Attack tree metrics are operad algebras

TL;DR

The paper addresses the fragmentation of attack-tree metrics by introducing a unifying, category-theoretic framework where AT metrics are defined as operad algebras over the Attack Tree operad. By encoding ATs as anchored trees and metrics as morphisms to endomorphism operads, it achieves modularity, extensibility to dynamic ATs and attack-defense trees, and compatibility with existing algorithms. It demonstrates necessary and sufficient conditions for operad-metric applicability, and develops generalized bottom-up and BDD-based algorithms within this framework, including the novel concept of scoperads to handle DAG-ATs. The result is a broad, principled foundation that subsumes prior definitions, supports extensions, and provides scalable metric computation across diverse AT formalisms with practical implications for security analysis.

Abstract

Attack Trees (ATs) are a widely used tool for security analysis. ATs can be employed in quantitative security analysis through metrics, which assign a security value to an AT. Many different AT metrics exist, and there exist multiple general definitions that aim to study a wide variety of AT metrics at once. However, these all have drawbacks: they do not capture all metrics, and they do not easily generalize to extensions of ATs. In this paper, we introduce a definition of AT metrics based on category theory, specifically operad algebras. This encompasses all previous definitions of AT metrics, and is easily generalized to extensions of ATs. Furthermore, we show that under easily expressed operad-theoretic conditions, existing metric calculation algorithms can be extended in considerable generality.

Figures (11)

• Figure 1: Attack tree of an attacker robbing a bank ($r$). They can either take the money by force ($f$), or they steal the money ($s$) by purchasing lockpicks for the vault ($l$) and breaking in at night ($b$).
• Figure 2: The conflicting definitions of the min time metric in previous work, for dynamic ATs $T_1$ and $T_2$. The time of BAS $a$ is denoted $t_a$.
• Figure 3: Modular composition of ATs.
• Figure 4: The map $\tau_{\sigma}(f)$ represented diagrammatically: first $\sigma^{-1}$ is applied to permute the arguments, and then $f$ is applied to the permuted arguments.
• Figure 5: Axiom 4) of Definition \ref{['def:operad']} for the endomorphism operad $\underline{\operatorname{End}}(X)$: Applying $f$ to arguments of the form $\tau_{\sigma_i}(g_i)$ yields the same function as first permuting all arguments via $(\sigma_1,\ldots,\sigma_{n})^{-1}$ and then applying $f \star \vec{g}$.

Theorems & Definitions (47)

• Definition 2.1
• Definition 2.2
• Definition 2.3
• Definition 2.4
• Definition 3.1
• Example 3.2
• Example 3.3
• Remark 3.4
• Definition 3.5
• Definition 3.6