Reversible Attack Trees

Attack trees are threat modeling formalism for identifying potential ways a system may be compromised. The underlying idea of this formalism is that possible attack points of a system are modeled as a set of nodes, together with the set of atomic actions which an attacker may execute to compromise the system. However, as attack trees are not designed from the administrator’s point of view, they are not equipped with sets of protection actions which can be used to stop an ongoing attack. In this paper we introduce reversible attack trees, as a variant of attack trees for which an ongoing attack can be fully or partially reset to the original state of the system. Then, we investigate whether the system administrator can detect whether a possible attack has reached some critical point in which his or her action is needed to prevent the attack by bringing the system to its initial state. Later, we show how this can be modeled by Timed Automata and checked by software tool UPPAAL.