Adversarial Formal Semantics of Attack Trees and Related Problems
Résumé
Security is a subject of increasing attention in our actual society in order to protect critical resourcesfrom information disclosure, theft or damage. The informal model of attack trees introduced bySchneier, and widespread in the industry, is advocated in the 2008 NATO report to govern the evaluationof the threat in risk analysis. Attack-defense trees have since been the subject of many theoreticalworks addressing different formal approaches.In 2017, M. Audinot et al. introduced a path semantics over a transition system for attack trees.Inspired by the latter, we propose a two-player interpretation of the attack-tree formalism. To doso, we replace transition systems by concurrent game arenas and our associated semantics consistof strategies. We then show that the emptiness problem, known to be NP-complete for the pathsemantics, is now PSPACE-complete. Additionally, we show that the membership problem is CONPcompletefor our two-player interpretation while it collapses to P in the path semantics.