Scalable Attack Representation Model Using Logic Reduction Techniques

Automated construction methods of attack graphs (AGs) and their improved attack representation models (ARMs) have been proposed, but the AG has a state space explosion when analysing the security of very large sized networked systems. Instead, attack trees (ATs) and their improved ARMs can be used (e.g., Defense Trees, Protection Trees, Attack Response Trees, and Attack Countermeasure Trees), because they are a non-state-space model. However, there are no known methods to construct ATs in a scalable manner automatically while maintaining all possible attack scenarios. We can use an AG generation tools, and transform the AG into the AT using min-cuts. However, this method requires a transformation (i.e., an overhead), and computing min-cuts is a NP-hard problem. Another way is to construct ATs directly with given network information. A naive approach is to compute all possible attack paths and populate the AT branches using logic gates (e.g., AND and OR gates), but this method generates an exponential number of nodes, causing a scalability problem. We propose two logic reduction techniques to automate the ATs construction and to reduce the size of the AT. The computational complexity is calculated. The simulation result shows the construction time for the naive method and two logic reduction techniques. The trade-off between the construction time and the memory usage of simplified ATs are also shown.