Towards an automated attack tree generator for the IoT

Abstract

The growing frequency and scale of cyber security attacks is daunting. Notable areas of concern are the Internet of Things (IoT) and Operational Technology (OT) systems; the IoT is becoming intimately integrated into our lives, and the physical repercussions of attacks on OT systems can be devastating. Risk analysis tools can prove to be very helpful towards defining counter measures that can either prevent or dampen the effect of these seemingly inevitable cyber security attacks. One such tool, attack trees, provide a formal way of describing the varying attacks that could be mounted against a system. Though they are limited because their development is time intensive, work has been done on automating this process with attack tree generators. In this thesis, we provide suggested design modifications to be made on existing attack tree generators to work on IoT and OT systems.