Defense Tree (DD-Tree)

• Defense Tree (DD-Tree) is a formal security modeling framework that integrates attacker goals with explicit defensive actions using AND-OR refinements.
• It extends traditional attack trees by embedding defensive counterstrategies within a structured model to enable both qualitative and quantitative risk assessments.
• Tool support via ADTool and QuADTool and scalable algorithms facilitate efficient evaluation of security scenarios and optimal defense investment.

Defense Tree (DD-Tree) denotes a defense-oriented security tree formalism used to represent attacker goals, defensive counteractions, and the refinement of both into smaller subgoals or actions. In contemporary attack-defense-tree literature, a defense tree is most commonly treated not as an independently implemented formalism, but as a restricted instance of the broader attack-defense tree (ADTree) framework: “attack trees, protection trees and defense trees, are all particular instances of attack-defense trees” (Kordy et al., 2013). At the same time, adjacent literatures use closely related structures with different emphases, including attack trees with defense annotations at attack leaves and online planning trees over defender actions. This suggests that “Defense Tree” names a stable modeling idea—explicit reasoning about defensive structure—more reliably than a single universally fixed syntax (Mollah et al., 9 Dec 2025, Li et al., 5 Jan 2026).

1. Position within the attack-defense-tree lineage

The modern technical interpretation of a Defense Tree is anchored in the ADTree framework. In that reading, a defense tree is a historical or restricted defense-oriented pattern that can be embedded into the more general attacker-defender formalism. The decisive modeling move is that defense is not merely an external note on an attack model; it is incorporated into the tree language itself (Kordy et al., 2013).

The relationship among the principal formalisms is summarized below.

Formalism	Characterization	Relation to Defense Tree
Attack tree	Only attacker actions/goals, no explicit defender counteractions	Simpler than a defense tree
Protection tree	Emphasizes protections/countermeasures against attacks	Closely related defense-oriented variant
Defense tree	Attack-oriented tree enriched with defensive components	Historical/narrow form
Attack-defense tree	Umbrella formalism that subsumes the above	Generalization/subsuming framework

A more expressive ADT line goes further than older defense-oriented variants by giving “attackers and defenders equal capabilities,” including intermediate and root-level defensive goals rather than only leaf-level safeguards (Copae et al., 17 Apr 2025). QuADTool adopts this richer attack-defense-tree viewpoint and is best seen as a related and often more expressive formalism than classical defense-tree variants, rather than as a terminological duplicate (Dorfhuber et al., 2024).

2. Syntax, node types, and semantics

In the ADTree interpretation, the core model is a rooted tree whose nodes belong to one of two opposing players: the attacker and the defender. The root represents the main goal of one of them. That goal is decomposed through an AND-OR refinement structure, and every node may be counteracted by a subtree rooted in a node of the opposite player. This explicit counteraction relation is what makes ADTrees strictly richer than ordinary attack trees and what allows defense trees to be represented as a restricted subclass (Kordy et al., 2013).

Several semantic points are central for defense-tree interpretation. First, defensive mechanisms are represented as defender nodes rather than as mere annotations. Second, refinement is available through disjunctive refinement, corresponding to alternative ways to achieve a goal, and conjunctive refinement, corresponding to multiple subgoals that all need to be achieved. Third, a non-refined node in an ADTree is not necessarily a graphical leaf, because such a node can still be countered even if it has no refining children. This matters for defense trees because an atomic defensive action can still participate in attacker-defender interaction (Kordy et al., 2013).

A more formal ADT presentation models an attack-defense structure as a rooted directed acyclic graph

$T = (N,E,\gamma,\tau,\vartheta),$

where gate types satisfy

$\gamma(v) \in \{BS, AND, OR, INH\},$

and actor types satisfy

$\tau(v) \in \{A,D\}.$

Here, basic steps are leaves, internal nodes refine a goal conjunctively or disjunctively, and the inhibition gate captures the contested pattern “the main subgoal succeeds and the opposing counteraction fails” (Copae et al., 17 Apr 2025).

