Security Argument Graph Generation

• Security argument graph generation is a process that automates the construction of graphical models—such as attack trees—by formalizing system, workflow, and adversary data.
• It employs various methodologies including logic-based, model-based, grammar-based, learning-based, and template-driven approaches to achieve scalable and repeatable security assessments.
• Key algorithms iteratively extend base graphs using predefined templates, balancing automation with the accuracy and interpretability needed for robust risk evaluations.

Security argument graph generation denotes a class of automated methods and frameworks for constructing graphical formalisms—such as attack trees, attack graphs, or more general security argument graphs—that integrate diverse security-relevant information to facilitate security assessment, risk management, and system evaluation. These methods formalize domain knowledge, system architecture, workflows, and known/possible adversary actions, supporting both qualitative and quantitative reasoning about system security properties. Research in this field addresses the need for scalable, repeatable, and accurate model construction, overcoming limitations of manual methods in capturing the complex dependencies present in modern socio-technical systems (Konsta et al., 2023, Tippenhauer et al., 2014).

1. Formal Definition and Graph Model Structures

A security argument graph $(\omega)$ is defined as a triple: $\omega := (V, E, \ell)$ where $V$ is a finite set of vertices, $E \subseteq V \times V$ is a set of directed edges, and $\ell: V \to A$ assigns to each vertex an attribute tuple that encapsulates both static (e.g., node type, identifier) and mutable (e.g., probabilistic, logical) properties (Tippenhauer et al., 2014). Nodes commonly correspond to system elements such as goals, workflow steps, actor and component availabilities, attack steps, or attacker properties. Edges encode arguments about how one node’s property or occurrence is contingent on others.

Graph growth proceeds via local extensions: each local extension is a pair $(v_r, \omega_r)$ where $v_r$ is an expandable vertex and $\omega_r$ is a small star graph introducing new predecessor nodes into $v_r$. Templates, defined as $(m_\gamma, f_\gamma)$, encapsulate recurring “argument patterns.” The matching function $\omega := (V, E, \ell)$0 determines applicability (where $\omega := (V, E, \ell)$1 denotes the environment—inputs, system models), and $\omega := (V, E, \ell)$2 constructs the corresponding extension.

2. Taxonomy of Generation Methodologies

The automatic generation of security argument graphs can be classified into five families (Konsta et al., 2023):

Family	Core Principle	Key Example Methods
Logic-Based	Encode system in formal logic; use solver/model checker to extract violating paths	Sheyner et al.: nuSMV; Bezawada et al.: PDDL Planning
Model-Based	Transform system models using graph grammar or rule systems	Gadyatskaya et al.: TREsPASS; Ivanova et al.
Grammar-Based	Parse traces/event logs with CFGs; parse tree becomes argument graph	Pinchinat et al.; Jhawar et al.
Learning-Based	Statistical/neural models classify which nodes/edges to include	Koo et al.: DNN/Random Forest on CVE
Template-Driven	Repeated instantiation of argument patterns/templates against configs	Phillips & Swiler: Pattern Matching; Bryant et al.

Each approach exploits a different form of available structure (formal models, logs, vulnerability databases, configuration files) and matches problem domains and scalability/automation tradeoffs.

3. Key Algorithms and Extension Patterns

Graph generation algorithms universally rely on iteratively extending a base graph by matching templates to vertices given environmental context (Tippenhauer et al., 2014). For template-driven methods, the standard iterative driver is:

$V$2

Core extension templates, each encoding “argument patterns,” include:

• T₁: Security Goal $\omega := (V, E, \ell)$3 ActionAvailability (final step of workflow)
• T₂: ActionAvailability $\omega := (V, E, \ell)$4 predecessor ActionAvailability (action-dependency)
• T₃: ActionAvailability $\omega := (V, E, \ell)$5 ActorAvailability (who executes), MessageAvailability (communicated data)
• T₄: ActorAvailability $\omega := (V, E, \ell)$6 ComponentAvailability (actor-to-component mapping)
• T₅: ComponentAvailability $\omega := (V, E, \ell)$7 sub-properties (device composition)
• T₆: ComponentAvailability $\omega := (V, E, \ell)$8 AttackStep (attacks on a non-decomposable property)
• T₇: AttackStep $\omega := (V, E, \ell)$9 AttackerProperty (capability prerequisites)

Each template provides a precondition, transformation rule, and postcondition, formalized in terms of vertex types and system/attacker model data (Tippenhauer et al., 2014).

