Guiding Threat Analysis with Threat Source Models

Threat analysis identifies how potential adversaries exploit system weaknesses to achieve their goals. Attack graphs are one method to conduct threat analysis by exposing vulnerability relationships, allowing administrators to pinpoint high risk paths. However, computational and cognitive complexity challenges must be dealt with. One method for managing threat analysis and attack graph complexity is to differentiate between likely and unlikely attack paths using threat source models. Threat source models are used during risk assessments to describe likely and unlikely adversary behavior, and so can be used for the same purpose during attack graph analysis. The framework presented here allows threat source models to guide attack graph generation to remove unlikely attack paths.