A recurring misconception is to treat any attack tree with attached mitigations as a full defense tree. The connected-vehicle vulnerability paper is explicit that its construction is “best understood as a standard attack tree extended with defense annotations at attack leaves.” Attacks remain primary, defenses are attached as mitigations to leaf attacks, and there is no explicit alternation where a defense can itself be countered by an attack node and then counter-countered again (Mollah et al., 9 Dec 2025).

3. Quantitative attributes and evaluation

Quantitative analysis is one of the principal reasons to use defense-tree-like models. In ADTool, standard analysis proceeds by assigning numerical values to all atomic actions, that is, non-refined nodes, and then computing values for all remaining nodes automatically in a bottom-up way. The computation is governed by attribute domains, which determine the operators used for different node configurations. The supported measure classes include real-valued attributes such as time, cost, and probability; level-based attributes such as required skill level or reachability within less than $k$ units of time; and Boolean properties such as satisfiability of a scenario. The complexity of the bottom-up algorithm is linear in the number of nodes (Kordy et al., 2013).

This bottom-up style can be made substantially more defense-centered. A recent extension introduces separate attribute domains for defender and attacker and associates to them separate basic assignments

$$\beta_D : \mathcal{D}\to V_D,\qquad \beta_A : \mathcal{A}\to V_A.$$

The aggregate value of a defense vector and the aggregate value of an attack vector are then evaluated independently, and the target object becomes a Pareto front over defender and attacker metrics. The dominance relation is defined as

$$(s_1,t_1)\sqsubseteq (s_2,t_2) \quad\text{iff}\quad s_1 \preceq_D s_2 \ \text{and}\ t_1 \succeq_A t_2,$$

so the analysis formalizes the goal of spending less on defense while forcing the attacker to incur more cost, time, skill, or probability burden (Copae et al., 17 Apr 2025).

The attribute framework is semiring-parametric. Explicit examples include minimum cost, minimum sequential time, minimum parallel time, minimum skill, and probability. For tree-structured ADTs, the Pareto front is computed by a bottom-up dynamic algorithm with dominance pruning; for general DAG-shaped ADTs, the method translates the model into a reduced ordered binary decision diagram. The paper reports that both approaches effectively handle ADTs with several hundred nodes (Copae et al., 17 Apr 2025).

This quantitative line broadens the meaning of defense-tree analysis. It is no longer limited to asking whether an attack succeeds; it can ask which defensive investments are Pareto-optimal against an attacker’s best response. A plausible implication is that the most technically mature defense-tree research increasingly lies inside general ADT frameworks rather than in standalone defense-tree syntaxes.

4. Tool support, scalability, and verification backends

ADTool remains the canonical practical environment for defense-tree-style modeling within the ADTree lineage. It is free, open source software for graphical modeling and quantitative analysis, with easy creation, efficient editing, and automated bottom-up evaluation of security-relevant measures. Because defense trees are treated as ADTree instances, they use the same integrated workflow: graphical construction of syntactically correct models, immediate synchronization with the corresponding attack-defense term (ADTerm), bottom-up attribute evaluation, and consistency checks such as the rule that nodes labeled with the same name automatically receive the same value (Kordy et al., 2013).

The same tool support applies to defense-tree instances as to full ADTrees: folding and expanding, zooming, temporarily hiding subtrees, saving as .adt, exporting to pdf, png, jpeg, and tex, and printing over multiple pages. Quantitative evaluation is instantaneous relative to model size because the evaluation procedure is linear, while the practical bottleneck for very large models is rendering. The paper states that the tool easily handles a few thousand nodes, whereas for more than ten thousand nodes interactive editing may incur delays because node positions are recalculated (Kordy et al., 2013).

QuADTool extends the tooling landscape by combining synthesis, quantitative analysis, and export to formal verification backends. It supports GUI construction as well as import from DOT, ADTool XML, and ATBEST models; it performs exact or probably approximately correct (PAC) analysis; and it exports to PRISM, PRISM-games, MODEST, and UPPAAL, with STORM reachable indirectly via MODEST-to-JANI export (Dorfhuber et al., 2024).

