Special Issue Paper
Attack countermeasure trees (ACT): towards unifying the constructs of attack and defense trees
Article first published online: 2 FEB 2011
Copyright © 2011 John Wiley & Sons, Ltd.
Security and Communication Networks
Special Issue: Defending Against Insider Threats and Internal Data Leakage
Volume 5, Issue 8, pages 929–943, August 2012
How to Cite
Roy, A., Kim, D. S. and Trivedi, K. S. (2012), Attack countermeasure trees (ACT): towards unifying the constructs of attack and defense trees. Security Comm. Networks, 5: 929–943. doi: 10.1002/sec.299
- Issue published online: 25 JUL 2012
- Article first published online: 2 FEB 2011
- attack trees;
- non-state-space model;
- return on attack;
- return on investment
Attack tree (AT) is one of the widely used non-state-space models for security analysis. The basic formalism of AT does not take into account defense mechanisms. Defense trees (DTs) have been developed to investigate the effect of defense mechanisms using measures such as attack cost, security investment cost, return on attack (ROA), and return on investment (ROI). DT, however, places defense mechanisms only at the leaf nodes and the corresponding ROI/ROA analysis does not incorporate the probabilities of attack. In attack response tree (ART), attack and response are both captured but ART suffers from the problem of state-space explosion, since solution of ART is obtained by means of a state-space model. In this paper, we present a novel attack tree paradigm called attack countermeasure tree (ACT) which avoids the generation and solution of a state-space model and takes into account attacks as well as countermeasures (in the form of detection and mitigation events). In ACT, detection and mitigation are allowed not just at the leaf node but also at the intermediate nodes while at the same time the state-space explosion problem is avoided in its analysis. We study the consequences of incorporating countermeasures in the ACT using three case studies (ACT for BGP attack, ACT for a SCADA attack and ACT for malicious insider attacks). Copyright © 2011 John Wiley & Sons, Ltd.