber-risk assessment approach specifically designed for Medical Cyber Physical Systems (MCPS)- and Internet-of-Medical Devices (IoMT)-based collaborative digital healthcare systems, which leverage Federated Identity Management (FIM) solutions to manage user identities within this complex environment. While these systems offer advantages like easy data collection and improved collaboration, they also introduce new security challenges due to the interconnected nature of devices and data, as well as vulnerabilities within the FIM and the lack of robust security in IoMT devices. To proactively safeguard the digital healthcare system from cyber attacks with potentially life-threatening consequences, a comprehensive and evidence-based cyber-risk assessment is crucial for mitigating these risks. To this end, this paper proposes a novel cyber-risk assessment approach that leverages a three-dimensional attack landscape analysis, encompassing existing IT infrastructure, medical devices, and Federated Identity Management protocols. By considering their interconnected vulnerabilities, the approach recommends tailored security controls to prioritize and mitigate critical risks, ultimately enhancing system resilience. The proposed approach combines established industry standards like Cyber Resilience Review (CRR) asset management and NIST SP 800-30 for a comprehensive assessment. We have validated our approach using threat modeling with attack trees and detailed attack sequence diagrams on a diverse range of IoMT and MCPS devices from various vendors. The resulting evidence-based cyber-risk assessments and corresponding security control recommendations will significantly support healthcare professionals and providers in improving both patient and medical device safety management within the FIM-enabled healthcare ecosystem.

Predicting Attack Paths from Application Security Vulnerabilities Using a Multi-Layer Perceptron

This paper is in the series of continuing research and proposes an approach to predicting possible attack paths from application security vulnerability-based attack trees. The attack trees are formed by stringing together weaknesses discovered in an application code and a group of applications within a domain. The Common Weakness Enumeration (CWE) and Common Vulnerabilities and Exposures (CVE) linked together as a string of vulnerabilities in the attack trees can be visualized as pathways for attacks. These pathways become potential attacks that can spread vertically and horizontally leading to a multi-path attack that can involve multiple software applications. With more data, and huge number of vulnerabilities, it will become impossible to identify all attack paths unless a full-scale implementation of an autonomous processing mechanism is in place. Machine Learning (ML) and Deep Learning (DL) techniques have been adopted in the cybersecurity space for decades, however all the studies have been around networks, endpoints, and device monitoring. This paper focuses on application security and building on earlier work cited, the use of a vulnerability map that uses attack vectors in a Deep Learning (DL) method implementing a Multi-Layer Perceptron (MLP) forms the basis for developing a predictive model that relates a set of linked vulnerabilities to an attack path. The results are encouraging, and this approach will help in identifying successful or failed attack paths involving multiple applications, isolated or grouped, and will help focus on the right applications and the vulnerabilities associated as priority for remediation.

Plant-Based Insecticides for Control of Aedes aegypti, Sitophilus zeamais and Nasutitermes corniger: A Review and Bibliometric Analysis

Insect pests can transmit diseases or affect the economy and their uncontrolled growth is intensified by human activity, which has affected ecosystems and interfered with trophic chains. Aedes aegypti L. transmits dengue, chikungunya, zika and yellow fever, while Sitophilus zeamais Motsch is a stored grain pest, and Nasutitermes corniger Motsch attacks trees and urban buildings. This work provides a review of the state of art and current trends, as well as a bibliometric analysis on the insecticidal activity of plant-based products against Ae. aegypti, S. zeamais and N. corniger. The review of literature data showed that plant insecticides comprise secondary metabolites and proteins that can impair the viability of embryos, larvae, pupae, and adults, as well as fertility and oviposition or feeding behavior of insects. Also, they tend to be more biodegradable and less harmful to non-target organisms compared to synthetic insecticides. The bibliometric analysis revealed the concentration of publications in tropical regions worldwide, where there is a strong occurrence of diseases transmitted by Ae. aegypti. These reports were far more numerous than those on N. corniger and S. zeamais. Furthermore, the synthesis of metallic nanoparticles from plant products has strongly emerged as a current trend.

