Regression Nodes: Extending attack trees with data from social sciences

Jan-Willem Bullee, L. Montoya, Wolter Pieters, Marianne Junger, Pieter H. Hartel

Research output: Chapter in Book/Report/Conference proceedingConference contributionAcademicpeer-review

2 Citations (Scopus)
2 Downloads (Pure)


In the field of security, attack trees are often used to assess security vulnerabilities probabilistically in relation to multi-step attacks. The nodes are usually connected via AND-gates, where all children must be executed, or via OR-gates, where only one action is necessary for the attack step to succeed. This logic, however, is not suitable for including human interaction such as that of social engineering, because the attacker may combine different persuasion principles to different degrees, with different associated success probabilities. Experimental results in this domain are typically represented by regression equations rather than logical gates. This paper therefore proposes an extension to attack trees involving a regression-node, illustrated by data obtained from a social engineering experiment. By allowing the annotation of leaf nodes with experimental data from social science, the regression-node enables the development of integrated socio-technical security models.
Original languageUndefined
Title of host publicationProceedings of the Workshop on Socio-Technical Aspects in Security and Trust (STAST 2015)
Place of PublicationPiscataway, New Jersey
Number of pages7
ISBN (Print)978-1-5090-0178-1
Publication statusPublished - Jul 2015
EventWorkshop on Socio-Technical Aspects in Security and Trust, STAST 2015 - Verona, Italy
Duration: 13 Jul 201513 Jul 2015

Publication series

PublisherIEEE Computer Society


ConferenceWorkshop on Socio-Technical Aspects in Security and Trust, STAST 2015
Abbreviated titleSTAST 2015


  • SCS-Cybersecurity
  • EWI-26273
  • EC Grant Agreement nr.: FP7/318003
  • Social Engineering
  • METIS-312711
  • Regression
  • IR-97196
  • Attack Tree
  • EC Grant Agreement nr.: FP7/2007-2013

Cite this