Regression Nodes: Extending attack trees with data from social sciences

Research output: Chapter in Book/Report/Conference proceedingConference contributionAcademicpeer-review

1 Citation (Scopus)

Abstract

In the field of security, attack trees are often used to assess security vulnerabilities probabilistically in relation to multi-step attacks. The nodes are usually connected via AND-gates, where all children must be executed, or via OR-gates, where only one action is necessary for the attack step to succeed. This logic, however, is not suitable for including human interaction such as that of social engineering, because the attacker may combine different persuasion principles to different degrees, with different associated success probabilities. Experimental results in this domain are typically represented by regression equations rather than logical gates. This paper therefore proposes an extension to attack trees involving a regression-node, illustrated by data obtained from a social engineering experiment. By allowing the annotation of leaf nodes with experimental data from social science, the regression-node enables the development of integrated socio-technical security models.
Original languageUndefined
Title of host publicationProceedings of the Workshop on Socio-Technical Aspects in Security and Trust (STAST 2015)
Place of PublicationPiscataway, New Jersey
PublisherIEEE Computer Society
Pages17-23
Number of pages7
ISBN (Print)978-1-5090-0178-1
DOIs
Publication statusPublished - Jul 2015

Publication series

Name
PublisherIEEE Computer Society

Keywords

  • SCS-Cybersecurity
  • EWI-26273
  • EC Grant Agreement nr.: FP7/318003
  • Social Engineering
  • METIS-312711
  • Regression
  • IR-97196
  • Attack Tree
  • EC Grant Agreement nr.: FP7/2007-2013

Cite this

Bullee, J-W., Montoya, L., Pieters, W., Junger, M., & Hartel, P. H. (2015). Regression Nodes: Extending attack trees with data from social sciences. In Proceedings of the Workshop on Socio-Technical Aspects in Security and Trust (STAST 2015) (pp. 17-23). Piscataway, New Jersey: IEEE Computer Society. https://doi.org/10.1109/STAST.2015.11