4. End-to-End Generation Pipelines and Data Inputs

The input artifacts required for automated security argument graph generation typically consist of:

• Security Goal: The root property or invariant to assess.
• Workflow Descriptions: Sequences or graphs of actions (with actors) capturing business or control logic.
• System Model: Actor-to-component mappings, network topology, component hierarchies, and decomposition trees.
• Attacker Catalog: Taxonomies of possible attack steps and requisite attacker properties (Tippenhauer et al., 2014).

Prototypical end-to-end workflows (as seen in both (Konsta et al., 2023, Tippenhauer et al., 2014)) include:

• Model-checking pipelines (formal architectural models, safety properties specified in CTL, enumeration of counterexample paths).
• Template-matching pipelines (network configuration, template instantiation until fixpoint).
• Grammar-parsing pipelines (log/event trace parsing, argument extraction from parse trees).
• Learning-based pipelines (classification over CVE-labeled data to propose graph edges/paths).

The CyberSAGE prototype, for example, supports XML import of workflow, system, and attacker models, and implements the template-driven graph growth algorithm in Java with rapid runtimes (≈50-node graphs synthesized in under one second) (Tippenhauer et al., 2014).

5. Comparative Analysis: Scalability, Automation, Accuracy, Domain Applicability

Empirical evaluation of generation approaches highlights key differences (Konsta et al., 2023):

• Scalability: Model checking approaches suffer from state-space explosion and typically do not scale beyond dozens of hosts; template-driven approaches yield linear scaling in network size and template count (hundreds of hosts in seconds).
• Automation Level: Fully automatic pipelines are feasible with logic, planning, or CFG-based approaches; semi-automatic pipelines combine user input (initial trees, action selection) with automated refinement.
• Accuracy and Completeness: Learning-based methods report high accuracy against ground-truth attack data (e.g., Koo et al.: 88.8%/95.7% accuracy on prerequisite/postcondition relations), while logic-based approaches are complete with respect to their input models but can overapproximate possible attack scenarios. Template-driven approaches depend on the coverage of the template library, potentially missing zero-days.
• Domain Applicability: Logic/model-driven approaches are best suited to formally specified networks or protocols (e.g., SCADA, TREsPASS); template and CFG-based approaches accommodate known configuration structures or observed logs.

6. Key Challenges and Research Directions

Ongoing research themes and open problems include (Konsta et al., 2023):

• Combinatorial Explosion: Scalability is challenged by the product of large networks and extensive template or event libraries; methods for abstraction and summarization (e.g., macro-nodes) are under investigation.
• Dynamic and Evolving Systems: Most frameworks lack robust support for incremental updates concurrent with system evolution; only limited partial regeneration capabilities are present (e.g., Phillips & Swiler).
• Data Scarcity and Novel Attacks: Template and learning-based approaches are limited by available labeled data (CVE/CAPEC databases); the inability to model zero-days is a recurrent limitation.
• Formal Guarantees: A lack of soundness and completeness proofs pervades template- and grammar-based approaches, though formalizations exist for certain restricted cases (e.g., SAND trees—NP complexity proven by Audinot & Pinchinat).
• Expert Involvement and Output Interpretability: Balancing automation with meaningful, actionable outputs remains nontrivial; highly automatic mechanisms may generate excessively large or spurious graphs, requiring semi-automatic or interactive refinement.
• Rich Model Support: Emerging models (SAND, $V$0-out-of-$V$1, attack-defense extensions) exhibit little automation; initial progress has been made (e.g., Gadyatskaya ADT generation), but these areas remain active research directions.

7. Guidelines and Best Practices for Practitioners

Best practices in the deployment of security argument graph generation include (Konsta et al., 2023):

• Input Selection: Use logic-based approaches when formal system models are available; template-driven approaches are efficient given config files; grammar-based for trace/log-based evidence.
• Automation vs. Interpretability: Logic-based pipelines yield maximal coverage but may admit spurious paths; template and learning-based approaches are more pragmatic for real-world exploits but risk incompleteness. Hybrid pipelines offer compromise.
• Abstraction and Scaling: Prune the search space via threat scoring or aggregation; use CVSS thresholds or subnet summarization to limit graph growth.
• Resource Maintenance: Regularly update CVE/CAPEC databases (for ML/template approaches) and version system models to facilitate incremental analysis.
• Verification and Validation: Benchmark outputs against execution logs (logic-based) or known attack scenarios (template/ML); quantitative metrics such as precision/recall support tool evaluation.

Security argument graph generation synthesizes methodologically diverse approaches to automate and systematize the construction of security argumentation models, significantly advancing capabilities in security assessment and risk management across complex engineered systems (Konsta et al., 2023, Tippenhauer et al., 2014).