Which attacks are most critical? Risk prioritization via attack tree importance measures

Abstract

Attack Trees (ATs) are widely used to model and analyze security risks. Quantitative AT analysis can furthermore express risk with multiple metrics such as required attacker cost, time, and skill. This gives a detailed security assessment of the system as a whole, but does not come with a notion of which attacks are most critical. Understanding such criticality can significantly contribute to risk prioritization. To fill these gaps in AT, we propose Importance Measures (IMs) for ATs that quantify how important a single attack step is to the overall success or likelihood of the attack. We analyze cost- and probability-based attack models that reflect common operational scenarios among researchers, such as persistent adversaries against systems with limited detection capabilities and single-attempt attacks in high-security environments. Our framework supports arbitrary monotone metrics and provides a framework allowing the study of many metrics. We apply our proposed framework to a real-world case study taken from the MITRE ATT&CK knowledge source. Our results show how importance measures can identify high-leverage attack steps that substantially reduce attacker effort or increase success probability, and how defenders can use our approach to prioritize mitigations under limited resources.