Prioritization of Application Security Vulnerability Remediation Using Metrics, Correlation Analysis, and Threat Model

As part of a continuing research for evaluating threats posed for exposed attack surface, this study will provide a consolidated view of exploitability of vulnerable applications presenting a web attack surface of an organization exposed to an attacker. While testing and scanning technologies like Static Analysis Security Testing (SAST), Dynamic Analysis Security Testing (DAST), Application Ethical Hack (Penetration Testing), a monitoring technology like the Web Application Firewall (WAF) provides web traffic information of the number of transaction requests for every application under study. To ensure validity, reliability, and completeness of observation multiple applications must be observed. Research from a prior study is referenced that shows correlation between incoming WAF requests and existing vulnerabilities. Using correlation analysis, vulnerabilities metrics, and a threat model analysis help identify pathways to an attack. A vulnerability map-based attack tree can be developed using Common Weakness Enumeration (CWE) and Common Vulnerabilities and Exposures (CVE) information. The threat model analysis and vulnerability-based attack tree can help in simulation studies of possible attacks. This attack tree will show the linkages between vulnerabilities and a lineage pointing to how an attack could travel from the incoming WAF requests to deep down into the application code of exposed and existing, open vulnerabilities travelling laterally to create a more expanded attack crossing trust boundaries using application data flow.

Complying with ISO 26262 and ISO/SAE 21434: A Safety and Security Co-Analysis Method for Intelligent Connected Vehicle.

A cyber-physical system (CPS) integrates communication and automation technologies into the operational processes of physical systems. Nowadays, as a complex CPS, an intelligent connected vehicle (ICV) may be exposed to accidental functional failures and malicious attacks. Therefore, ensuring the ICV's safety and security is crucial. Traditional safety/security analysis methods, such as failure mode and effect analysis and attack tree analysis, cannot provide a comprehensive analysis for the interactions between the system components of the ICV. In this work, we merge system-theoretic process analysis (STPA) with the concept phase of ISO 26262 and ISO/SAE 21434. We focus on the interactions between components while analyzing the safety and security of ICVs to reduce redundant efforts and inconsistencies in determining safety and security requirements. To conquer STPA's abstraction in describing causal scenarios, we improved the physical component diagram of STPA-SafeSec by adding interface elements. In addition, we proposed the loss scenario tree to describe specific scenarios that lead to unsafe/unsecure control actions. After hazard/threat analysis, a unified risk assessment process is proposed to ensure consistency in assessment criteria and to streamline the process. A case study is implemented on the autonomous emergency braking system to demonstrate the validation of the proposed method.

A Proposed Approach to Integrate Application Security Vulnerability Data with Incidence Response Systems

This paper has proposed a method to develop an attack tree, from application vulnerability data discovered through tests and scans and correlation analysis using incoming transaction requests monitored by a Web Application Firewall (WAF) tool. The attack tree shows multiple pathways for an attack to shape through vulnerability linkages and a deeper analysis of the Common Weakness Enumeration (CWE) and Common Vulnerability Exposure (CVE) mapping to individual vulnerabilities. By further relating to a parent, peer, or child CWE (including CWEs that follow another CWE and in some cases precede other CWEs) will provide more insight into the attack patterns. These patterns will reveal a multi-vulnerability, multi-application attack pattern which will be hard to visualize without data consolidation and correlation analysis. The correlation analysis tied to the test and scan data supports a vulnerability lineage starting from incoming requests to individual vulnerabilities found in the code that traces a possible attack path. This solution, if automated, can provide threat alerts and immediate focus on vulnerabilities that need to be remedied as a priority. SOAR (Security Orchestration, Automation, and Response), XSOAR (Extended Security Orchestration, Automation, and Response), SIEM (Security Information and Event Management), and XDR (Extended Detection and Response) are more constructed to suit networks, infrastructure and devices, and sensors; not meant for application security vulnerability information as collected. So, this paper makes a special case that must be made for integration of application security information as part of threat intelligence, and threat and incident response systems.

A comprehensive framework for quantitative risk assessment of organizational networks using FAIR-modified attack trees

Attack trees are a widely used method for threat modeling and analyzing cyber-attacks in organizational networks. Assessing the risk associated with each individual node of an attack tree is crucial for understanding the overall risk of the attack. This article presents a comparative study of different threat modeling methods and risk assessment approaches in organizational networks. The article also presents a novel comprehensive approach for quantifying risk assessment of organizational networks based on attack trees modified according to the factor analysis of information risk (FAIR) approach. Our results demonstrate the effectiveness of the novel approach in capturing the unique characteristics of different assets and their dependencies in an attack tree, leading to quantitative risk assessment.

