Paper 2010/412

Optimal Adversary Behavior for the Serial Model of Financial Attack Trees

Margus Niitsoo


Attack tree analysis is used to estimate different parameters of general security threats based on information available for atomic subthreats. We focus on estimating the expected gains of an adversary based on both the cost and likelihood of the subthreats. Such a multi-parameter analysis is considerably more complicated than separate probability or skill level estimation, requiring exponential time in general. However, this paper shows that under reasonable assumptions a completely different type of optimal substructure exists which can be harnessed into a linear-time algorithm for optimal gains estimation. More concretely, we use a decision-theoretic framework in which a rational adversary sequentially considers and performs the available attacks. The assumption of rationality serves as an upper bound as any irrational behavior will just hurt the end result of the adversary himself. We show that if the attacker considers the attacks in a goal-oriented way, his optimal expected gains can be computed in linear time. Our model places the least restrictions on adversarial behavior of all known attack tree models that analyze economic viability of an attack and, as such, provides for the best efficiently computable estimate for the potential reward.

Available format(s)
Publication info
Published elsewhere. Longer version of that published at IWSEC 2010
attack treessecurity analysis
Contact author(s)
margus niitsoo @ ut ee
2010-07-24: received
Short URL
Creative Commons Attribution


      author = {Margus Niitsoo},
      title = {Optimal Adversary Behavior for the Serial Model of Financial Attack Trees},
      howpublished = {Cryptology ePrint Archive, Paper 2010/412},
      year = {2010},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.