Merging Attack Trees and MITRE ATT&CK Tactics for More Effective Attack Modeling

At present, attack trees/graphs and MITRE ATT &CK Navigator representations are considered to be the most effective ways of visually depicting a cyber attack. In this work, we first discuss the effectiveness of each of these approaches from the perspective of human perception and comprehension. We then propose a novel attack modeling technique that merges the traditional attack-trees with the MITRE ATT&CK methodology. We name this technique Color Coded MITRE ATT&CK Inspired Attack Tree (CC-MATT-AT) modeling. CC-MATT-AT is able to produces attack representations that are visually far superior than models produced by either attack trees or MITRE ATT &CK alone - which becomes especially important and evident in the case of complex attacks. Finally, we demonstrate the practical use and potential advantages of our novel technique by presenting a CC-MATT -AT model of one of the best-known hybrid attacks (i.e., attacks that span both IT and OT environments) to date - Sutxnet.