### Abstract

Automated construction methods of attack graphs (AGs) and their improved attack representation models (ARMs) have been proposed, but the AG has a state space explosion when analysing the security of very large sized networked systems. Instead, attack trees (ATs) and their improved ARMs can be used (e.g., Defense Trees, Protection Trees, Attack Response Trees, and Attack Countermeasure Trees), because they are a non-state-space model. However, there are no known methods to construct ATs in a scalable manner automatically while maintaining all possible attack scenarios. We can use an AG generation tools, and transform the AG into the AT using min-cuts. However, this method requires a transformation (i.e., an overhead), and computing min-cuts is a NP-hard problem. Another way is to construct ATs directly with given network information. A naive approach is to compute all possible attack paths and populate the AT branches using logic gates (e.g., AND and OR gates), but this method generates an exponential number of nodes, causing a scalability problem. We propose two logic reduction techniques to automate the ATs construction and to reduce the size of the AT. The computational complexity is calculated. The simulation result shows the construction time for the naive method and two logic reduction techniques. The trade-off between the construction time and the memory usage of simplified ATs are also shown.

Original language | English |
---|---|

Title of host publication | Proceedings - 12th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2013 |

Place of Publication | United States |

Publisher | IEEE, Institute of Electrical and Electronics Engineers |

Pages | 404-411 |

Number of pages | 8 |

ISBN (Print) | 9780769550220 |

DOIs | |

Publication status | Published - 1 Dec 2013 |

Externally published | Yes |

Event | 12th IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom 2013) - Melbourne, VIC, Australia Duration: 16 Jul 2013 → 18 Jul 2013 |

### Conference

Conference | 12th IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom 2013) |
---|---|

Country | Australia |

City | Melbourne, VIC |

Period | 16/07/13 → 18/07/13 |

### Fingerprint

### Cite this

*Proceedings - 12th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2013*(pp. 404-411). [6680868] United States: IEEE, Institute of Electrical and Electronics Engineers. https://doi.org/10.1109/TrustCom.2013.51

}

*Proceedings - 12th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2013.*, 6680868, IEEE, Institute of Electrical and Electronics Engineers, United States, pp. 404-411, 12th IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom 2013), Melbourne, VIC, Australia, 16/07/13. https://doi.org/10.1109/TrustCom.2013.51

**Scalable attack representation model using logic reduction techniques.** / Hong, Jin Bum; Kim, Dong Seong; Takaoka, Tadao.

Research output: Chapter in Book/Conference paper › Conference paper

TY - GEN

T1 - Scalable attack representation model using logic reduction techniques

AU - Hong, Jin Bum

AU - Kim, Dong Seong

AU - Takaoka, Tadao

PY - 2013/12/1

Y1 - 2013/12/1

N2 - Automated construction methods of attack graphs (AGs) and their improved attack representation models (ARMs) have been proposed, but the AG has a state space explosion when analysing the security of very large sized networked systems. Instead, attack trees (ATs) and their improved ARMs can be used (e.g., Defense Trees, Protection Trees, Attack Response Trees, and Attack Countermeasure Trees), because they are a non-state-space model. However, there are no known methods to construct ATs in a scalable manner automatically while maintaining all possible attack scenarios. We can use an AG generation tools, and transform the AG into the AT using min-cuts. However, this method requires a transformation (i.e., an overhead), and computing min-cuts is a NP-hard problem. Another way is to construct ATs directly with given network information. A naive approach is to compute all possible attack paths and populate the AT branches using logic gates (e.g., AND and OR gates), but this method generates an exponential number of nodes, causing a scalability problem. We propose two logic reduction techniques to automate the ATs construction and to reduce the size of the AT. The computational complexity is calculated. The simulation result shows the construction time for the naive method and two logic reduction techniques. The trade-off between the construction time and the memory usage of simplified ATs are also shown.

AB - Automated construction methods of attack graphs (AGs) and their improved attack representation models (ARMs) have been proposed, but the AG has a state space explosion when analysing the security of very large sized networked systems. Instead, attack trees (ATs) and their improved ARMs can be used (e.g., Defense Trees, Protection Trees, Attack Response Trees, and Attack Countermeasure Trees), because they are a non-state-space model. However, there are no known methods to construct ATs in a scalable manner automatically while maintaining all possible attack scenarios. We can use an AG generation tools, and transform the AG into the AT using min-cuts. However, this method requires a transformation (i.e., an overhead), and computing min-cuts is a NP-hard problem. Another way is to construct ATs directly with given network information. A naive approach is to compute all possible attack paths and populate the AT branches using logic gates (e.g., AND and OR gates), but this method generates an exponential number of nodes, causing a scalability problem. We propose two logic reduction techniques to automate the ATs construction and to reduce the size of the AT. The computational complexity is calculated. The simulation result shows the construction time for the naive method and two logic reduction techniques. The trade-off between the construction time and the memory usage of simplified ATs are also shown.

KW - Attack Tree

KW - Complexity Analysis

KW - Model Simplification

KW - Scalability

KW - Security Model

UR - http://www.scopus.com/inward/record.url?scp=84893466433&partnerID=8YFLogxK

U2 - 10.1109/TrustCom.2013.51

DO - 10.1109/TrustCom.2013.51

M3 - Conference paper

SN - 9780769550220

SP - 404

EP - 411

BT - Proceedings - 12th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2013

PB - IEEE, Institute of Electrical and Electronics Engineers

CY - United States

ER -