Master Assignment
[MSc Thesis] Comparing attack graphs with business process models for modeling attacker strategies
Type: Master EE/CS/HMI etcÂ
Period: TBD
Student: (Unassigned)
If you are interested please contact :
Background:
Both attack graphs and business process models have been used in the literature to model attacker strategies. Alert-driven attack graphs are extracted from discrete markovian finite state automata that are great for modeling the semantic meaning of symbols, i.e., identical symbols that have different futures/pasts are modeled using different states. On the other hand, business process models are great for modeling concurrency, i.e., modeling simultaneous attacker actions. In this project, we aim to compare the merits of each approach in modeling attacker strategies from a dataset of intrusion alerts collected through a penetration testing competition. We also aim to combine the two approaches to get the best of both worlds, i.e., modeling concurrent attacker actions while also considering their semantic meaning.