Подходы к оценке защищённости информационных систем с криптографическим преобразованием объектов

The file system is one of the components of an information system, especially vulnerable to attacks by intruders. Consequently, it is impossible to increase the security level of an information system without ensuring a sufficient level of protection for file system objects, attacks on which affect, among other things, the interests of users of information systems. In order to make decisions on the use of certain mechanisms for protecting file system objects, a regular assessment of their current level of security is necessary. The purpose of the study. Building a model for assessing the security of an information system with cryptographic transformation of file system objects in the context of an attacker using a wide range of attacks on the file system. Materials and methods. The analysis of scientific publications on the problem of assessing the security of information systems allowed us to propose a methodology for assessing the security of information system assets. The methodology is based on a combination of a probabilistic approach to the analysis of possible scenarios for the implementation of threats in information systems for file system objects, expert assessments of basic attack events and representations in the form of attack trees. The threat implementation representation in the form of attack trees is used to simulate the actions of an attacker. Results. A structural model of an information system with cryptographic transformation of objects has been developed. Its valuable assets have been allocated. The list of the main threats to information security relevant for such systems is defined. Possible variants of the ways of implementing attacks and possible scenarios of the development of events in the processes of transferring file system objects with cryptographic transformation are modeled. A set of measures for the protection of information system objects with cryptographic transformation of objects is proposed. The calculation of the probabilities of attacks on an asset along the path determined by the attack tree, the possibility of implementing an attack, the degree of effectiveness of the proposed countermeasures is proposed. Conclusion. The presented methodology for assessing the security of an information system with cryptographic transformation of objects makes it possible to use well-known approaches in a comprehensive manner, and will be useful to developers and researchers in practical and scientific activities to ensure information security.

Threat modeling AI/ML with the Attack Tree

Threat modeling AI/ML with the Attack Tree

Securing Cloud-Assisted Connected and Autonomous Vehicles: An In-Depth Threat Analysis and Risk Assessment.

As threat vectors and adversarial capabilities evolve, Cloud-Assisted Connected and Autonomous Vehicles (CCAVs) are becoming more vulnerable to cyberattacks. Several established threat analysis and risk assessment (TARA) methodologies are publicly available to address the evolving threat landscape. However, these methodologies inadequately capture the threat data of CCAVs, resulting in poorly defined threat boundaries or the reduced efficacy of the TARA. This is due to multiple factors, including complex hardware-software interactions, rapid technological advancements, outdated security frameworks, heterogeneous standards and protocols, and human errors in CCAV systems. To address these factors, this study begins by systematically evaluating TARA methods and applying the Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privileges (STRIDE) threat model and Damage, Reproducibility, Exploitability, Affected Users, and Discoverability (DREAD) risk assessment to target system architectures. This study identifies vulnerabilities, quantifies risks, and methodically examines defined data processing components. In addition, this study offers an attack tree to delineate attack vectors and provides a novel defense taxonomy against identified risks. This article demonstrates the efficacy of the TARA in systematically capturing compromised security requirements, threats, limits, and associated risks with greater precision. By doing so, we further discuss the challenges in protecting hardware-software assets against multi-staged attacks due to emerging vulnerabilities. As a result, this research informs advanced threat analyses and risk management strategies for enhanced security engineering of cyberphysical CCAV systems.

Development of a flow intrusion model for effectiveness evaluation in nuclear power plant security system

The fundamental purpose of the security system in a nuclear power plant is to thwart any adversary attempting to breach the facility by means of detection, delay, and response. This study introduces a novel flow intrusion model (FIM) that integrates the EASI method and Bayesian Attack Tree to assess the effectiveness and sensitivity of the security system. In contrast to the conventional effectiveness evaluation technique, which utilizes the enumeration method to compute the vulnerable path, the FIM method concentrates on a thorough analysis of the dynamic and static risks inherent in the security system. To facilitate a practical analysis of the FIM, a minimum case is presented.

Integrated Attack Tree in Residual Risk Management Framework

Safety-critical cyber-physical systems (CPSs), such as high-tech cars having cyber capabilities, are highly interconnected. Automotive manufacturers are concerned about cyber attacks on vehicles that can lead to catastrophic consequences. There is a need for a new risk management approach to address and investigate cybersecurity risks. Risk management in the automotive domain is challenging due to technological improvements and advances every year. The current standard for automotive security is ISO/SAE 21434, which discusses a framework that includes threats, associated risks, and risk treatment options such as risk reduction by applying appropriate defences. This paper presents a residual cybersecurity risk management framework aligned with the framework presented in ISO/SAE 21434. A methodology is proposed to develop an integrated attack tree that considers multiple sub-systems within the CPS. Integrating attack trees in this way will help the analyst to take a broad perspective of system security. Our previous approach utilises a flow graph to calculate the residual risk to a system before and after applying defences. This paper is an extension of our initial work. It defines the steps for applying the proposed framework and using adaptive cruise control (ACC) and adaptive light control (ALC) to illustrate the applicability of our work. This work is evaluated by comparing it with the requirements of the risk management framework discussed in the literature. Currently, our methodology satisfies more than 75% of their requirements.

