Generating Attack Scenarios by Detecting Multi-Step Threats With OWASP Pytm

Abstract

As modern IT systems become increasingly complex, sophisticated attacks that sequentially exploit multiple system components have become more prevalent. However, existing automated threat modeling tools primarily identify threats at individual components, making it difficult to identify complex attack paths spanning multiple system components. This paper presents pytm-Seq, an automated threat modeling tool that identifies feasible multi-step attack paths using extended Data Flow Diagrams (DFDs) augmented with functional-type and data-flow-order attributes. The tool derives reusable threat patterns from STIX-based attack scenarios and identifies feasible attack paths by matching these patterns against the extended DFDs through constraint-aware graph traversal. It further enriches the identified attack paths with component-level vulnerability information using a large language model (LLM). For evaluation, we analyze a dataset of 150 real-world attack cases from various domains to construct a threat knowledge base comprising 52 reusable multi-step threat patterns. We then evaluate pytm-Seq on a separate dataset of 150 attack cases and compare its performance with state-of-the-art threat modeling tools. Experimental results show that pytm-Seq achieves a precision of 0.89, a recall of 0.88, an F1-score of 0.89, consistently outperforming existing threat modeling tools.