An Adversary Effort Based Attack Probability Model

The correct assessment of cyber attack probabilities is an important factor in evaluating the cyber risk a system is exposed to. While research shows that the attack probability is strongly dependent on the effort an adversary has to spent to execute the attack, currently no model yet takes this into account to evaluate the overall cyber risk of a given system. To fill this gap, this paper introduces a novel model that estimates attack path probabilities based on the corresponding vulnerability exploitation efforts. First, the effort to execute each attack step is estimated based on the availability of vulnerabilities, corresponding exploits and an attacker skill model. The resulting exploitation efforts are then used to calculate the probabilities for single attack steps, which are then combined to complete attack paths. The complete model is also demonstrated using a practical example and compared to a basic evaluation using Common Vulnerability Scoring System scores.