Survey: Automatic generation of attack trees and attack graphs

Graphical security models constitute a well-known, user-friendly way to represent the security of a system. These classes of models are used by security experts to identify vulnerabilities and assess the security of a system. The manual construction of these models can be tedious, especially for large enterprises. Consequently, the research community is trying to address this issue by proposing methods for the automatic generation of such models. In this work, we present a survey illustrating the current status of the automatic generation of two popular kinds of graphical security models: Attack Trees and Attack Graphs. The goal of this survey is to present the current methodologies used in the field, compare them, and present the challenges and future directions to the research community.

Modelling and analysis of social engineering threats using the attack tree and the Markov model

Modelling and analysis of social engineering threats using the attack tree and the Markov model

Invasive bark beetle Dryocoetes himalayensis (Coleoptera: Curculionidae: Scolytinae) – A threat for walnut trees (Juglans spp.) in Europe?

AbstractAs walnut trees (Juglans spp.) are of high economic importance, considerable attention has been given to invasive pests of these trees in Europe. In 2016, Dryocoetes himalayensis Strohmeyer, 1908, an alien bark beetle originating from the Himalayas region of India, already present in several European countries, was confirmed to have attacked walnut trees in the Czech Republic. Within the present study, we (i) surveyed the current distribution of D. himalayensis in the Czech Republic, (ii) examined D. himalayensis phenology by rearing it in trap logs, and (iii) investigated tree level habitat preferences of the species in two study stands with 180 black walnut (Juglans nigra L.) trees and 66 common walnut (Juglans regia L.) trees sampled. The present study documented the species to be relatively widespread in some warmer lowland regions of the Czech Republic (42 localities found) and to reach high abundance locally. Almost 15 thousand D. himalayensis individuals reared from the trap logs showed the species emerging throughout the whole vegetation period with a distinctive peak in June. Even though the species is able to develop in thin stems (diameter <5 cm), it is most numerous in thicker trunk bases and also preferably attacks trees of higher diameters. The species preferred common walnut trees (its native host) with decreased vitality. In contrast, black walnut trees (North American species) were attacked regardless of their vitality, but the vitality of occupied trees successively decreased. Based on our results, D. himalayensis should be assumed as a considerable pest of walnut trees (particularly black walnuts), which might become of significant importance in its European invasive range in the future, and thus substantial attention should be given to it.

Efficient and Generic Algorithms for Quantitative Attack Tree Analysis

Numerous analysis methods for quantitative attack tree analysis have been proposed. These algorithms compute relevant security metrics, i.e. performance indicators that quantify how good the security of a system is; typical metrics being the most likely attack, the cheapest, or the most damaging one. However, existing methods are only geared towards specific metrics or do not work on general attack trees. This paper classifies attack trees in two dimensions: proper trees vs. directed acyclic graphs (i.e. with shared subtrees); and static vs. dynamic gates. For three out of these four classes, we propose novel algorithms that work over a generic attribute domain, encompassing a large number of concrete security metrics defined on the attack tree semantics; dynamic attack trees with directed acyclic graph structure are left as an open problem. We also analyse the computational complexity of our methods.

Deep Reinforcement Learning for Intelligent Penetration Testing Path Design

Penetration testing is an important method to evaluate the security degree of a network system. The importance of penetration testing attack path planning lies in its ability to simulate attacker behavior, identify vulnerabilities, reduce potential losses, and continuously improve security strategies. By systematically simulating various attack scenarios, it enables proactive risk assessment and the development of robust security measures. To address the problems of inaccurate path prediction and difficult convergence in the training process of attack path planning, an algorithm which combines attack graph tools (i.e., MulVAL, multi-stage vulnerability analysis language) and the double deep Q network is proposed. This algorithm first constructs an attack tree, searches paths in the attack graph, and then builds a transfer matrix based on depth-first search to obtain all reachable paths in the target system. Finally, the optimal path for target system attack path planning is obtained by using the deep double Q network (DDQN) algorithm. The MulVAL double deep Q network(MDDQN) algorithm is tested in different scale penetration testing environments. The experimental results show that, compared with the traditional deep Q network (DQN) algorithm, the MDDQN algorithm is able to reach convergence faster and more stably and improve the efficiency of attack path planning.