The RipA Model: On the Domino Effect in Attacks against Informatization Architectures

For informatization architectures with complex information interactions and dependencies, adversaries can exploit the relations among platforms and businesses that originally serve to maintain normal architecture operations, causing threats generated by attacks to transmit, spread, and amplify toward other components. We refer to this inherently unavoidable threat transmission pattern based on operational mechanisms as “threat ripple,” and the resulting chain reactions of abnormal states as “ripple effects,” namely, the domino effects formed by threat ripple. This paper discusses the formation and evolution mechanisms of such domino effects from a business oriented perspective. Traditional threat models cannot adequately describe this attack pattern. Our paper designs an architecture model that integrates platforms and businesses for an informatization architecture, and explains the dependencies within it, as well as the attack methods through which an adversary can generate threat ripples. Based on this, we construct a RipA model to reflect how threats leverage internal dependencies to produce ripple effects, and corresponding mathematical representations are developed to support threat computation. Grounded in the architecture model, the proposed RipA model can characterize the domino effect of threat transmission within the architecture following an attack. By modelling a power production scenario, it is demonstrated that the proposed threat modelling approach can be used to evaluate threat events and support the quantitative analysis of threats.