Theory of Graphical Security Models extending Attack Trees

Threat modeling, utilizing graphical security models, is a comprehensive approach to understanding a system at its fundamental security level. The primary objective is to systematically identify and assess all potential threats that the system may face.

This practice is consider integral to the construction of a robust security system. Attack Trees, a term initially introduced by Schneier, is eventually a simple framework for threat modeling. As defined, they represent a formalized mean of describing a system's security by illustrating potential attacks it may face.

Despite the advances in the existing literature and the fact that the state-of-the-art idea behind both threat modeling and attack trees is rational, there has been a lack of significant advancement in recent years. Nevertheless, these models continue to serve a valuable purpose in terms of explanation, demonstration, and discussion. Even so, an intriguing approach for their further exploration involves leveraging them as a decidable and formalized means to identify and mitigate future and recurring threats.

By evolving these models into more automated frameworks, there exists potential to create a systematic, rule-based approach to threat detection and provide solutions.

The research aims to unfold a twofold investigation. Firstly, on the theoretical front, the idea is to investigate the limitations existing and try to delve into the realms of theory and theorem proving. The aim is to establish semantics that can transform trees into a more comprehensible, reusable, and more effective, in terms of their construction, means for threat analysis.

Simultaneously, on the practical side, we aim to investigate the automated approach for constructing attack trees. This automation aims to encourage a broader acceptance of the utilization of attack trees as a threat modeling approach. This approach is anticipated to include latest techniques like artificial intelligence, fostering their widespread integration into risk analysis practices.