Extent of an Attack in an Attack Graph: Method to Evaluate Evidence Set

Evaluating the impact of an attack in a system is essential for prioritizing response towards simultaneous threats. While some attacks will impact lower-valued resources of the system, whereas other attacks have an impact on disrupting critical components. A quantifiable metric for impact would serve as a valuable tool to prioritize attack scenarios based on their potential damage. Our study proposes a structural approach to measure the severity of an attack by integrating a vulnerability assessment framework that includes the Common Vulnerability Scoring System (CVSS) score, the Exploit Prediction Scoring System (EPSS) score, along with economic factors.