Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Automated Repeatable Adversary Threat Emulation with Effects Language (EL)

Suresh K. Damodaran, Paul D. Rowe

TL;DR

The paper tackles the challenge of automatically emulating multi-step adversary TTPs in a repeatable, tool-agnostic way. It introduces Effects Language (EL), a visually defined, directly executable coordination language, and provides a formal execution semantics to drive attack graphs with asynchronous precondition evaluation and distributed execution. A Wizard Spider-based example demonstrates how EL can model, execute, and produce proof-of-attack traces, while experimental results show meaningful reductions in time and labor for initial and repeated emulations. The work delivers a structured, collaborative framework for defensive tool evaluation, cyber range experiments, and what-if analyses, enabling scalable and verifiable threat emulation across diverse environments.

Abstract

The emulation of multi-step attacks attributed to advanced persistent threats is valuable for training defenders and evaluating defense tools. In this paper, we discuss the numerous challenges and desired attributes associated with such automation. Additionally, we introduce the use of Effects Language (EL), a visual programming language with graph-based operational semantics, as a solution to address many of these challenges and requirements. We formally define the execution semantics of EL, and prove important execution properties. Furthermore, we showcase the application of EL to codify attacks using an example from one of the publicly available attack scenarios. We also demonstrate how EL can be utilized to provide proof-of-attack of complex multi-step attacks. Our results highlight the improvements in time and resource efficiency achieved through the use of EL for repeatable automation.

Automated Repeatable Adversary Threat Emulation with Effects Language (EL)

TL;DR

The paper tackles the challenge of automatically emulating multi-step adversary TTPs in a repeatable, tool-agnostic way. It introduces Effects Language (EL), a visually defined, directly executable coordination language, and provides a formal execution semantics to drive attack graphs with asynchronous precondition evaluation and distributed execution. A Wizard Spider-based example demonstrates how EL can model, execute, and produce proof-of-attack traces, while experimental results show meaningful reductions in time and labor for initial and repeated emulations. The work delivers a structured, collaborative framework for defensive tool evaluation, cyber range experiments, and what-if analyses, enabling scalable and verifiable threat emulation across diverse environments.

Abstract

The emulation of multi-step attacks attributed to advanced persistent threats is valuable for training defenders and evaluating defense tools. In this paper, we discuss the numerous challenges and desired attributes associated with such automation. Additionally, we introduce the use of Effects Language (EL), a visual programming language with graph-based operational semantics, as a solution to address many of these challenges and requirements. We formally define the execution semantics of EL, and prove important execution properties. Furthermore, we showcase the application of EL to codify attacks using an example from one of the publicly available attack scenarios. We also demonstrate how EL can be utilized to provide proof-of-attack of complex multi-step attacks. Our results highlight the improvements in time and resource efficiency achieved through the use of EL for repeatable automation.

Paper Structure

This paper contains 41 sections, 9 theorems, 11 equations, 9 figures, 4 tables, 9 algorithms.

Table of Contents

  1. Introduction
  2. Effective Automated TTP Emulation
  3. Attack Plan is a Directed Graph.
  4. Visual Representation.
  5. Diversity of Attack Command Implementations.
  6. Preconditions.
  7. Duration of Attack.
  8. Proof of Attack.
  9. Continuity.
  10. Support Roles.
  11. Debugging and Performance.
  12. Attack Resilience.
  13. Distributed Operating Environment.
  14. Restoration of Operating Environment.
  15. EL is a Visual Language
  16. ...and 26 more sections

Key Result

Theorem 1

At the end of each line of Algorithm alg:main, the sets $I, \widehat{D}, \widehat{A}, F$ partition the nodes of the graph $G$.

Figures (9)

  • Figure 1: Non-goal terminal node
  • Figure 2: EL Example with Annotated Rules
  • Figure 3: EL IDE
  • Figure 4: Roles
  • Figure 5: The standard node state sequence is from inactive to active to fired.
  • ...and 4 more figures

Theorems & Definitions (18)

  • Definition 1
  • Definition 2
  • Definition 3
  • Theorem 1
  • Lemma 1
  • Lemma 2
  • Lemma 3
  • Theorem 2
  • proof
  • Definition 4
  • ...and 8 more