Reusable Attack Tree Patterns Using Common Attack Pattern Enumeration and Classification

Attack trees are a threat analysis method that breaks down cyber attack scenarios into individual steps that an attacker can choose. While this generally has the advantage of being able to structurally represent threats to target information systems, it also has cost-related challenges such as requiring a high level of expertise, experience, and sufficient working time for analysis. To address this, we propose a method to generate attack tree patterns from Common Attack Pattern Enumeration and Classification (CAPEC) attack patterns and reuse them to improve the efficiency of attack tree generation. In this study, we (1) developed a method to generate attack tree patterns from CAPEC, (2) verified the effectiveness of the proposed method through a case study targeting web application systems, and (3) developed and evaluated an automatic generation tool for attack tree patterns. The case study demonstrated that patterns could be reused when local subgoals matched, even for scenarios with different final goals across different web application systems. Additionally, the developed automatic generation tool was able to appropriately convert 71% of CAPEC patterns into attack tree patterns. In the first half of this paper, we introduce the proposed method and describe the verification results through case studies. In the latter half, we report on the performance evaluation of the automatic generation tool for attack tree patterns.