QuADTool is especially significant because it addresses imprecise quantitative inputs. For PAC analysis it restricts the bottom-up method to a simpler static fragment using $AND$, $OR$, and $NOT$, and propagates both error and uncertainty from the leaves to the root. The paper reports feasible exports for literature-size models, most evaluations below 10 seconds, and a highest execution time of 1.2 seconds for 1355-node PAC/non-PAC experiments (Dorfhuber et al., 2024).

5. Domain-specific and operational reinterpretations

Although the classical Defense Tree is rooted in security modeling, recent work applies related tree ideas in ways that only partially match the traditional formalism. In connected and autonomous vehicle vulnerability analysis, the chosen “attack-defense tree” is explicitly attack-centered: the root node is the attacker’s ultimate goal of compromising the CAV system or a major CAV function, intermediate nodes are sub-goals, and the finest-grained attack events are scored as attack leaves $\mathcal{I}_i$. Defensive countermeasures are attached to those leaves, but the model is “closest to a defense-enriched attack tree” rather than to a fully alternating ADTree calculus (Mollah et al., 9 Dec 2025).

In LLM safety, ACE-Safety uses a jailbreak strategy search tree built by Monte Carlo Tree Search. The explicit tree is over attacker strategy choices, while the defender appears in node evaluation and in later co-evolutionary training. The paper therefore classifies the method as only partially approximating a Defense Tree: explicitly it is an attack strategy tree with group-aware search; implicitly it is an attack-defense interaction tree embedded in a co-evolutionary loop (Li et al., 24 Nov 2025).

In automated cyber defense, ACDZero develops a defender-centric MCTS planning tree over defensive actions in a partially observable cyber environment. The root is a latent state

$\gamma(v) \in \{BS, AND, OR, INH\},$0

tree edges represent defensive actions $\gamma(v) \in \{BS, AND, OR, INH\},$1, and branch values are predicted future rewards rather than Boolean success or bottom-up attributes. The paper is explicit that this is not a classical attack-defense tree with explicit attacker nodes and AND/OR semantics, but rather a “decision-theoretic defense tree” generated online from current observations (Li et al., 5 Jan 2026).

These reinterpretations mark an important boundary. The underlying intuition—branching over defensive possibilities—persists, but the formal object changes from a static symbolic security model into a search tree, game tree approximation, or online planning structure. This suggests that “defense tree” now spans both symbolic attacker-defender decomposition and defender-side decision planning under uncertainty.

6. Acceptability, limitations, and terminological ambiguity

Empirical work on acceptability indicates that defense-tree-style models are not limited to highly technical audiences. A Method Evaluation Model-based study with $\gamma(v) \in \{BS, AND, OR, INH\},$2 participants—53 with a strong computer science background and 49 with a limited computer science background—found that “a very limited technical background is sufficient for ADT acceptability.” The measured dimensions were Actual Effectiveness, Perceived Ease of Use, Perceived Usefulness, and Intention To Use, and the study reports that ADTs were viable for users with limited technical background after short training (Schiele et al., 17 Feb 2025).

The practical significance is strongest for communication. The study found no meaningful disadvantage for the limited-background group in many comprehension, construction, and perceived-usefulness measures, and it reports equivalence for communication-oriented judgments. This is directly relevant to defense trees because they are frequently used not only for analysis but also for communicating security reasoning across stakeholder groups (Schiele et al., 17 Feb 2025).

At the same time, the literature is clear about scope limits. ADTool is primarily a tool paper; it does not present a defense-tree-specific semantics separate from ADTrees, and it does not spell out the exact embedding conditions of every subclass in that text (Kordy et al., 2013). Many recent “tree” methods relevant to defense are therefore not canonical Defense Trees in the classical sense.

There is also genuine terminological ambiguity. In speculative decoding, “DDTree” denotes “Diffusion Draft Tree,” a method for constructing draft trees from per-position marginals for block diffusion drafters, and is unrelated to security defense modeling (Zhang et al., 1 Jun 2026). This suggests that the acronym “DD-Tree” is not standardized across fields, whereas the defense-tree concept remains anchored more reliably by its attacker-defender modeling semantics than by its shorthand name.