Measuring Coverage of Attack Simulations on MAL Attack Graphs

Nicklas Hersén

Summary

With the transition from traditional media and the increasing number of digital devices, the threats against digital infrastructure is greater than ever before. New and stricter security requirements are placed on digital platform in order to protect sensitive information against external cyber threats. Threat modeling is a process which involves identifying threats and weakness of a system with the purpose of eliminating vulnerabilities before they are exploited. The Meta Attack Language is a probabilistic threat modeling language which allows security researchers to instantiate specific attack scenarios through the use of attack simulations. Currently there is no support for gathering coverage data from these simulations other than manually checking the compromised state of all objects present in a simulation. The purpose of this work is to develop a coverage extension in order to simplify the threat modeling process. The coverage extension is able to produce coverage estimates from attack simulations executed on specific Meta Attack Language threat models. These metrics are adaptations of existing code- and model coverage metrics commonly used for software- and model testing. There are limitations in what type of data can be effectively presented (such as for exponentially growing data sets) due to the simplicity of the models.