[Paper Review] ADTool: Security Analysis with Attack-Defense Trees (Extended Version)

Barbara Kordy, Piotr Kordy+2 more|arXiv (Cornell University)|May 29, 2013

Information and Cyber Security19 references3 citations

TL;DR

ADTool is a free, open-source software tool for constructing and quantitatively analyzing attack-defense trees (ADTrees), a formalism that models both attacker and defender actions in security scenarios. It supports automated bottom-up evaluation of security metrics using attribute-based computation, enabling scalable, accurate risk assessment with intuitive graphical modeling and formal verification of model correctness.

ABSTRACT

The ADTool is free, open source software assisting graphical modeling and quantitative analysis of security, using attack-defense trees. The main features of the ADTool are easy creation, efficient editing, and automated bottom-up evaluation of security-relevant measures. The tool also supports the usage of attack trees, protection trees and defense trees, which are all particular instances of attack-defense trees.

Motivation & Objective

• Address the lack of free, open-source tools that support both graphical modeling and quantitative analysis of attack-defense trees.
• Provide a user-friendly environment that enforces syntactic correctness in ADTree models to prevent modeling errors.
• Enable automated, bottom-up computation of security metrics using formal attribute domains to support risk assessment.
• Support integration of attack trees, protection trees, and defense trees as special cases of attack-defense trees.
• Facilitate industrial and academic adoption of ADTree methodology through extensible, modular software architecture and cross-platform availability.

Proposed method

• Uses an extended ADTree formalism that models attacker and defender actions as interdependent nodes in a hierarchical AND-OR tree structure.
• Employs a bottom-up evaluation algorithm that computes metric values from atomic actions (non-refined nodes) using user-defined attribute domains and operators.
• Implements an enhanced version of Walker’s tree layout algorithm with improvements from Buchheim et al. for visually appealing tree rendering.
• Supports model creation via context menus and keyboard shortcuts, ensuring syntactic correctness during construction.
• Uses Java with reflection-based plugin architecture to allow dynamic extension of new attribute domains without recompilation.
• Integrates with free libraries (abego TreeLayout, InfoNode Docking Windows) for efficient layout and flexible GUI management.

Experimental results

Research questions

• RQ1 How can a free and open-source tool support both the creation and quantitative analysis of attack-defense trees in a unified environment?
• RQ2 What design principles enable ADTool to ensure syntactic correctness of ADTree models while remaining user-friendly?
• RQ3 To what extent does ADTool scale in handling large-scale security models with thousands of nodes?
• RQ4 How does the integration of attack, defense, and protection trees within a single formalism improve security analysis compared to isolated models?
• RQ5 What are the practical benefits of using a formally grounded, attribute-based computation framework for security metrics in ADTrees?

Key findings

• ADTool enables instant quantitative evaluation of ADTrees, with computations performed in a bottom-up manner that scales efficiently with tree size.
• The tool supports models with over ten thousand nodes, though layout recalculation may cause a five-second delay when adding new nodes.
• The use of Java reflection allows runtime extension of new attribute domains without recompiling the core application.
• ADTool outperforms existing tools by combining visual modeling, formal verification, and automated quantitative analysis in a single, open-source environment.
• The tool has been successfully applied in a real-world case study involving quantitative threat analysis of an electronic voting system.
• The ADTool’s modular architecture and open-source nature make it a viable, extensible alternative to commercial tools like SecurITree and AttackTree+.