Milan Lopuhaä-Zwakenberg

Which attacks are most critical? Risk prioritization via attack tree importance measures

Attack Trees (ATs) are widely used to model and analyze security risks. Quantitative AT analysis can furthermore express risk with multiple metrics such as required attacker cost, time, and skill. This gives a detailed security assessment of the system as a whole, but does not come with a notion of which attacks are mo...