Novel Color Coded MITRE ATT&CK Inspired Attack Tree Modeling: Application in ICSs

As the alarming trend of industrial and critical-infrastructure systems targeting by sophisticated APT actors continues, the need for accurate and effective modeling of adversary behavior in these systems has becomes even more pressing. Namely, models of complex attacks that do not contain all the relevant information, or are visually inordinate and difficult to comprehend or navigate, are more likely to: 1) impede the overall understanding of attack strategies and objectives, for both cybersecurity experts and non-experts; 2) result in poor decision making, such as selection and implementation of inadequate defences against the modeled attacks. In this work, we first explain the main difference between the concepts of ‘attack modeling’ and ‘threat modeling’. Subsequently, we survey the existing most prominent attack modelling techniques (AMTs), while emphasizing their respective pros and cons. Next, we also survey the most recent research works that deal with the (in)effectiveness of the existing AMTs from the visual representation and human perception perspective. As the main contribution of this work, we propose a novel attack visualization approach that merges the traditional attack-trees with the MITRE ATT&CK methodology. We name this technique Color Coded MITRE ATT&CK Inspired Attack Tree (CC-MATT-AT) modeling. CC-MATT-AT is able to produces attack representations that are visually far superior to models produced using attack trees or MITRE ATT&CK alone – which is especially important and evident in the case of complex attacks. Finally, we demonstrate the practical use and potential advantages of our CC-MATT-AT modeling by building a representation of one of the best-known attacks on industrial control systems to date (Sutxnet).