Fuzzy Attack Tree: Assessing Cyberattack Risk Using Attack Tree and Fuzzy Logic

Nitin Naik, Paul Jenkins, Paul Grace, Dishita Naik, Jingping Song, Shaligram Prajapat, Durgesh Mishra, Longzhi Yang, Tossapon Boongoen, Natthakan Iam-On

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

Abstract

Organisations and users have been experiencing significant rises in cyberattacks and their severity, which means that they require a greater awareness and understanding of the anatomy of cyberattacks, to prevent and mitigate their effects. In analysing cyberattacks, there are a number of different approaches that may be used to assess their potential risks and effects. However, these are utilised in specific types of cyberattacks and their analysis, which means they cannot be applied in every situation or cyberattack. Moreover, several other factors may influence the decision to use these approaches, such as cost, complexity, skills and adaptability. As a result, continuous research to design and enhance these approaches is undertaken to produce a generic, cost-effective, easy and adaptable approach. This paper presents one such approach to assess the risk of cyberattacks utilising an attack tree and fuzzy logic. An attack tree is a systematic and illustrative method for describing an attack on a system and analysing its taxonomy and other aspects. Subsequently, the probability and risk of each leaf node in the attack tree are calculated using the proposed formulas. Finally, fuzzy logic enables decision making based on imprecise data and heuristics to obtain the overall risk of attack. This proposed approach comprises systematic steps to accomplish an assessment of any cyberattack and its associated risks in an uncomplicated and effective manner, enabling its prevention and mitigation to be determined. The paper illustrates an application of the proposed approach to assess the risk of an information theft attack on an organisation, which can then be utilised to assess the risk of other cyberattacks.
Original languageEnglish
Title of host publication2023 IEEE International Conference on ICT in Business Industry & Government (ICTBIG)
Place of PublicationPiscataway
PublisherIEEE
Number of pages9
ISBN (Electronic)9798350343274
ISBN (Print)9798350343281
DOIs
Publication statusPublished - 8 Dec 2023
Event3rd International Conference on ICT in Business Industry & Government (ICTBIG 2023) - Indore, India
Duration: 8 Dec 20239 Dec 2023
Conference number: 3rd
https://indore.hosting.acm.org/ictbig2023/index.htm

Conference

Conference3rd International Conference on ICT in Business Industry & Government (ICTBIG 2023)
Abbreviated titleICTBIG
Country/TerritoryIndia
CityIndore
Period8/12/239/12/23
Internet address

Cite this